diff --git a/.buildkite/disabled_jest_configs.json b/.buildkite/disabled_jest_configs.json
index fe51488c7066f6..0d7741e60b385e 100644
--- a/.buildkite/disabled_jest_configs.json
+++ b/.buildkite/disabled_jest_configs.json
@@ -1 +1,3 @@
-[]
+[
+  "x-pack/plugins/index_management/jest.config.js"
+]
\ No newline at end of file
diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml
index 95588c63f7489e..0f7a75bde18695 100644
--- a/.buildkite/ftr_configs.yml
+++ b/.buildkite/ftr_configs.yml
@@ -225,9 +225,7 @@ enabled:
   - x-pack/test/detection_engine_api_integration/basic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group4/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group10/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts
   - x-pack/test/disable_ems/config.ts
   - x-pack/test/encrypted_saved_objects_api_integration/config.ts
   - x-pack/test/examples/config.ts
@@ -450,10 +448,14 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/configs/serverless.config.ts
@@ -462,7 +464,6 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/default_license/risk_engine/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/entity_analytics/default_license/risk_engine/configs/ess.config.ts
-
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/management/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/management/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/bundled_prebuilt_rules_package/configs/serverless.config.ts
@@ -471,3 +472,5 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/large_prebuilt_rules_package/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/update_prebuilt_rules_package/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/update_prebuilt_rules_package/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/ess.config.ts
\ No newline at end of file
diff --git a/.buildkite/pipelines/quality-gates/pipeline.tests-qa.yaml b/.buildkite/pipelines/quality-gates/pipeline.tests-qa.yaml
index ede4f047c7a111..feac7bdb17848a 100644
--- a/.buildkite/pipelines/quality-gates/pipeline.tests-qa.yaml
+++ b/.buildkite/pipelines/quality-gates/pipeline.tests-qa.yaml
@@ -5,7 +5,7 @@
 steps:
   - label: ":kibana: Kibana Serverless Tests for ${ENVIRONMENT}"
     trigger: appex-qa-serverless-kibana-ftr-tests # https://buildkite.com/elastic/appex-qa-serverless-kibana-ftr-tests
-    soft_fail: true # Remove this before release or when tests stabilize
+    soft_fail: true # Remove when tests stabilize
     build:
       env:
         ENVIRONMENT: ${ENVIRONMENT}
@@ -16,7 +16,6 @@ steps:
   # TODO: Uncomment this code when the integration is ready.
   # - label: ":pipeline::female-detective::seedling: Trigger Security Solution quality gate script"
   #   trigger: security-serverless-quality-gate # https://buildkite.com/elastic/security-serverless-quality-gate
-  #   soft_fail: true # Remove this when tests are fixed
   #   build:
   #     env:
   #       ENVIRONMENT: ${ENVIRONMENT}
@@ -53,7 +52,7 @@ steps:
       - label: ":judge::seedling: Trigger Manual Tests Phase - Observability"
         command: "make -C /agent trigger-manual-verification-phase"
         env:
-          NOTIFICATION_APPENDIX: "<!subteam^S060GJFKGGP> please execute your manual testing plan."
+          NOTIFICATION_APPENDIX: "<!subteam^S896GM05A> please execute your manual testing plan."
           USE_GROUP_LABEL: true
         agents:
           image: "docker.elastic.co/ci-agent-images/manual-verification-agent:0.0.6"
diff --git a/.buildkite/pipelines/quality-gates/pipeline.tests-staging.yaml b/.buildkite/pipelines/quality-gates/pipeline.tests-staging.yaml
index 2630b555aa7a00..6b450aad7553ef 100644
--- a/.buildkite/pipelines/quality-gates/pipeline.tests-staging.yaml
+++ b/.buildkite/pipelines/quality-gates/pipeline.tests-staging.yaml
@@ -13,7 +13,7 @@ steps:
 
   - label: ":kibana: Kibana Serverless Tests for ${ENVIRONMENT}"
     trigger: appex-qa-serverless-kibana-ftr-tests # https://buildkite.com/elastic/appex-qa-serverless-kibana-ftr-tests
-    soft_fail: true # Remove this before release or when tests stabilize
+    soft_fail: true # Remove when tests stabilize
     build:
       env:
         ENVIRONMENT: ${ENVIRONMENT}
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 19b62559fa3c08..109bab65da3d2a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -28,6 +28,7 @@ packages/kbn-ambient-storybook-types @elastic/kibana-operations
 packages/kbn-ambient-ui-types @elastic/kibana-operations
 packages/kbn-analytics @elastic/kibana-core
 packages/analytics/client @elastic/kibana-core
+packages/analytics/utils/analytics_collection_utils @elastic/kibana-core
 test/analytics/plugins/analytics_ftr_helpers @elastic/kibana-core
 test/analytics/plugins/analytics_plugin_a @elastic/kibana-core
 packages/analytics/shippers/elastic_v3/browser @elastic/kibana-core
@@ -38,8 +39,8 @@ packages/analytics/shippers/gainsight @elastic/kibana-core
 packages/kbn-apm-config-loader @elastic/kibana-core @vigneshshanmugam
 x-pack/plugins/apm_data_access @elastic/obs-knowledge-team @elastic/obs-ux-infra_services-team
 x-pack/plugins/apm @elastic/obs-ux-infra_services-team
-packages/kbn-apm-synthtrace @elastic/obs-ux-infra_services-team
-packages/kbn-apm-synthtrace-client @elastic/obs-ux-infra_services-team
+packages/kbn-apm-synthtrace @elastic/obs-ux-infra_services-team @elastic/obs-ux-logs-team
+packages/kbn-apm-synthtrace-client @elastic/obs-ux-infra_services-team @elastic/obs-ux-logs-team
 packages/kbn-apm-utils @elastic/obs-ux-infra_services-team
 test/plugin_functional/plugins/app_link_test @elastic/kibana-core
 x-pack/test/usage_collection/plugins/application_usage_test @elastic/kibana-core
@@ -314,6 +315,7 @@ src/plugins/data_view_field_editor @elastic/kibana-data-discovery
 src/plugins/data_view_management @elastic/kibana-data-discovery
 src/plugins/data_views @elastic/kibana-data-discovery
 x-pack/plugins/data_visualizer @elastic/ml-ui
+x-pack/plugins/dataset_quality @elastic/obs-ux-logs-team
 packages/kbn-datemath @elastic/kibana-data-discovery
 packages/deeplinks/analytics @elastic/kibana-data-discovery @elastic/kibana-presentation @elastic/kibana-visualizations
 packages/deeplinks/devtools @elastic/platform-deployment-management
@@ -417,7 +419,6 @@ x-pack/examples/gen_ai_streaming_response_example @elastic/response-ops
 packages/kbn-generate @elastic/kibana-operations
 packages/kbn-generate-console-definitions @elastic/platform-deployment-management
 packages/kbn-generate-csv @elastic/appex-sharedux
-packages/kbn-generate-csv-types @elastic/appex-sharedux
 packages/kbn-get-repo-files @elastic/kibana-operations
 x-pack/plugins/global_search_bar @elastic/appex-sharedux
 x-pack/plugins/global_search @elastic/appex-sharedux
@@ -543,8 +544,8 @@ src/plugins/no_data_page @elastic/appex-sharedux
 x-pack/plugins/notifications @elastic/appex-sharedux
 packages/kbn-object-versioning @elastic/appex-sharedux
 x-pack/plugins/observability_ai_assistant @elastic/obs-knowledge-team
-x-pack/packages/observability/alert_details @elastic/actionable-observability
-x-pack/packages/observability/alerting_test_data @elastic/actionable-observability
+x-pack/packages/observability/alert_details @elastic/obs-ux-management-team
+x-pack/packages/observability/alerting_test_data @elastic/obs-ux-management-team
 x-pack/test/cases_api_integration/common/plugins/observability @elastic/response-ops
 x-pack/plugins/observability_log_explorer @elastic/obs-ux-logs-team
 x-pack/plugins/observability_onboarding @elastic/obs-ux-logs-team
@@ -590,7 +591,16 @@ packages/kbn-repo-source-classifier @elastic/kibana-operations
 packages/kbn-repo-source-classifier-cli @elastic/kibana-operations
 packages/kbn-reporting/common @elastic/appex-sharedux
 x-pack/examples/reporting_example @elastic/appex-sharedux
+packages/kbn-reporting/export_types/csv @elastic/appex-sharedux
+packages/kbn-reporting/export_types/csv_common @elastic/appex-sharedux
+packages/kbn-reporting/export_types/pdf @elastic/appex-sharedux
+packages/kbn-reporting/export_types/pdf_common @elastic/appex-sharedux
+packages/kbn-reporting/export_types/png @elastic/appex-sharedux
+packages/kbn-reporting/export_types/png_common @elastic/appex-sharedux
+packages/kbn-reporting/mocks_server @elastic/appex-sharedux
 x-pack/plugins/reporting @elastic/appex-sharedux
+packages/kbn-reporting/public @elastic/appex-sharedux
+packages/kbn-reporting/server @elastic/appex-sharedux
 packages/kbn-resizable-layout @elastic/kibana-data-discovery
 examples/resizable_layout_examples @elastic/kibana-data-discovery
 x-pack/test/plugin_functional/plugins/resolver_test @elastic/security-solution
@@ -788,6 +798,7 @@ packages/kbn-unified-field-list @elastic/kibana-data-discovery
 examples/unified_field_list_examples @elastic/kibana-data-discovery
 src/plugins/unified_histogram @elastic/kibana-data-discovery
 src/plugins/unified_search @elastic/kibana-visualizations
+packages/kbn-unsaved-changes-badge @elastic/kibana-data-discovery
 x-pack/plugins/upgrade_assistant @elastic/platform-deployment-management
 x-pack/plugins/uptime @elastic/obs-ux-infra_services-team
 x-pack/plugins/drilldowns/url_drilldown @elastic/appex-sharedux
@@ -986,10 +997,11 @@ packages/kbn-monaco/src/esql @elastic/kibana-visualizations
 /x-pack/plugins/infra/public/common @elastic/obs-ux-infra_services-team
 /x-pack/plugins/infra/public/observability_logs @elastic/obs-ux-logs-team
 /x-pack/plugins/infra/public/services @elastic/obs-ux-infra_services-team
-/x-pack/test/functional/apps/infra @elastic/infra-monitoring-ui @elastic/obs-ux-infra_services-team @elastic/obs-ux-logs-team
+/x-pack/test/functional/apps/infra @elastic/infra-monitoring-ui @elastic/obs-ux-infra_services-team
+/x-pack/test/functional/apps/infra/logs @elastic/infra-monitoring-ui @elastic/obs-ux-logs-team
 /x-pack/test/api_integration/apis/infra @elastic/infra-monitoring-ui @elastic/obs-ux-infra_services-team
 
-# Actionable observability
+# Observability UX management team
 x-pack/packages/observability/alert_details @elastic/obs-ux-management-team
 x-pack/test/observability_functional @elastic/obs-ux-management-team
 x-pack/plugins/infra/public/alerting @elastic/obs-ux-management-team
@@ -1219,6 +1231,9 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/test/security_solution_cypress/cypress/e2e/investigations @elastic/security-threat-hunting-investigations
 /x-pack/test/security_solution_cypress/cypress/e2e/sourcerer/sourcerer_timeline.cy.ts @elastic/security-threat-hunting-investigations
 
+x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout  @elastic/security-threat-hunting-investigations
+x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout  @elastic/security-threat-hunting-investigations
+
 /x-pack/plugins/security_solution/public/common/components/alerts_viewer @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_action @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/common/components/event_details @elastic/security-threat-hunting-investigations
@@ -1227,7 +1242,8 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/public/detections/components/alerts_kpis @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/detections/components/alerts_table @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/detections/components/alerts_info @elastic/security-threat-hunting-investigations
-/x-pack/plugins/security_solution/public/flyout @elastic/security-threat-hunting-investigations
+/x-pack/plugins/security_solution/public/flyout/document_details @elastic/security-threat-hunting-investigations
+/x-pack/plugins/security_solution/public/flyout/shared @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/resolver @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/timelines @elastic/security-threat-hunting-investigations
 
@@ -1370,6 +1386,7 @@ x-pack/test/security_solution_api_integration/test_suites/detections_response/de
 x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation @elastic/security-detection-engine
 x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions @elastic/security-detection-engine
 x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts @elastic/security-detection-engine
+/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users @elastic/security-detection-engine
 
 ## Security Threat Intelligence - Under Security Platform
 /x-pack/plugins/security_solution/public/common/components/threat_match @elastic/security-detection-engine
diff --git a/.i18nrc.json b/.i18nrc.json
index 4a71e696efc1fe..6146398873d837 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -90,7 +90,7 @@
     "randomSampling": "x-pack/packages/kbn-random-sampling",
     "reactPackages": "packages/react",
     "textBasedEditor": "packages/kbn-text-based-editor",
-    "reporting": "packages/kbn-reporting/common",
+    "reporting": "packages/kbn-reporting",
     "savedObjects": "src/plugins/saved_objects",
     "savedObjectsFinder": "src/plugins/saved_objects_finder",
     "savedObjectsManagement": "src/plugins/saved_objects_management",
@@ -132,7 +132,8 @@
     "unifiedSearch": "src/plugins/unified_search",
     "unifiedFieldList": "packages/kbn-unified-field-list",
     "unifiedHistogram": "src/plugins/unified_histogram",
-    "unifiedDataTable": "packages/kbn-unified-data-table"
+    "unifiedDataTable": "packages/kbn-unified-data-table",
+    "unsavedChangesBadge": "packages/kbn-unsaved-changes-badge"
   },
   "translations": []
 }
diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index cfe971c8e01be9..64143589d01679 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index 7c724461a9e3ef..99efdc253e5391 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/aiops.devdocs.json b/api_docs/aiops.devdocs.json
index 85b78d1efc4820..4a976c737c794f 100644
--- a/api_docs/aiops.devdocs.json
+++ b/api_docs/aiops.devdocs.json
@@ -1337,10 +1337,10 @@
           },
           {
             "parentPluginId": "aiops",
-            "id": "def-public.LogRateAnalysisResultsData.significantTerms",
+            "id": "def-public.LogRateAnalysisResultsData.significantItems",
             "type": "Array",
             "tags": [],
-            "label": "significantTerms",
+            "label": "significantItems",
             "description": [
               "Statistically significant field/value items."
             ],
@@ -1349,8 +1349,8 @@
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTerm",
-                "text": "SignificantTerm"
+                "section": "def-common.SignificantItem",
+                "text": "SignificantItem"
               },
               "[]"
             ],
@@ -1360,10 +1360,10 @@
           },
           {
             "parentPluginId": "aiops",
-            "id": "def-public.LogRateAnalysisResultsData.significantTermsGroups",
+            "id": "def-public.LogRateAnalysisResultsData.significantItemsGroups",
             "type": "Array",
             "tags": [],
-            "label": "significantTermsGroups",
+            "label": "significantItemsGroups",
             "description": [
               "Statistically significant groups of field/value items."
             ],
@@ -1372,8 +1372,8 @@
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermGroup",
-                "text": "SignificantTermGroup"
+                "section": "def-common.SignificantItemGroup",
+                "text": "SignificantItemGroup"
               },
               "[]"
             ],
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index 354011bbf232e8..abd069d6bcc745 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.devdocs.json b/api_docs/alerting.devdocs.json
index e91a46ecfb7fbe..9505e1de3807c4 100644
--- a/api_docs/alerting.devdocs.json
+++ b/api_docs/alerting.devdocs.json
@@ -2728,7 +2728,7 @@
             "label": "actions",
             "description": [],
             "signature": [
-              "Readonly<{ frequency?: Readonly<{} & { throttle: string | null; notifyWhen: \"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\"; summary: boolean; }> | undefined; alertsFilter?: Readonly<{ query?: Readonly<{ dsl?: string | undefined; } & { kql: string; filters: Readonly<{ query?: Record<string, any> | undefined; state$?: Readonly<{} & { store: string; }> | undefined; } & { meta: Record<string, any>; }>[]; }> | undefined; timeframe?: Readonly<{} & { days: (2 | 7 | 6 | 5 | 4 | 3 | 1)[]; hours: Readonly<{} & { start: string; end: string; }>; timezone: string; }> | undefined; } & {}> | undefined; uuid?: string | undefined; } & { id: string; params: Record<string, any>; actionTypeId: string; group: string; }>[]"
+              "Readonly<{ frequency?: Readonly<{} & { throttle: string | null; notifyWhen: \"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\"; summary: boolean; }> | undefined; alertsFilter?: Readonly<{ query?: Readonly<{ dsl?: string | undefined; } & { kql: string; filters: Readonly<{ query?: Record<string, any> | undefined; $state?: Readonly<{} & { store: \"appState\" | \"globalState\"; }> | undefined; } & { meta: Record<string, any>; }>[]; }> | undefined; timeframe?: Readonly<{} & { days: (2 | 7 | 6 | 5 | 4 | 3 | 1)[]; hours: Readonly<{} & { start: string; end: string; }>; timezone: string; }> | undefined; } & {}> | undefined; uuid?: string | undefined; useAlertDataForTemplate?: boolean | undefined; } & { id: string; params: Record<string, any>; actionTypeId: string; group: string; }>[]"
             ],
             "path": "x-pack/plugins/alerting/server/application/rule/types/rule.ts",
             "deprecated": false,
@@ -4691,11 +4691,35 @@
         "signature": [
           "{ getContext: () => Context; getState: () => State; getUuid: () => string; getStart: () => string | null; hasContext: () => boolean; replaceState: (state: State) => ",
           "Alert",
-          "<State, Context, ActionGroupIds>; scheduleActions: (actionGroup: ActionGroupIds, context?: Context) => ",
+          "<State, Context, ActionGroupIds, ",
+          {
+            "pluginId": "@kbn/alerts-as-data-utils",
+            "scope": "common",
+            "docId": "kibKbnAlertsAsDataUtilsPluginApi",
+            "section": "def-common.AADAlert",
+            "text": "AADAlert"
+          },
+          ">; scheduleActions: (actionGroup: ActionGroupIds, context?: Context) => ",
           "Alert",
-          "<State, Context, ActionGroupIds>; setContext: (context: Context) => ",
+          "<State, Context, ActionGroupIds, ",
+          {
+            "pluginId": "@kbn/alerts-as-data-utils",
+            "scope": "common",
+            "docId": "kibKbnAlertsAsDataUtilsPluginApi",
+            "section": "def-common.AADAlert",
+            "text": "AADAlert"
+          },
+          ">; setContext: (context: Context) => ",
           "Alert",
-          "<State, Context, ActionGroupIds>; }"
+          "<State, Context, ActionGroupIds, ",
+          {
+            "pluginId": "@kbn/alerts-as-data-utils",
+            "scope": "common",
+            "docId": "kibKbnAlertsAsDataUtilsPluginApi",
+            "section": "def-common.AADAlert",
+            "text": "AADAlert"
+          },
+          ">; }"
         ],
         "path": "x-pack/plugins/alerting/server/alert/alert.ts",
         "deprecated": false,
@@ -8160,6 +8184,20 @@
             "path": "x-pack/plugins/alerting/common/rule.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-common.RuleAction.useAlertDataForTemplate",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "useAlertDataForTemplate",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index 46fcda0e2c7ced..2a7c56b3ec1e96 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-o
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 809 | 1 | 778 | 50 |
+| 810 | 1 | 779 | 50 |
 
 ## Client
 
diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json
index c35b5362dce3df..897cd39513a7b8 100644
--- a/api_docs/apm.devdocs.json
+++ b/api_docs/apm.devdocs.json
@@ -3525,7 +3525,7 @@
           "StringC",
           "; }>>; }>]>; }> | undefined; handler: ({}: ",
           "APMRouteHandlerResources",
-          " & { params: { path: { id: string; }; body: { label: string; url: string; } & { id?: string | undefined; filters?: { key: \"\" | \"service.name\" | \"service.environment\" | \"transaction.name\" | \"transaction.type\"; value: string; }[] | undefined; }; }; }) => Promise<void>; } & ",
+          " & { params: { path: { id: string; }; body: { label: string; url: string; } & { id?: string | undefined; filters?: { key: \"\" | \"service.environment\" | \"service.name\" | \"transaction.name\" | \"transaction.type\"; value: string; }[] | undefined; }; }; }) => Promise<void>; } & ",
           "APMRouteCreateOptions",
           "; \"POST /internal/apm/settings/custom_links\": { endpoint: \"POST /internal/apm/settings/custom_links\"; params?: ",
           "TypeC",
@@ -3563,7 +3563,7 @@
           "StringC",
           "; }>>; }>]>; }> | undefined; handler: ({}: ",
           "APMRouteHandlerResources",
-          " & { params: { body: { label: string; url: string; } & { id?: string | undefined; filters?: { key: \"\" | \"service.name\" | \"service.environment\" | \"transaction.name\" | \"transaction.type\"; value: string; }[] | undefined; }; }; }) => Promise<void>; } & ",
+          " & { params: { body: { label: string; url: string; } & { id?: string | undefined; filters?: { key: \"\" | \"service.environment\" | \"service.name\" | \"transaction.name\" | \"transaction.type\"; value: string; }[] | undefined; }; }; }) => Promise<void>; } & ",
           "APMRouteCreateOptions",
           "; \"GET /internal/apm/settings/custom_links\": { endpoint: \"GET /internal/apm/settings/custom_links\"; params?: ",
           "PartialC",
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index 35ca4197656a2a..3054b4228c6b32 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
diff --git a/api_docs/apm_data_access.mdx b/api_docs/apm_data_access.mdx
index 2b0e99da57c3f2..1e3faec44ddb2a 100644
--- a/api_docs/apm_data_access.mdx
+++ b/api_docs/apm_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apmDataAccess
 title: "apmDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apmDataAccess plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apmDataAccess']
 ---
 import apmDataAccessObj from './apm_data_access.devdocs.json';
diff --git a/api_docs/asset_manager.mdx b/api_docs/asset_manager.mdx
index df03fe9929c539..564cc08e57cf55 100644
--- a/api_docs/asset_manager.mdx
+++ b/api_docs/asset_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/assetManager
 title: "assetManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the assetManager plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'assetManager']
 ---
 import assetManagerObj from './asset_manager.devdocs.json';
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index 8ad89dcc152734..d621ec7e6c16c4 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index 8d55782e5e45d9..c6297e0f08f474 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index 7de5bd76bdd44b..14322f9c1f0ed8 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 8efe25d7afca9e..81ea481070a8d2 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index cc578932d279f5..8f10078c47f8c2 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index ba8c180b3c6eca..1deca15b7abc3d 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index 1b8c2248a51901..e2da1f02675a3b 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index 6a65f733471f38..07c00eb8fa709b 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index df453622062a97..180e2a6565f3a4 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index 198f9b4c75c7a5..70873f3466d258 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index de571179a25c4d..81ea3c2c6302e2 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/content_management.mdx b/api_docs/content_management.mdx
index bd57fd4ca7cd2b..20737866a276f3 100644
--- a/api_docs/content_management.mdx
+++ b/api_docs/content_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/contentManagement
 title: "contentManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the contentManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'contentManagement']
 ---
 import contentManagementObj from './content_management.devdocs.json';
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index 3de4ebbf9f68fb..ecaa1207437a96 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index e9d35f1e18a951..23c814c9c8c47e 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index 94b24cd8ddbe02..bab1ba8b7e7eb2 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index 669ff705a81de2..1388e49e66abac 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json
index 77cfa0b7d09c84..04a304f93dd8ff 100644
--- a/api_docs/data.devdocs.json
+++ b/api_docs/data.devdocs.json
@@ -7790,6 +7790,20 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "data",
+            "id": "def-public.GetFieldsOptions.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -7809,7 +7823,7 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          " extends ",
+          "<T> extends ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -7817,15 +7831,7 @@
             "section": "def-common.IKibanaSearchRequest",
             "text": "IKibanaSearchRequest"
           },
-          "<",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.ISearchRequestParams",
-            "text": "ISearchRequestParams"
-          },
-          ">"
+          "<T>"
         ],
         "path": "src/plugins/data/common/search/strategies/es_search/types.ts",
         "deprecated": false,
@@ -10365,7 +10371,15 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          ", SearchStrategyResponse extends ",
+          "<",
+          {
+            "pluginId": "data",
+            "scope": "common",
+            "docId": "kibDataSearchPluginApi",
+            "section": "def-common.ISearchRequestParams",
+            "text": "ISearchRequestParams"
+          },
+          ">, SearchStrategyResponse extends ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -12961,7 +12975,15 @@
                 "section": "def-common.IEsSearchRequest",
                 "text": "IEsSearchRequest"
               },
-              ", ",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchRequestParams",
+                "text": "ISearchRequestParams"
+              },
+              ">, ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -15593,7 +15615,7 @@
             "signature": [
               "(options: { pattern: string | string[]; metaFields?: string[] | undefined; fieldCapsOptions?: { allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined; type?: string | undefined; rollupIndex?: string | undefined; indexFilter?: ",
               "QueryDslQueryContainer",
-              " | undefined; fields?: string[] | undefined; }) => Promise<{ fields: ",
+              " | undefined; fields?: string[] | undefined; allowHidden?: boolean | undefined; }) => Promise<{ fields: ",
               {
                 "pluginId": "dataViews",
                 "scope": "server",
@@ -15716,6 +15738,20 @@
                     "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts",
                     "deprecated": false,
                     "trackAdoption": false
+                  },
+                  {
+                    "parentPluginId": "data",
+                    "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.allowHidden",
+                    "type": "CompoundType",
+                    "tags": [],
+                    "label": "allowHidden",
+                    "description": [],
+                    "signature": [
+                      "boolean | undefined"
+                    ],
+                    "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
                   }
                 ]
               }
@@ -17615,7 +17651,7 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          " extends ",
+          "<T> extends ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -17623,15 +17659,7 @@
             "section": "def-common.IKibanaSearchRequest",
             "text": "IKibanaSearchRequest"
           },
-          "<",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.ISearchRequestParams",
-            "text": "ISearchRequestParams"
-          },
-          ">"
+          "<T>"
         ],
         "path": "src/plugins/data/common/search/strategies/es_search/types.ts",
         "deprecated": false,
@@ -18337,7 +18365,15 @@
               "section": "def-common.IEsSearchRequest",
               "text": "IEsSearchRequest"
             },
-            ", ",
+            "<",
+            {
+              "pluginId": "data",
+              "scope": "common",
+              "docId": "kibDataSearchPluginApi",
+              "section": "def-common.ISearchRequestParams",
+              "text": "ISearchRequestParams"
+            },
+            ">, ",
             {
               "pluginId": "data",
               "scope": "common",
@@ -23651,6 +23687,22 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "data",
+            "id": "def-common.DataViewAttributes.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [
+              "\nAllow hidden and system indices when loading field list"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -23900,6 +23952,20 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "data",
+            "id": "def-common.GetFieldsOptions.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -24077,7 +24143,7 @@
                 "section": "def-common.FieldAttrs",
                 "text": "FieldAttrs"
               },
-              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
             ],
             "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts",
             "deprecated": false,
@@ -25204,7 +25270,7 @@
             "section": "def-common.FieldAttrs",
             "text": "FieldAttrs"
           },
-          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index 67837e8e89befb..1028805d3b13b8 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3193 | 32 | 2542 | 22 |
+| 3197 | 32 | 2545 | 22 |
 
 ## Client
 
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index 6d3f601824faeb..a85420c2c721d8 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3193 | 32 | 2542 | 22 |
+| 3197 | 32 | 2545 | 22 |
 
 ## Client
 
diff --git a/api_docs/data_search.devdocs.json b/api_docs/data_search.devdocs.json
index 231c59c5051c89..bf6f39e5a7abc6 100644
--- a/api_docs/data_search.devdocs.json
+++ b/api_docs/data_search.devdocs.json
@@ -19,7 +19,7 @@
             "section": "def-common.ApplicationStart",
             "text": "ApplicationStart"
           },
-          "; }) => { title: string; body: React.ReactNode; } | undefined"
+          "; }) => { title: string; body: React.ReactNode; actions?: React.ReactNode[] | undefined; } | undefined"
         ],
         "path": "src/plugins/data/public/search/search_interceptor/utils.ts",
         "deprecated": false,
@@ -267,7 +267,7 @@
               "\nCurrent session management\n{@link ISessionService}"
             ],
             "signature": [
-              "{ start: () => string; readonly state$: ",
+              "{ start: () => string; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly state$: ",
               "Observable",
               "<",
               {
@@ -277,7 +277,7 @@
                 "section": "def-public.SearchSessionState",
                 "text": "SearchSessionState"
               },
-              ">; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly sessionMeta$: ",
+              ">; readonly sessionMeta$: ",
               "Observable",
               "<",
               "SessionMeta",
@@ -497,7 +497,15 @@
                 "section": "def-common.IEsSearchRequest",
                 "text": "IEsSearchRequest"
               },
-              ", SearchStrategyResponse extends ",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchRequestParams",
+                "text": "ISearchRequestParams"
+              },
+              ">, SearchStrategyResponse extends ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -715,7 +723,7 @@
               "\nCurrent session management\n{@link ISessionService}"
             ],
             "signature": [
-              "{ start: () => string; readonly state$: ",
+              "{ start: () => string; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly state$: ",
               "Observable",
               "<",
               {
@@ -725,7 +733,7 @@
                 "section": "def-public.SearchSessionState",
                 "text": "SearchSessionState"
               },
-              ">; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly sessionMeta$: ",
+              ">; readonly sessionMeta$: ",
               "Observable",
               "<",
               "SessionMeta",
@@ -1271,7 +1279,7 @@
         "label": "ISessionService",
         "description": [],
         "signature": [
-          "{ start: () => string; readonly state$: ",
+          "{ start: () => string; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly state$: ",
           "Observable",
           "<",
           {
@@ -1281,7 +1289,7 @@
             "section": "def-public.SearchSessionState",
             "text": "SearchSessionState"
           },
-          ">; save: () => Promise<void>; clear: () => void; destroy: () => void; readonly sessionMeta$: ",
+          ">; readonly sessionMeta$: ",
           "Observable",
           "<",
           "SessionMeta",
@@ -27275,8 +27283,8 @@
             "pluginId": "data",
             "scope": "common",
             "docId": "kibDataSearchPluginApi",
-            "section": "def-common.ISearchOptions",
-            "text": "ISearchOptions"
+            "section": "def-common.SearchSourceSearchOptions",
+            "text": "SearchSourceSearchOptions"
           }
         ],
         "path": "src/plugins/data/common/search/strategies/ese_search/types.ts",
@@ -27595,7 +27603,7 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          " extends ",
+          "<T> extends ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -27603,15 +27611,7 @@
             "section": "def-common.IKibanaSearchRequest",
             "text": "IKibanaSearchRequest"
           },
-          "<",
-          {
-            "pluginId": "data",
-            "scope": "common",
-            "docId": "kibDataSearchPluginApi",
-            "section": "def-common.ISearchRequestParams",
-            "text": "ISearchRequestParams"
-          },
-          ">"
+          "<T>"
         ],
         "path": "src/plugins/data/common/search/strategies/es_search/types.ts",
         "deprecated": false,
@@ -28084,7 +28084,15 @@
                 "section": "def-common.IEsSearchRequest",
                 "text": "IEsSearchRequest"
               },
-              ", SearchStrategyResponse extends ",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchRequestParams",
+                "text": "ISearchRequestParams"
+              },
+              ">, SearchStrategyResponse extends ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -30034,7 +30042,15 @@
                 "section": "def-common.IEsSearchRequest",
                 "text": "IEsSearchRequest"
               },
-              ", SearchStrategyResponse extends ",
+              "<",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.ISearchRequestParams",
+                "text": "ISearchRequestParams"
+              },
+              ">, SearchStrategyResponse extends ",
               {
                 "pluginId": "data",
                 "scope": "common",
@@ -34106,7 +34122,15 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          ", SearchStrategyResponse extends ",
+          "<",
+          {
+            "pluginId": "data",
+            "scope": "common",
+            "docId": "kibDataSearchPluginApi",
+            "section": "def-common.ISearchRequestParams",
+            "text": "ISearchRequestParams"
+          },
+          ">, SearchStrategyResponse extends ",
           {
             "pluginId": "data",
             "scope": "common",
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index 44d105910a2310..63aedbc218d54d 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 3193 | 32 | 2542 | 22 |
+| 3197 | 32 | 2545 | 22 |
 
 ## Client
 
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index ad68e4efd36b6f..52bcd8c7aaa6cb 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index 78443ee9661b8a..02ead0b2a86ec7 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index ef6968f88252ee..0b124108530079 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json
index c4efdd100341f0..96792d381cdf74 100644
--- a/api_docs/data_views.devdocs.json
+++ b/api_docs/data_views.devdocs.json
@@ -4488,6 +4488,22 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dataViews",
+            "id": "def-public.DataViewAttributes.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [
+              "\nAllow hidden and system indices when loading field list"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -6164,7 +6180,7 @@
             "section": "def-common.FieldAttrs",
             "text": "FieldAttrs"
           },
-          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
@@ -9221,7 +9237,7 @@
             "signature": [
               "(options: { pattern: string | string[]; metaFields?: string[] | undefined; fieldCapsOptions?: { allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined; type?: string | undefined; rollupIndex?: string | undefined; indexFilter?: ",
               "QueryDslQueryContainer",
-              " | undefined; fields?: string[] | undefined; }) => Promise<{ fields: ",
+              " | undefined; fields?: string[] | undefined; allowHidden?: boolean | undefined; }) => Promise<{ fields: ",
               {
                 "pluginId": "dataViews",
                 "scope": "server",
@@ -9344,6 +9360,20 @@
                     "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts",
                     "deprecated": false,
                     "trackAdoption": false
+                  },
+                  {
+                    "parentPluginId": "dataViews",
+                    "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.allowHidden",
+                    "type": "CompoundType",
+                    "tags": [],
+                    "label": "allowHidden",
+                    "description": [],
+                    "signature": [
+                      "boolean | undefined"
+                    ],
+                    "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
                   }
                 ]
               }
@@ -15787,6 +15817,22 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dataViews",
+            "id": "def-common.DataViewAttributes.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [
+              "\nAllow hidden and system indices when loading field list"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -18081,6 +18127,20 @@
             "path": "src/plugins/data_views/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dataViews",
+            "id": "def-common.GetFieldsOptions.allowHidden",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "allowHidden",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "src/plugins/data_views/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -18763,7 +18823,7 @@
                 "section": "def-common.FieldAttrs",
                 "text": "FieldAttrs"
               },
-              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
             ],
             "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts",
             "deprecated": false,
@@ -20486,7 +20546,7 @@
             "section": "def-common.FieldAttrs",
             "text": "FieldAttrs"
           },
-          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+          " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
         ],
         "path": "src/plugins/data_views/common/types.ts",
         "deprecated": false,
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index b7ab9bebaefdc8..399cc8f171c197 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 918 | 0 | 255 | 4 |
+| 922 | 0 | 257 | 4 |
 
 ## Client
 
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index a99330414e8107..276e39cc373164 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
diff --git a/api_docs/dataset_quality.devdocs.json b/api_docs/dataset_quality.devdocs.json
new file mode 100644
index 00000000000000..d1a6ce1df8d6d9
--- /dev/null
+++ b/api_docs/dataset_quality.devdocs.json
@@ -0,0 +1,69 @@
+{
+  "id": "datasetQuality",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": [],
+    "setup": {
+      "parentPluginId": "datasetQuality",
+      "id": "def-public.DatasetQualityPluginSetup",
+      "type": "Interface",
+      "tags": [],
+      "label": "DatasetQualityPluginSetup",
+      "description": [],
+      "path": "x-pack/plugins/dataset_quality/public/types.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "children": [],
+      "lifecycle": "setup",
+      "initialIsOpen": true
+    },
+    "start": {
+      "parentPluginId": "datasetQuality",
+      "id": "def-public.DatasetQualityPluginStart",
+      "type": "Interface",
+      "tags": [],
+      "label": "DatasetQualityPluginStart",
+      "description": [],
+      "path": "x-pack/plugins/dataset_quality/public/types.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "children": [],
+      "lifecycle": "start",
+      "initialIsOpen": true
+    }
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "datasetQuality",
+        "id": "def-common.DatasetQualityConfig",
+        "type": "Interface",
+        "tags": [],
+        "label": "DatasetQualityConfig",
+        "description": [],
+        "path": "x-pack/plugins/dataset_quality/common/plugin_config.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/dataset_quality.mdx b/api_docs/dataset_quality.mdx
new file mode 100644
index 00000000000000..2791eb615437a8
--- /dev/null
+++ b/api_docs/dataset_quality.mdx
@@ -0,0 +1,38 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibDatasetQualityPluginApi
+slug: /kibana-dev-docs/api/datasetQuality
+title: "datasetQuality"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the datasetQuality plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', 'datasetQuality']
+---
+import datasetQualityObj from './dataset_quality.devdocs.json';
+
+This plugin introduces the concept of dataset quality, where users can easily get an overview on the datasets they have.
+
+Contact [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 3 | 0 | 3 | 0 |
+
+## Client
+
+### Setup
+<DocDefinitionList data={[datasetQualityObj.client.setup]}/>
+
+### Start
+<DocDefinitionList data={[datasetQualityObj.client.start]}/>
+
+## Common
+
+### Interfaces
+<DocDefinitionList data={datasetQualityObj.common.interfaces}/>
+
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index 540826fdd6105f..a89f7618fd20c1 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -18,7 +18,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-public.PluginSetupContract.registerNavigation" text="registerNavigation"/> | ml, stackAlerts | - |
 | <DocLink id="kibAlertingPluginApi" section="def-server.RuleExecutorServices.alertFactory" text="alertFactory"/> | ruleRegistry, observability, ml, infra, monitoring, securitySolution, stackAlerts, synthetics, transform, uptime | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | home, data, esUiShared, savedObjectsManagement, exploratoryView, fleet, ml, apm, indexLifecycleManagement, observabilityOnboarding, synthetics, upgradeAssistant, uptime, ux, kibanaOverview | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | share, uiActions, guidedOnboarding, home, serverless, management, spaces, savedObjects, indexManagement, visualizations, controls, dashboard, savedObjectsTagging, expressionXY, lens, expressionMetricVis, expressionGauge, security, alerting, triggersActionsUi, cases, aiops, advancedSettings, exploratoryView, fleet, metricsDataAccess, licenseManagement, maps, dataVisualizer, ml, profiling, apm, expressionImage, expressionMetric, expressionError, expressionRevealImage, expressionRepeatImage, expressionShape, crossClusterReplication, enterpriseSearch, globalSearchBar, graph, grokdebugger, indexLifecycleManagement, infra, ingestPipelines, logstash, monitoring, observabilityOnboarding, osquery, devTools, painlessLab, remoteClusters, rollup, searchprofiler, newsfeed, securitySolution, snapshotRestore, synthetics, transform, upgradeAssistant, uptime, ux, watcher, cloudDataMigration, console, filesManagement, kibanaOverview, visDefaultEditor, expressionHeatmap, expressionLegacyMetricVis, expressionPartitionVis, expressionTagcloud, visTypeTable, visTypeTimelion, visTypeTimeseries, visTypeVega, visTypeVislib | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | encryptedSavedObjects, actions, data, ml, logstash, securitySolution, cloudChat | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authz" text="authz"/> | actions, ml, savedObjectsTagging, enterpriseSearch | - |
@@ -124,6 +123,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibExpressionsPluginApi" section="def-server.ExpressionFunctionDefinition.context" text="context"/> | canvas | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectsImportSuccess.createNewCopy" text="createNewCopy"/> | spaces, savedObjectsManagement | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectAttribute" text="SavedObjectAttribute"/> | @kbn/core, visualizations, triggersActionsUi, advancedSettings | - |
+| <DocLink id="kibKbnReportingExportTypesPdfPluginApi" section="def-server.PdfV1ExportType" text="PdfV1ExportType"/> | reporting | - |
+| <DocLink id="kibKbnReportingExportTypesPdfCommonPluginApi" section="def-common.JobParamsPDFDeprecated" text="JobParamsPDFDeprecated"/> | @kbn/reporting-export-types-pdf, reporting | - |
 | <DocLink id="kibKbnCoreElasticsearchServerPluginApi" section="def-common.ElasticsearchServiceSetup.legacy" text="legacy"/> | @kbn/core-elasticsearch-server-internal, @kbn/core-plugins-server-internal, observabilityOnboarding, console | - |
 | <DocLink id="kibKbnContentManagementTableListViewTablePluginApi" section="def-common.TableListViewTableProps.withoutPageTemplateWrapper" text="withoutPageTemplateWrapper"/> | @kbn/content-management-table-list-view, filesManagement | - |
 | <DocLink id="kibSecurityPluginApi" section="def-public.SecurityPluginStart.uiApi" text="uiApi"/> | enterpriseSearch | - |
@@ -193,9 +194,6 @@ Safe to remove.
 | <DocLink id="kibListsPluginApi" section="def-server.ListClient.setListPolicy" text="setListPolicy"/> | lists | 
 | <DocLink id="kibListsPluginApi" section="def-server.ListClient.setListItemPolicy" text="setListItemPolicy"/> | lists | 
 | <DocLink id="kibReportingPluginApi" section="def-public.ReportingPublicComponents.ReportingPanelPDF" text="ReportingPanelPDF"/> | reporting | 
-| <DocLink id="kibReportingPluginApi" section="def-common.BaseParams" text="BaseParams"/> | reporting | 
-| <DocLink id="kibReportingPluginApi" section="def-common.BasePayload" text="BasePayload"/> | reporting | 
-| <DocLink id="kibReportingPluginApi" section="def-common.JobAppParamsPDF" text="JobAppParamsPDF"/> | reporting | 
 | <DocLink id="kibSavedObjectsPluginApi" section="def-public.SavedObjectsStart.SavedObjectClass" text="SavedObjectClass"/> | savedObjects | 
 | <DocLink id="kibTaskManagerPluginApi" section="def-server.ConcreteTaskInstance.interval" text="interval"/> | taskManager | 
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsBulkDeleteOptions" text="SavedObjectsBulkDeleteOptions"/> | @kbn/core-saved-objects-api-browser | 
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index 040f6fbead292e..93ec1d6ddeb599 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -300,6 +300,14 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
+## @kbn/reporting-export-types-pdf
+
+| Deprecated API | Reference location(s) | Remove By |
+| ---------------|-----------|-----------|
+| <DocLink id="kibKbnReportingExportTypesPdfCommonPluginApi" section="def-common.JobParamsPDFDeprecated" text="JobParamsPDFDeprecated"/> | [printable_pdf.ts](https://github.com/elastic/kibana/tree/main/packages/kbn-reporting/export_types/pdf/printable_pdf.ts#:~:text=JobParamsPDFDeprecated), [printable_pdf.ts](https://github.com/elastic/kibana/tree/main/packages/kbn-reporting/export_types/pdf/printable_pdf.ts#:~:text=JobParamsPDFDeprecated), [printable_pdf.ts](https://github.com/elastic/kibana/tree/main/packages/kbn-reporting/export_types/pdf/printable_pdf.ts#:~:text=JobParamsPDFDeprecated) | - |
+
+
+
 ## @kbn/securitysolution-data-table
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -380,7 +388,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibHomePluginApi" section="def-public.HomePublicPluginSetup.environment" text="environment"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/plugin.ts#:~:text=environment) | 8.8.0 |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/components/routing/app_root/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/components/routing/app_root/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/components/routing/app_root/index.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/application/index.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode), [license_check.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/common/license_check.test.ts#:~:text=mode)+ 2 more | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [license_context.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/apm/public/context/license/license_context.tsx#:~:text=license%24) | 8.8.0 |
@@ -522,8 +529,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [search_interceptor.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_interceptor/search_interceptor.ts#:~:text=toMountPoint), [search_interceptor.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_interceptor/search_interceptor.ts#:~:text=toMountPoint), [search_interceptor.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_interceptor/search_interceptor.ts#:~:text=toMountPoint), [search_interceptor.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_interceptor/search_interceptor.ts#:~:text=toMountPoint), [delete_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx#:~:text=toMountPoint), [delete_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx#:~:text=toMountPoint), [extend_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx#:~:text=toMountPoint), [extend_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx#:~:text=toMountPoint), [inspect_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx#:~:text=toMountPoint), [inspect_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx#:~:text=toMountPoint)+ 4 more | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [get_columns.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx#:~:text=RedirectAppLinks), [get_columns.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx#:~:text=RedirectAppLinks), [get_columns.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx#:~:text=RedirectAppLinks), [connected_search_session_indicator.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx#:~:text=RedirectAppLinks), [connected_search_session_indicator.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx#:~:text=RedirectAppLinks), [connected_search_session_indicator.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx#:~:text=RedirectAppLinks) | - |
+| <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [delete_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx#:~:text=toMountPoint), [delete_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx#:~:text=toMountPoint), [extend_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx#:~:text=toMountPoint), [extend_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx#:~:text=toMountPoint), [inspect_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx#:~:text=toMountPoint), [inspect_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx#:~:text=toMountPoint), [rename_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx#:~:text=toMountPoint), [rename_button.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx#:~:text=toMountPoint), [search_service.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_service.ts#:~:text=toMountPoint), [search_service.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/search/search_service.ts#:~:text=toMountPoint)+ 4 more | - |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | [session_service.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/server/search/session/session_service.ts#:~:text=authc) | - |
 | <DocLink id="kibUiActionsPluginApi" section="def-public.UiActionsService.executeTriggerActions" text="executeTriggerActions"/> | [data_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx#:~:text=executeTriggerActions), [data_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx#:~:text=executeTriggerActions) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/filters/persistable_state.ts#:~:text=SavedObjectReference), [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/filters/persistable_state.ts#:~:text=SavedObjectReference), [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/filters/persistable_state.ts#:~:text=SavedObjectReference), [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/persistable_state.ts#:~:text=SavedObjectReference), [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/persistable_state.ts#:~:text=SavedObjectReference), [persistable_state.ts](https://github.com/elastic/kibana/tree/main/src/plugins/data/common/query/persistable_state.ts#:~:text=SavedObjectReference) | - |
@@ -654,14 +660,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 
 
-## esUiShared
-
-| Deprecated API | Reference location(s) | Remove By |
-| ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [view_api_request_flyout.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx#:~:text=RedirectAppLinks), [view_api_request_flyout.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx#:~:text=RedirectAppLinks), [view_api_request_flyout.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx#:~:text=RedirectAppLinks) | - |
-
-
-
 ## eventAnnotation
 
 | Deprecated API | Reference location(s) | Remove By |
@@ -685,7 +683,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | ---------------|-----------|-----------|
 | <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [use_discover_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/components/shared/exploratory_view/hooks/use_discover_link.tsx#:~:text=indexPatternId) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [add_to_case_action.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/components/shared/exploratory_view/header/add_to_case_action.tsx#:~:text=toMountPoint), [add_to_case_action.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/components/shared/exploratory_view/header/add_to_case_action.tsx#:~:text=toMountPoint) | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/index.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreSavedObjectsBrowserPluginApi" section="def-common.SavedObjectsStart" text="SavedObjectsStart"/> | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/types.ts#:~:text=SavedObjectsStart), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/exploratory_view/public/application/types.ts#:~:text=SavedObjectsStart) | - |
 
@@ -830,7 +827,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-common.SavedObject.migrationVersion" text="migrationVersion"/> | [install.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts#:~:text=migrationVersion), [install.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts#:~:text=migrationVersion), [install.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts#:~:text=migrationVersion), [get.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts#:~:text=migrationVersion), [get.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts#:~:text=migrationVersion), [get.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts#:~:text=migrationVersion), [get.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/packages/get.test.ts#:~:text=migrationVersion), [install.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.test.ts#:~:text=migrationVersion), [install.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts#:~:text=migrationVersion), [install.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts#:~:text=migrationVersion)+ 22 more | - |
 | <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [use_get_logs_discover_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/multi_page_layout/hooks/use_get_logs_discover_link.tsx#:~:text=indexPatternId) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [use_confirm_open_unverified.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_confirm_open_unverified.tsx#:~:text=toMountPoint), [use_confirm_open_unverified.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_confirm_open_unverified.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint), [use_package_install.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/hooks/use_package_install.tsx#:~:text=toMountPoint)+ 12 more | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [tutorial_directory_header_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx#:~:text=RedirectAppLinks), [tutorial_directory_header_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx#:~:text=RedirectAppLinks), [tutorial_directory_header_link.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx#:~:text=RedirectAppLinks), [custom_assets_accordion.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx#:~:text=RedirectAppLinks), [custom_assets_accordion.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx#:~:text=RedirectAppLinks), [custom_assets_accordion.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx#:~:text=RedirectAppLinks), [agent_logs.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx#:~:text=RedirectAppLinks), [agent_logs.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx#:~:text=RedirectAppLinks), [agent_logs.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/app.tsx#:~:text=RedirectAppLinks)+ 5 more | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/integrations/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/app.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.PublicLicense.mode" text="mode"/> | [agent_policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/services/agent_policy_config.test.ts#:~:text=mode), [agent_policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/services/agent_policy_config.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.PublicLicense.mode" text="mode"/> | [agent_policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/services/agent_policy_config.test.ts#:~:text=mode), [agent_policy_config.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/services/agent_policy_config.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode), [agent_policy_watch.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agent_policy_watch.test.ts#:~:text=mode) | 8.8.0 |
@@ -898,7 +894,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/application.tsx#:~:text=RedirectAppLinks), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/application.tsx#:~:text=RedirectAppLinks)+ 1 more | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/application.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/plugin.ts#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract" text="SavedObjectsClientContract"/> | [kibana_services.ts](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/kibana_services.ts#:~:text=SavedObjectsClientContract), [kibana_services.ts](https://github.com/elastic/kibana/tree/main/src/plugins/home/public/application/kibana_services.ts#:~:text=SavedObjectsClientContract) | - |
@@ -920,7 +915,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=RedirectAppLinks), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=KibanaThemeProvider), [index.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/public/application/index.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/server/services/license.ts#:~:text=license%24) | 8.8.0 |
 
@@ -975,7 +969,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [add_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/add_data/add_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks), [manage_data.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/application.tsx#:~:text=KibanaThemeProvider), [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/application.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreApplicationBrowserPluginApi" section="def-common.AppMountParameters.appBasePath" text="appBasePath"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/kibana_overview/public/application.tsx#:~:text=appBasePath) | 8.8.0 |
 
@@ -1091,8 +1084,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [index.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/index.ts#:~:text=license%24) | 8.8.0 |
-| <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.refresh" text="refresh"/> | [index.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/index.ts#:~:text=refresh) | 8.8.0 |
+| <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/plugin.ts#:~:text=license%24) | 8.8.0 |
+| <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.refresh" text="refresh"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/plugin.ts#:~:text=refresh) | 8.8.0 |
 
 
 
@@ -1110,7 +1103,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-public.PluginSetupContract.registerNavigation" text="registerNavigation"/> | [register_ml_alerts.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts#:~:text=registerNavigation) | - |
 | <DocLink id="kibAlertingPluginApi" section="def-server.RuleExecutorServices.alertFactory" text="alertFactory"/> | [register_jobs_monitoring_rule_type.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts#:~:text=alertFactory), [register_jobs_monitoring_rule_type.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts#:~:text=alertFactory) | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=KibanaThemeProvider), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=KibanaThemeProvider), [anomaly_charts_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx#:~:text=KibanaThemeProvider), [anomaly_swimlane_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx#:~:text=KibanaThemeProvider), [anomaly_swimlane_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx#:~:text=KibanaThemeProvider), [anomaly_swimlane_embeddable.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/app.tsx#:~:text=KibanaThemeProvider), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=KibanaThemeProvider)+ 2 more | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=license%24) | 8.8.0 |
@@ -1153,7 +1145,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/public/application/app.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibKbnCoreElasticsearchServerPluginApi" section="def-common.ElasticsearchServiceSetup.legacy" text="legacy"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability_onboarding/server/plugin.ts#:~:text=legacy) | - |
 
@@ -1220,6 +1211,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [job_failure.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_failure.tsx#:~:text=toMountPoint), [job_failure.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_failure.tsx#:~:text=toMountPoint), [job_failure.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_failure.tsx#:~:text=toMountPoint), [general_error.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/general_error.tsx#:~:text=toMountPoint), [general_error.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/general_error.tsx#:~:text=toMountPoint), [job_success.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_success.tsx#:~:text=toMountPoint), [job_success.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_success.tsx#:~:text=toMountPoint), [job_success.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_success.tsx#:~:text=toMountPoint), [job_warning_formulas.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx#:~:text=toMountPoint), [job_warning_formulas.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx#:~:text=toMountPoint)+ 9 more | - |
+| <DocLink id="kibKbnReportingExportTypesPdfPluginApi" section="def-server.PdfV1ExportType" text="PdfV1ExportType"/> | [core.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/server/core.ts#:~:text=PdfV1ExportType), [core.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/server/core.ts#:~:text=PdfV1ExportType) | - |
+| <DocLink id="kibKbnReportingExportTypesPdfCommonPluginApi" section="def-common.JobParamsPDFDeprecated" text="JobParamsPDFDeprecated"/> | [request_handler.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts#:~:text=JobParamsPDFDeprecated), [request_handler.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts#:~:text=JobParamsPDFDeprecated) | - |
 
 
 
@@ -1276,7 +1269,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [saved_objects_edition_page.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx#:~:text=RedirectAppLinks), [saved_objects_edition_page.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx#:~:text=RedirectAppLinks), [saved_objects_edition_page.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx#:~:text=RedirectAppLinks), [saved_objects_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx#:~:text=RedirectAppLinks), [saved_objects_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx#:~:text=RedirectAppLinks), [saved_objects_table.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObject" text="SavedObject"/> | [find_relationships.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts#:~:text=SavedObject), [find_relationships.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts#:~:text=SavedObject), [find_relationships.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts#:~:text=SavedObject), [find_relationships.test.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/server/lib/find_relationships.test.ts#:~:text=SavedObject) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [record.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/services/types/record.ts#:~:text=SavedObjectReference), [record.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/services/types/record.ts#:~:text=SavedObjectReference) | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectsImportSuccess.createNewCopy" text="createNewCopy"/> | [resolve_import_errors.ts](https://github.com/elastic/kibana/tree/main/src/plugins/saved_objects_management/public/lib/resolve_import_errors.ts#:~:text=createNewCopy) | - |
@@ -1452,7 +1444,6 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | <DocLink id="kibAlertingPluginApi" section="def-server.RuleExecutorServices.alertFactory" text="alertFactory"/> | [common.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/server/alert_rules/common.ts#:~:text=alertFactory), [message_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/server/alert_rules/tls_rule/message_utils.ts#:~:text=alertFactory), [tls_rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/server/alert_rules/tls_rule/tls_rule.ts#:~:text=alertFactory), [monitor_status_rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/server/alert_rules/status_rule/monitor_status_rule.ts#:~:text=alertFactory) | - |
 | <DocLink id="kibDiscoverPluginApi" section="def-common.DiscoverAppLocatorParams.indexPatternId" text="indexPatternId"/> | [stderr_logs.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/stderr_logs.tsx#:~:text=indexPatternId) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [toast_title.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/toast_title.tsx#:~:text=toMountPoint), [toast_title.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/toast_title.tsx#:~:text=toMountPoint), [browser_test_results.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/manual_test_run_mode/browser_test_results.tsx#:~:text=toMountPoint), [browser_test_results.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/manual_test_run_mode/browser_test_results.tsx#:~:text=toMountPoint), [delete_monitor.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_list_table/delete_monitor.tsx#:~:text=toMountPoint), [delete_monitor.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_list_table/delete_monitor.tsx#:~:text=toMountPoint), [delete_monitor.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_list_table/delete_monitor.tsx#:~:text=toMountPoint), [delete_param.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/settings/global_params/delete_param.tsx#:~:text=toMountPoint), [delete_param.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/settings/global_params/delete_param.tsx#:~:text=toMountPoint), [delete_param.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/settings/global_params/delete_param.tsx#:~:text=toMountPoint)+ 6 more | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=RedirectAppLinks), [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=RedirectAppLinks), [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=KibanaThemeProvider), [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=KibanaThemeProvider), [synthetics_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx#:~:text=KibanaThemeProvider) | - |
 
 
@@ -1535,7 +1526,6 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/shared_imports.ts#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=RedirectAppLinks), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [shared_imports.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/shared_imports.ts#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=KibanaThemeProvider), [app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/public/application/app.tsx#:~:text=KibanaThemeProvider) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [reindex_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObject" text="SavedObject"/> | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/common/types.ts#:~:text=SavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/common/types.ts#:~:text=SavedObject) | - |
@@ -1548,7 +1538,6 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 | ---------------|-----------|-----------|
 | <DocLink id="kibAlertingPluginApi" section="def-server.RuleExecutorServices.alertFactory" text="alertFactory"/> | [common.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/common.ts#:~:text=alertFactory), [status_check.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/status_check.ts#:~:text=alertFactory), [tls.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/tls.ts#:~:text=alertFactory), [tls_legacy.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/tls_legacy.ts#:~:text=alertFactory), [duration_anomaly.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/duration_anomaly.ts#:~:text=alertFactory) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.toMountPoint" text="toMountPoint"/> | [alert_messages.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx#:~:text=toMountPoint), [alert_messages.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx#:~:text=toMountPoint), [ml_flyout_container.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/components/monitor/ml/ml_flyout_container.tsx#:~:text=toMountPoint), [ml_flyout_container.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/components/monitor/ml/ml_flyout_container.tsx#:~:text=toMountPoint), [ml_flyout_container.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/components/monitor/ml/ml_flyout_container.tsx#:~:text=toMountPoint) | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [alert_messages.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx#:~:text=RedirectAppLinks), [alert_messages.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx#:~:text=RedirectAppLinks), [alert_messages.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx#:~:text=RedirectAppLinks), [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=RedirectAppLinks), [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=RedirectAppLinks), [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=KibanaThemeProvider), [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=KibanaThemeProvider), [uptime_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx#:~:text=KibanaThemeProvider) | - |
 
 
@@ -1557,7 +1546,6 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=RedirectAppLinks), [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=RedirectAppLinks), [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaThemeProvider" text="KibanaThemeProvider"/> | [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=KibanaThemeProvider), [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=KibanaThemeProvider), [ux_app.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ux/public/application/ux_app.tsx#:~:text=KibanaThemeProvider) | - |
 
 
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index 763c598f167b70..90dde6624eb22a 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -52,8 +52,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Plugin | Deprecated API | Reference location(s) | Remove By |
 | --------|-------|-----------|-----------|
-| mapsEms | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [index.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/index.ts#:~:text=license%24) | 8.8.0 |
-| mapsEms | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.refresh" text="refresh"/> | [index.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/index.ts#:~:text=refresh) | 8.8.0 |
+| mapsEms | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/plugin.ts#:~:text=license%24) | 8.8.0 |
+| mapsEms | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.refresh" text="refresh"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/src/plugins/maps_ems/server/plugin.ts#:~:text=refresh) | 8.8.0 |
 
 
 
@@ -128,9 +128,9 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/
 
 | Plugin | Deprecated API | Reference location(s) | Remove By |
 | --------|-------|-----------|-----------|
-| indexLifecycleManagement | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/server/services/license.ts#:~:text=license%24), [reindex_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/server/services/license.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/remote_clusters/server/plugin.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/rollup/server/services/license.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/server/plugin.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/snapshot_restore/server/services/license.ts#:~:text=license%24) | 8.8.0 |
 | management | <DocLink id="kibKbnCoreApplicationBrowserPluginApi" section="def-common.AppMountParameters.appBasePath" text="appBasePath"/> | [application.tsx](https://github.com/elastic/kibana/tree/main/src/plugins/management/public/application.tsx#:~:text=appBasePath) | 8.8.0 |
 | licenseManagement | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/license_management/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cross_cluster_replication/public/plugin.ts#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/public/plugin.tsx#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/watcher/public/plugin.ts#:~:text=license%24) | 8.8.0 |
+| indexLifecycleManagement | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/index_lifecycle_management/server/services/license.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/painless_lab/server/services/license.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/remote_clusters/server/plugin.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/rollup/server/services/license.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/searchprofiler/server/plugin.ts#:~:text=license%24), [license.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/snapshot_restore/server/services/license.ts#:~:text=license%24), [reindex_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24), [reindex_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts#:~:text=license%24) | 8.8.0 |
 
 
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index fcd8246f503527..6f5d7e3396c4a6 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.devdocs.json b/api_docs/discover.devdocs.json
index 5542d68c109d55..307409fec37cb2 100644
--- a/api_docs/discover.devdocs.json
+++ b/api_docs/discover.devdocs.json
@@ -794,7 +794,15 @@
                 "section": "def-common.DataView",
                 "text": "DataView"
               },
-              ") => void; undoSavedSearchChanges: () => void; updateAdHocDataViewId: () => void; }"
+              ") => void; undoSavedSearchChanges: () => Promise<",
+              {
+                "pluginId": "savedSearch",
+                "scope": "public",
+                "docId": "kibSavedSearchPluginApi",
+                "section": "def-public.SavedSearch",
+                "text": "SavedSearch"
+              },
+              ">; updateAdHocDataViewId: () => void; }"
             ],
             "path": "src/plugins/discover/public/application/main/services/discover_state.ts",
             "deprecated": false,
@@ -985,6 +993,20 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.FlyoutCustomization.title",
+            "type": "string",
+            "tags": [],
+            "label": "title",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "src/plugins/discover/public/customizations/customization_types/flyout_customization.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "discover",
             "id": "def-public.FlyoutCustomization.actions",
@@ -1267,6 +1289,39 @@
             "trackAdoption": false,
             "children": [],
             "returnComment": []
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.TopNavCustomization.defaultBadges",
+            "type": "Object",
+            "tags": [],
+            "label": "defaultBadges",
+            "description": [],
+            "signature": [
+              "TopNavDefaultBadges",
+              " | undefined"
+            ],
+            "path": "src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "discover",
+            "id": "def-public.TopNavCustomization.getBadges",
+            "type": "Function",
+            "tags": [],
+            "label": "getBadges",
+            "description": [],
+            "signature": [
+              "(() => ",
+              "TopNavBadge",
+              "[]) | undefined"
+            ],
+            "path": "src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 7399ac8d106090..71b2e1cea2a016 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 130 | 0 | 87 | 18 |
+| 133 | 0 | 90 | 20 |
 
 ## Client
 
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index 2560ceff5721a2..9df5fae9e631f9 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/ecs_data_quality_dashboard.mdx b/api_docs/ecs_data_quality_dashboard.mdx
index 4406ce8e354312..fbb6be3ad8e26f 100644
--- a/api_docs/ecs_data_quality_dashboard.mdx
+++ b/api_docs/ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ecsDataQualityDashboard
 title: "ecsDataQualityDashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ecsDataQualityDashboard plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ecsDataQualityDashboard']
 ---
 import ecsDataQualityDashboardObj from './ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/elastic_assistant.mdx b/api_docs/elastic_assistant.mdx
index 389118ca73ba87..dd27d3fabe5a69 100644
--- a/api_docs/elastic_assistant.mdx
+++ b/api_docs/elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/elasticAssistant
 title: "elasticAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the elasticAssistant plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'elasticAssistant']
 ---
 import elasticAssistantObj from './elastic_assistant.devdocs.json';
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index 69ff45a1b76f4f..bfad9f63f4827d 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index 3814474a19718e..b0a5975752c71c 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index 683f865c62335f..69551457934c15 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index d4ead5258f45c5..d5d1d961a6c1d6 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index b778008638278e..6a1598ef21c829 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index cb2c5f6afd86b7..c8c74aa4937acf 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_annotation_listing.mdx b/api_docs/event_annotation_listing.mdx
index 67a44e81e21a6c..f5b2d014ce5085 100644
--- a/api_docs/event_annotation_listing.mdx
+++ b/api_docs/event_annotation_listing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotationListing
 title: "eventAnnotationListing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotationListing plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotationListing']
 ---
 import eventAnnotationListingObj from './event_annotation_listing.devdocs.json';
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index 215034cef5227b..4209dbd4c24bee 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
diff --git a/api_docs/exploratory_view.mdx b/api_docs/exploratory_view.mdx
index 275cde683ddb8b..8f195a5c242019 100644
--- a/api_docs/exploratory_view.mdx
+++ b/api_docs/exploratory_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/exploratoryView
 title: "exploratoryView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the exploratoryView plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'exploratoryView']
 ---
 import exploratoryViewObj from './exploratory_view.devdocs.json';
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index 4826fc43a0cb16..39711a53405566 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.devdocs.json b/api_docs/expression_gauge.devdocs.json
index c09174717c09ec..4ffb246b88599d 100644
--- a/api_docs/expression_gauge.devdocs.json
+++ b/api_docs/expression_gauge.devdocs.json
@@ -913,7 +913,7 @@
           },
           "<",
           "GoalDomainRange",
-          ">; base?: number | undefined; actual?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
+          ">; actual?: number | undefined; base?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
           "GoalLabelAccessor",
           " | undefined; labelMinor?: string | ",
           "GoalLabelAccessor",
@@ -1215,7 +1215,7 @@
           },
           "<",
           "GoalDomainRange",
-          ">; base?: number | undefined; actual?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
+          ">; actual?: number | undefined; base?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
           "GoalLabelAccessor",
           " | undefined; labelMinor?: string | ",
           "GoalLabelAccessor",
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index 73f21468f7967b..b4436f848d99d4 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index fbe776832cee1a..ff81db920e838e 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index 7df7e492abf662..84b62bccb1a446 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index d65cad5852ba56..490307858c6869 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index eb996bf5f6dbb0..03703f1840aa1a 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index b20e31573ce0f9..05fa7dd8d18efc 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index 6a35064c2b9e0e..fc41ff6fb20d9a 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index b3bd8d94787b27..b0dcd2bb7eb3ab 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index bb7d4e54b665a5..3287beca87e47b 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index ce33700ad9eaeb..46bbdf399e6c8f 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index 2abc263bab12ad..5a302e8a3727aa 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 3bfc54bff94211..776e9939050e4c 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index c098590e8f3aa7..0a5f31956155a9 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index 940bf4813eb0fe..3d43ce341fbc74 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index 1acfc950293465..8d3ee144d054e7 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index bf46c5e775d3bf..97d7ebfb2f5b3c 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.devdocs.json b/api_docs/files.devdocs.json
index e361a3c2a6336b..12fa5d46818a47 100644
--- a/api_docs/files.devdocs.json
+++ b/api_docs/files.devdocs.json
@@ -6245,6 +6245,22 @@
             "path": "src/plugins/files/common/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "files",
+            "id": "def-common.FileKind.hashes",
+            "type": "Array",
+            "tags": [],
+            "label": "hashes",
+            "description": [
+              "\nA list of hashes to compute for this file kind. The hashes will be computed\nduring the file upload process and stored in the file metadata."
+            ],
+            "signature": [
+              "(\"sha256\" | \"md5\" | \"sha1\" | \"sha512\")[] | undefined"
+            ],
+            "path": "src/plugins/files/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index cc2a4f021dc33d..f2663b244e344d 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 239 | 0 | 24 | 9 |
+| 240 | 0 | 24 | 9 |
 
 ## Client
 
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index e5e76deedd6698..db553dcf2263a6 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json
index 70d72df7dda0dd..6aedc7943b644f 100644
--- a/api_docs/fleet.devdocs.json
+++ b/api_docs/fleet.devdocs.json
@@ -4829,7 +4829,11 @@
               "\nList agents"
             ],
             "signature": [
-              "(options: Readonly<{ page?: number | undefined; perPage?: number | undefined; kuery?: any; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; showUpgradeable?: boolean | undefined; } & {}> & { showInactive: boolean; }) => Promise<{ agents: ",
+              "(options: Readonly<{ page?: number | undefined; perPage?: number | undefined; kuery?: any; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; showUpgradeable?: boolean | undefined; } & {}> & { showInactive: boolean; aggregations?: Record<string, ",
+              "AggregationsAggregationContainer",
+              "> | undefined; searchAfter?: ",
+              "SortResults",
+              " | undefined; pitId?: string | undefined; getStatusSummary?: boolean | undefined; }) => Promise<{ agents: ",
               {
                 "pluginId": "fleet",
                 "scope": "common",
@@ -4837,7 +4841,9 @@
                 "section": "def-common.Agent",
                 "text": "Agent"
               },
-              "[]; total: number; page: number; perPage: number; }>"
+              "[]; total: number; page: number; perPage: number; aggregations?: Record<string, ",
+              "AggregationsAggregate",
+              "> | undefined; }>"
             ],
             "path": "x-pack/plugins/fleet/server/services/agents/agent_service.ts",
             "deprecated": false,
@@ -4851,7 +4857,11 @@
                 "label": "options",
                 "description": [],
                 "signature": [
-                  "Readonly<{ page?: number | undefined; perPage?: number | undefined; kuery?: any; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; showUpgradeable?: boolean | undefined; } & {}> & { showInactive: boolean; }"
+                  "Readonly<{ page?: number | undefined; perPage?: number | undefined; kuery?: any; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; showUpgradeable?: boolean | undefined; } & {}> & { showInactive: boolean; aggregations?: Record<string, ",
+                  "AggregationsAggregationContainer",
+                  "> | undefined; searchAfter?: ",
+                  "SortResults",
+                  " | undefined; pitId?: string | undefined; getStatusSummary?: boolean | undefined; }"
                 ],
                 "path": "x-pack/plugins/fleet/server/services/agents/agent_service.ts",
                 "deprecated": false,
@@ -22479,7 +22489,7 @@
             "label": "owner",
             "description": [],
             "signature": [
-              "{ github: string; }"
+              "{ github: string; type?: \"elastic\" | \"partner\" | \"community\" | undefined; }"
             ],
             "path": "x-pack/plugins/fleet/common/types/models/package_spec.ts",
             "deprecated": false,
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index 76ace056690af3..98c3b0c71954c4 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index 8b01ecbd24e898..9bbc2d194bf10d 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index 8a8529e5ac1d2f..4daaac8bc91098 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index 92a80f07a1cbfd..f015c61e918cff 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index 2b3334256a6a6b..8b37c7c3f558a8 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index bcf41cc2783601..d728f1d5e1647f 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.devdocs.json b/api_docs/index_management.devdocs.json
index b5ba6df118a221..f3af751475dc76 100644
--- a/api_docs/index_management.devdocs.json
+++ b/api_docs/index_management.devdocs.json
@@ -388,6 +388,34 @@
           }
         ],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "indexManagement",
+        "id": "def-public.IndexManagementPluginStart",
+        "type": "Interface",
+        "tags": [],
+        "label": "IndexManagementPluginStart",
+        "description": [],
+        "path": "x-pack/plugins/index_management/public/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-public.IndexManagementPluginStart.extensionsService",
+            "type": "Object",
+            "tags": [],
+            "label": "extensionsService",
+            "description": [],
+            "signature": [
+              "ExtensionsSetup"
+            ],
+            "path": "x-pack/plugins/index_management/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -1298,7 +1326,9 @@
                 "section": "def-common.Mappings",
                 "text": "Mappings"
               },
-              " | undefined; }"
+              " | undefined; lifecycle?: (",
+              "IndicesDataLifecycleWithRollover",
+              " & { enabled?: boolean | undefined; }) | undefined; }"
             ],
             "path": "x-pack/plugins/index_management/common/types/component_templates.ts",
             "deprecated": false,
@@ -1331,6 +1361,94 @@
             "path": "x-pack/plugins/index_management/common/types/component_templates.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.ComponentTemplateSerialized.lifecycle",
+            "type": "Object",
+            "tags": [],
+            "label": "lifecycle",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "indexManagement",
+                "scope": "common",
+                "docId": "kibIndexManagementPluginApi",
+                "section": "def-common.DataRetention",
+                "text": "DataRetention"
+              },
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/index_management/common/types/component_templates.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "indexManagement",
+        "id": "def-common.DataRetention",
+        "type": "Interface",
+        "tags": [],
+        "label": "DataRetention",
+        "description": [],
+        "path": "x-pack/plugins/index_management/common/types/data_streams.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.DataRetention.enabled",
+            "type": "boolean",
+            "tags": [],
+            "label": "enabled",
+            "description": [],
+            "path": "x-pack/plugins/index_management/common/types/data_streams.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.DataRetention.infiniteDataRetention",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "infiniteDataRetention",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "x-pack/plugins/index_management/common/types/data_streams.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.DataRetention.value",
+            "type": "number",
+            "tags": [],
+            "label": "value",
+            "description": [],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/index_management/common/types/data_streams.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.DataRetention.unit",
+            "type": "string",
+            "tags": [],
+            "label": "unit",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/index_management/common/types/data_streams.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -2543,6 +2661,27 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "indexManagement",
+            "id": "def-common.TemplateDeserialized.lifecycle",
+            "type": "Object",
+            "tags": [],
+            "label": "lifecycle",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "indexManagement",
+                "scope": "common",
+                "docId": "kibIndexManagementPluginApi",
+                "section": "def-common.DataRetention",
+                "text": "DataRetention"
+              },
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/index_management/common/types/templates.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "indexManagement",
             "id": "def-common.TemplateDeserialized.composedOf",
@@ -2936,7 +3075,9 @@
                 "section": "def-common.Mappings",
                 "text": "Mappings"
               },
-              " | undefined; } | undefined"
+              " | undefined; lifecycle?: (",
+              "IndicesDataLifecycleWithRollover",
+              " & { enabled?: boolean | undefined; }) | undefined; } | undefined"
             ],
             "path": "x-pack/plugins/index_management/common/types/templates.ts",
             "deprecated": false,
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index 663fa0cd352679..d99952c4838c85 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/platform-deployment-management](https://github.com/orgs/elasti
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 206 | 0 | 201 | 4 |
+| 215 | 0 | 210 | 4 |
 
 ## Client
 
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 8a9e88cf2db65a..19401203c7f51d 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index 0b1e5ae24f771b..0cc16e89bd7d40 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index 4c43e51e2d2cef..63d7438c8904d7 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index 8febe841d8e0c0..189b6610ee6594 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index 94e5c48c4496cb..aabb76d630a7b7 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx
index 5349f3af5fc605..23e0ca70b44cf5 100644
--- a/api_docs/kbn_aiops_utils.mdx
+++ b/api_docs/kbn_aiops_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils
 title: "@kbn/aiops-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils']
 ---
 import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json';
diff --git a/api_docs/kbn_alerting_api_integration_helpers.mdx b/api_docs/kbn_alerting_api_integration_helpers.mdx
index 39ef4801b139c1..76f8c964865d53 100644
--- a/api_docs/kbn_alerting_api_integration_helpers.mdx
+++ b/api_docs/kbn_alerting_api_integration_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-api-integration-helpers
 title: "@kbn/alerting-api-integration-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-api-integration-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-api-integration-helpers']
 ---
 import kbnAlertingApiIntegrationHelpersObj from './kbn_alerting_api_integration_helpers.devdocs.json';
diff --git a/api_docs/kbn_alerting_state_types.mdx b/api_docs/kbn_alerting_state_types.mdx
index decbf540164919..c5357a0678468c 100644
--- a/api_docs/kbn_alerting_state_types.mdx
+++ b/api_docs/kbn_alerting_state_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-state-types
 title: "@kbn/alerting-state-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-state-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-state-types']
 ---
 import kbnAlertingStateTypesObj from './kbn_alerting_state_types.devdocs.json';
diff --git a/api_docs/kbn_alerts_as_data_utils.mdx b/api_docs/kbn_alerts_as_data_utils.mdx
index a5d117d5723221..14d1758ac4e23a 100644
--- a/api_docs/kbn_alerts_as_data_utils.mdx
+++ b/api_docs/kbn_alerts_as_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-as-data-utils
 title: "@kbn/alerts-as-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-as-data-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-as-data-utils']
 ---
 import kbnAlertsAsDataUtilsObj from './kbn_alerts_as_data_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts_ui_shared.mdx b/api_docs/kbn_alerts_ui_shared.mdx
index ebbdbca8a9aaa1..fe156ca3268c58 100644
--- a/api_docs/kbn_alerts_ui_shared.mdx
+++ b/api_docs/kbn_alerts_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-ui-shared
 title: "@kbn/alerts-ui-shared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-ui-shared plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-ui-shared']
 ---
 import kbnAlertsUiSharedObj from './kbn_alerts_ui_shared.devdocs.json';
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index 0b7dd80b3b3a97..41da2e03a3d147 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index 7683e2bcb0267e..05b22ea25bd417 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_collection_utils.devdocs.json b/api_docs/kbn_analytics_collection_utils.devdocs.json
new file mode 100644
index 00000000000000..3a3a34e764e585
--- /dev/null
+++ b/api_docs/kbn_analytics_collection_utils.devdocs.json
@@ -0,0 +1,47 @@
+{
+  "id": "@kbn/analytics-collection-utils",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/analytics-collection-utils",
+        "id": "def-common.isSyntheticsMonitor",
+        "type": "Function",
+        "tags": [],
+        "label": "isSyntheticsMonitor",
+        "description": [
+          "\nReturns whether the current navigation is performed by a Synthetics monitor\n(and hence, telemetry should not be collected)."
+        ],
+        "signature": [
+          "() => boolean"
+        ],
+        "path": "packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_analytics_collection_utils.mdx b/api_docs/kbn_analytics_collection_utils.mdx
new file mode 100644
index 00000000000000..f1cf88e92bbaa0
--- /dev/null
+++ b/api_docs/kbn_analytics_collection_utils.mdx
@@ -0,0 +1,30 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnAnalyticsCollectionUtilsPluginApi
+slug: /kibana-dev-docs/api/kbn-analytics-collection-utils
+title: "@kbn/analytics-collection-utils"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/analytics-collection-utils plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-collection-utils']
+---
+import kbnAnalyticsCollectionUtilsObj from './kbn_analytics_collection_utils.devdocs.json';
+
+
+
+Contact [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 1 | 0 | 0 | 0 |
+
+## Common
+
+### Functions
+<DocDefinitionList data={kbnAnalyticsCollectionUtilsObj.common.functions}/>
+
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index 09c2b17d706d91..409d8363c89879 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index b4541ac4a4ad92..92ee042360f6f3 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index a40c3f42195964..609bfbb645cafd 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index ca5f113a75fab4..c0222701054b58 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx
index 2df958d49823af..73674f838d059a 100644
--- a/api_docs/kbn_analytics_shippers_gainsight.mdx
+++ b/api_docs/kbn_analytics_shippers_gainsight.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight
 title: "@kbn/analytics-shippers-gainsight"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-gainsight plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight']
 ---
 import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index de4b1ddda4dd5e..d6f27633bf48b7 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index b589198be82c35..8a707c835f0f09 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace_client.devdocs.json b/api_docs/kbn_apm_synthtrace_client.devdocs.json
index 2bd574701728db..fed87d82059265 100644
--- a/api_docs/kbn_apm_synthtrace_client.devdocs.json
+++ b/api_docs/kbn_apm_synthtrace_client.devdocs.json
@@ -2437,7 +2437,7 @@
             "section": "def-common.ApmFields",
             "text": "ApmFields"
           },
-          ", \"@timestamp\" | \"ecs.version\" | \"observer.version_major\" | \"processor.event\" | \"event.ingested\" | \"observer.type\" | \"observer.version\" | \"metricset.name\" | \"processor.name\"> & Partial<{ 'labels.etag': string; agent_config_applied: number; 'event.agent_id_status': string; }>"
+          ", \"@timestamp\" | \"processor.event\" | \"ecs.version\" | \"event.ingested\" | \"observer.type\" | \"observer.version\" | \"observer.version_major\" | \"metricset.name\" | \"processor.name\"> & Partial<{ 'labels.etag': string; agent_config_applied: number; 'event.agent_id_status': string; }>"
         ],
         "path": "packages/kbn-apm-synthtrace-client/src/lib/agent_config/agent_config_fields.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index 0b9ee3691bb012..312a88198bc420 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index 774ed2b89f5175..7af7f1cef044fd 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index db125a6ec32dd6..e89aa154d812f9 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index 265aef6cd10630..5f522e29787b42 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index f7bff70376d929..3fa31abc0ff293 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
diff --git a/api_docs/kbn_chart_expressions_common.mdx b/api_docs/kbn_chart_expressions_common.mdx
index 9b3ade541eba75..2af9ff7332b85a 100644
--- a/api_docs/kbn_chart_expressions_common.mdx
+++ b/api_docs/kbn_chart_expressions_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-expressions-common
 title: "@kbn/chart-expressions-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-expressions-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-expressions-common']
 ---
 import kbnChartExpressionsCommonObj from './kbn_chart_expressions_common.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index eb5afd131b3286..3eeaf3cd311cb8 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index da16197e019612..7462733fc884f1 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index 683d382f170e7c..3de480ed219550 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 7e4341104281c7..04e7240b39f84f 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 99384e07907125..106c7c3e03f4c4 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_code_editor.mdx b/api_docs/kbn_code_editor.mdx
index 35ad1eedf78c0b..4acc329f7b7428 100644
--- a/api_docs/kbn_code_editor.mdx
+++ b/api_docs/kbn_code_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor
 title: "@kbn/code-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor']
 ---
 import kbnCodeEditorObj from './kbn_code_editor.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index 9e51888259b4f4..b278289fb313a2 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index 4f8985db93a7f9..8a9bde089c70e4 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index eff87cb5f28449..e192ffcfa0ad1d 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index cbd8024253a418..54faa957e183aa 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index 1a35d390f9a61f..e0502e81164591 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_tabbed_table_list_view.mdx b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
index e6c1a5458e2b52..e2d7cf44bf7186 100644
--- a/api_docs/kbn_content_management_tabbed_table_list_view.mdx
+++ b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-tabbed-table-list-view
 title: "@kbn/content-management-tabbed-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-tabbed-table-list-view plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-tabbed-table-list-view']
 ---
 import kbnContentManagementTabbedTableListViewObj from './kbn_content_management_tabbed_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view.mdx b/api_docs/kbn_content_management_table_list_view.mdx
index ec4e5269bcf645..ad5d44921985b2 100644
--- a/api_docs/kbn_content_management_table_list_view.mdx
+++ b/api_docs/kbn_content_management_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view
 title: "@kbn/content-management-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view']
 ---
 import kbnContentManagementTableListViewObj from './kbn_content_management_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view_table.mdx b/api_docs/kbn_content_management_table_list_view_table.mdx
index b10cae22d456a0..8702d5fdb32c53 100644
--- a/api_docs/kbn_content_management_table_list_view_table.mdx
+++ b/api_docs/kbn_content_management_table_list_view_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view-table
 title: "@kbn/content-management-table-list-view-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view-table plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view-table']
 ---
 import kbnContentManagementTableListViewTableObj from './kbn_content_management_table_list_view_table.devdocs.json';
diff --git a/api_docs/kbn_content_management_utils.mdx b/api_docs/kbn_content_management_utils.mdx
index 1469e133d487b9..7e84e380d6e1c0 100644
--- a/api_docs/kbn_content_management_utils.mdx
+++ b/api_docs/kbn_content_management_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-utils
 title: "@kbn/content-management-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-utils']
 ---
 import kbnContentManagementUtilsObj from './kbn_content_management_utils.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index f712106cf8f09a..fda7f80ae2ea2e 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index 6d359fc8194b84..96fc078ccc2456 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index d3d0d35c6e6926..39b7d6ab11ef85 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index d35a823e2c64eb..b71dcc4c4afd6e 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index 9512f6077cc793..f3658c59f301da 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index f968a4405c7415..1ff31f38bea3f0 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index cbcf773c9d7bb3..ffdcb671242e9f 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index 20baf5fda9507b..b81dc0db543ff5 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index 9e7dcdcc5b9dbb..728714013ec780 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index b74d90504b20c4..5807d0ccae7004 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index 8b2967a3980ff5..dc71b26849f48f 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index 738471d252a26a..0ee803e0744ea4 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index 1c90a4d719469f..eaabeb2aba8e42 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index c65cf3f6c3ace7..c3cf9ff8c65f78 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index 91d45dcd403bdf..2025c1859d3056 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index aad01347e34dd8..46b5ea91483107 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index 346f7ae0cdf132..c2956651186b5b 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index 4b66e271eb6e97..00dafd0d77c003 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index 8c67aaf07c0c2e..5d371de09c55ea 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index 0cc75d1b69d901..f1378e9adc70c5 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index 820464c9b28aae..42b48847c1dc79 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index 89a72cbb0cfa8e..8db90e89076f4a 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index 0fa1b61f658da8..8218a43de3ef6c 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index aaab43682fe35f..9ee0774c8ef8db 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index 68a60606dcd274..5f619525c811bf 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index 44cc5278fd53b6..8e2b103fd6d0d0 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index 3608be1d96e465..92a3b393312a13 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index 9997ac0c27a7c2..98d7ccc849ffed 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index 394ac4e44941da..6d596de7ccd1b1 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index 30ee602f5fd7b4..cd145170012d7f 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index 2202c66110f4c1..b3c56d63cce169 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index e6b20f63b20744..1c85a8bf3ba708 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index 78ad726dad0152..bb1e47e8199562 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 2af0d1fde963c9..5b7ed830d6a54e 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index bf788ba7abf12f..1516f640f69d75 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index 464fb71e20fe8e..939aa1d4781ef7 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index 3f7a9d7414ed79..b8ec0277deff1a 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index b045cd749cabb6..0d897a649adc05 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index 0be92f27661134..bdaaf1d44fccb6 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index f4774a5a75447a..cdd5e7c326e8a9 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index 3d93b32ce00173..a2fb261fc8f017 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index d0c3624f10f6a9..729b38e60a5c3b 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index 9d7fb20dc9e27e..ad7f55b1e5bfdc 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index ca3a588fff62a6..14c49dcb61f0df 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.devdocs.json b/api_docs/kbn_core_elasticsearch_server.devdocs.json
index b926e48892b73a..5b1adab0294956 100644
--- a/api_docs/kbn_core_elasticsearch_server.devdocs.json
+++ b/api_docs/kbn_core_elasticsearch_server.devdocs.json
@@ -1032,7 +1032,7 @@
               "Headers used for authentication against Elasticsearch"
             ],
             "signature": [
-              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
             ],
             "path": "packages/core/elasticsearch/core-elasticsearch-server/src/client/scopeable_request.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index 0315f579853c63..7ba89171046130 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.devdocs.json b/api_docs/kbn_core_elasticsearch_server_internal.devdocs.json
index ddc738b65660a6..82ccce9ed5415b 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.devdocs.json
+++ b/api_docs/kbn_core_elasticsearch_server_internal.devdocs.json
@@ -1567,6 +1567,9 @@
             "tags": [],
             "label": "cluster_build_flavor",
             "description": [],
+            "signature": [
+              "string | undefined"
+            ],
             "path": "packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts",
             "deprecated": false,
             "trackAdoption": false
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index 2c48581f0b683a..cb8834354b9e6f 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index 109b228419c354..8e11f3f668e01c 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index f46045bcdf1aab..fd28961e92c338 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index ed746cb511d112..53dbc7f736451f 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index a280d52377d609..0f90f7b33c80b4 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index 1e527a1aa7a948..7b896d7816398d 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index 0d3e5418829297..825f0f87bd7eb3 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index 6b74411a76b275..6e813d506614db 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index 47ab866be22158..4645c255a61ede 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index 2cafb5f2afa499..8d717516e1ee83 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index 92637b63638dfc..4cc7ac4de5ed04 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index 636d191bd921de..2b7657a91f4b1e 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index 4abfa985ba28e4..03cd6e56b12a8c 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 958c1086e2672f..c6a24b66217176 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index fd5258e49d831a..09c5e377e2b70b 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index 788743a3aedd43..96a2ad090c4014 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index 2bfde8199d4af8..8d8a41aa64a53c 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index 14e0ba6c45aaea..c35ce23823fece 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index 67cf62397ce852..4e8df446989069 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 4d5ad2996daf2d..d47c318a070784 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index 753a7d5f550df1..6ab812b7ed9ab3 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index 8ccbc2e1c91f72..2d55704c31c03d 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index c9d6ae227fb9cc..d5848e3bb43bda 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index c5166c225b4b07..49d307af713ede 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.devdocs.json b/api_docs/kbn_core_http_server.devdocs.json
index 7798bb1d4ebed3..de83f689115482 100644
--- a/api_docs/kbn_core_http_server.devdocs.json
+++ b/api_docs/kbn_core_http_server.devdocs.json
@@ -748,7 +748,7 @@
               "The headers associated with the request."
             ],
             "signature": [
-              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
             ],
             "path": "packages/core/http/core-http-server/src/router/raw_request.ts",
             "deprecated": false,
@@ -10214,7 +10214,7 @@
               "\nReadonly copy of incoming request headers."
             ],
             "signature": [
-              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+              "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
             ],
             "path": "packages/core/http/core-http-server/src/router/request.ts",
             "deprecated": false,
@@ -13183,6 +13183,10 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/server/routes/management.ts"
               },
+              {
+                "plugin": "fleet",
+                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
+              },
               {
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_config.ts"
@@ -13195,10 +13199,6 @@
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_last_reported.ts"
               },
-              {
-                "plugin": "fleet",
-                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
-              },
               {
                 "plugin": "metricsDataAccess",
                 "path": "x-pack/plugins/metrics_data_access/server/lib/adapters/framework/kibana_framework_adapter.ts"
@@ -13918,6 +13918,10 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/server/routes/anomaly_detectors.ts"
               },
+              {
+                "plugin": "fleet",
+                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
+              },
               {
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts"
@@ -13926,10 +13930,6 @@
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_last_reported.ts"
               },
-              {
-                "plugin": "fleet",
-                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
-              },
               {
                 "plugin": "metricsDataAccess",
                 "path": "x-pack/plugins/metrics_data_access/server/lib/adapters/framework/kibana_framework_adapter.ts"
@@ -14513,6 +14513,10 @@
                 "plugin": "ml",
                 "path": "x-pack/plugins/ml/server/routes/alerting.ts"
               },
+              {
+                "plugin": "fleet",
+                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
+              },
               {
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts"
@@ -14525,10 +14529,6 @@
                 "plugin": "telemetry",
                 "path": "src/plugins/telemetry/server/routes/telemetry_usage_stats.ts"
               },
-              {
-                "plugin": "fleet",
-                "path": "x-pack/plugins/fleet/server/services/security/fleet_router.ts"
-              },
               {
                 "plugin": "metricsDataAccess",
                 "path": "x-pack/plugins/metrics_data_access/server/lib/adapters/framework/kibana_framework_adapter.ts"
@@ -15942,7 +15942,7 @@
           "\nHttp request headers to read."
         ],
         "signature": [
-          "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
+          "{ date?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; range?: string | string[] | undefined; from?: string | string[] | undefined; etag?: string | string[] | undefined; accept?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; allow?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; host?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; origin?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }"
         ],
         "path": "packages/core/http/core-http-server/src/router/headers.ts",
         "deprecated": false,
@@ -16248,7 +16248,7 @@
           "\nSet of well-known HTTP headers."
         ],
         "signature": [
-          "\"date\" | \"warning\" | \"range\" | \"from\" | \"etag\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\""
+          "\"date\" | \"warning\" | \"location\" | \"range\" | \"from\" | \"etag\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\""
         ],
         "path": "packages/core/http/core-http-server/src/router/headers.ts",
         "deprecated": false,
@@ -17354,7 +17354,7 @@
           "\nHttp response headers to set."
         ],
         "signature": [
-          "Record<string, string | string[]> | Record<\"date\" | \"warning\" | \"range\" | \"from\" | \"etag\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"location\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]>"
+          "Record<string, string | string[]> | Record<\"date\" | \"warning\" | \"location\" | \"range\" | \"from\" | \"etag\" | \"accept\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"allow\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"expect\" | \"expires\" | \"forwarded\" | \"host\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"origin\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]>"
         ],
         "path": "packages/core/http/core-http-server/src/router/headers.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index a2c5bb67042a25..69ec0d058df74e 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index dd9452034c3bba..c73351b576d2d2 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index a8db8d4b210639..e70fdddbe69f8f 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index 4e787a04108bea..9305b77d9d6962 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index 467a4d2d7775b4..8e30a9928bc7a6 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index f1956673ae7dd0..d88e0e3a32c04d 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index fb3584a8f3fd30..67a0105427b183 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index 1bffca1a004ab8..27634b6d7d8e72 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index 2b66e8eea02749..8e96dd1593f0ae 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index f5623c603bd32e..dd835c6f2488f0 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index 502f2a91308d02..855e4b70b0985d 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 2b71abfc1ea8a4..3ff751bc15f564 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index 9ca5ba14fbd835..9a3054fca09e74 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index e1df7f4daea4b3..35bf496984fda0 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index b82e8a97c2d3ad..698f2f3105d2cd 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index df33f5414b56cd..a328d5c73083f1 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index 2719840e0362d5..c77747874f4e5a 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index 65c9b911db15a4..96261df56bc859 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index 2e1b08ebff16d5..1a5bd3676d53a0 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index 9381b0609991fc..700a2f0444662f 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index 0ed40f70fa83db..21fffacb7a0252 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index f2b43f07cf11ac..9d50d48dd9b912 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index c184d56ab961f8..90d40160bdd600 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index e690a1a81c64ed..fcb251894033da 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 57cfb003b40513..648476b471d7bf 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 037f00fc1f2d44..d64bea6e8ceb25 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index e95d84d0fd7b13..64fb1e71ad526f 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index b59392aaeab6df..70776e7f017105 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index 356d844323c814..326e2fd1a347df 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index 6ee83a5d07fc12..4c274ad8158727 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index b9eda3aeff0371..f224b2f42c6173 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index 304696001866fc..295f912277225b 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index 085e40c56353ae..970addfac64d10 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index 3dd4adf128eb06..a46d760d369821 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index 8208fd34bcb45b..74169fb6b52f95 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 1602a02dcea983..0ac7db1caa86c2 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index 46a90d1cfcb72c..0f12ec12987fa0 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_contracts_browser.mdx b/api_docs/kbn_core_plugins_contracts_browser.mdx
index a967dab339293d..3cc884220fde56 100644
--- a/api_docs/kbn_core_plugins_contracts_browser.mdx
+++ b/api_docs/kbn_core_plugins_contracts_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-contracts-browser
 title: "@kbn/core-plugins-contracts-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-contracts-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-contracts-browser']
 ---
 import kbnCorePluginsContractsBrowserObj from './kbn_core_plugins_contracts_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_contracts_server.mdx b/api_docs/kbn_core_plugins_contracts_server.mdx
index 90d1e2f22fe492..ba98fb28ee9332 100644
--- a/api_docs/kbn_core_plugins_contracts_server.mdx
+++ b/api_docs/kbn_core_plugins_contracts_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-contracts-server
 title: "@kbn/core-plugins-contracts-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-contracts-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-contracts-server']
 ---
 import kbnCorePluginsContractsServerObj from './kbn_core_plugins_contracts_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.devdocs.json b/api_docs/kbn_core_plugins_server.devdocs.json
index 6de41df4a25aa9..4a254538d50521 100644
--- a/api_docs/kbn_core_plugins_server.devdocs.json
+++ b/api_docs/kbn_core_plugins_server.devdocs.json
@@ -1222,7 +1222,7 @@
             "section": "def-common.PluginInitializerContext",
             "text": "PluginInitializerContext"
           },
-          "<unknown>) => ",
+          "<unknown>) => Promise<",
           {
             "pluginId": "@kbn/core-plugins-server",
             "scope": "common",
@@ -1246,7 +1246,7 @@
             "section": "def-common.AsyncPlugin",
             "text": "AsyncPlugin"
           },
-          "<TSetup, TStart, TPluginsSetup, TPluginsStart>"
+          "<TSetup, TStart, TPluginsSetup, TPluginsStart>>"
         ],
         "path": "packages/core/plugins/core-plugins-server/src/types.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index dd5d2d6b365bc8..8dd6ec1f0070e8 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index f0978ccf5b1ea6..2e161fa2396efd 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index afdb69e3016356..76b4ce950ac39f 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index 06b9e164301cba..4da0a4add6f7f4 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index 588f6037cd1c6a..611f8deaddb62b 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index 77eea817ce0c58..24702fd09bd5c5 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index 8513fdbbcad6e1..be52019337cf2a 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index e2bedb048a9f8b..30381c53066bde 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index 181855a71a163b..b8d9b047e9fc20 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index bb591388bd00b3..80903bbc0c714e 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 8c8a4b5806f764..735f71ed709531 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index 32ed91ad28a580..5a4cfdbcabdf52 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index 658783e787c8f2..edb1dda31a9f25 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index c4ea045c5d3ee8..3c2235d8b525e9 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index 42c46012ed39d6..e92be68f2c60cb 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index a9c52995de521a..444409eceaf983 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index 8c2d3b91951093..9c58104676a714 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index c37f9837a5166b..17fa146e01bf11 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index 5d8322dd56cccb..cb1c421f733619 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index 3ffd7a95e8d430..c6a2df2bdfb819 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index 912efca92b4225..ba4476ba76971e 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index d6ac3fd90180af..00ce80eec7f775 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index 1d08581d41ead5..094fb5682e9ece 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index c56345a83ea353..4b3b2779f91193 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index 48b5572776339f..c564ca08a048de 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index abe953e28d4a00..6721891c631ab1 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index 23392fefa6849c..af18c864dafd0c 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index 74130005e0b64f..25887ac55df6d9 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index 2405cae42ef0c6..abd13b6e9436be 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index 9a830bc84f8844..93a8f6300d55ee 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index c44712e5ae99a5..7fd05afebd092f 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index d57a951dc12368..4b3175e691341f 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 370cc73d276c07..c0efbacdd0bb1a 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_model_versions.mdx b/api_docs/kbn_core_test_helpers_model_versions.mdx
index e6b5c40790fcb9..fcfabc7d2b9dbb 100644
--- a/api_docs/kbn_core_test_helpers_model_versions.mdx
+++ b/api_docs/kbn_core_test_helpers_model_versions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-model-versions
 title: "@kbn/core-test-helpers-model-versions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-model-versions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-model-versions']
 ---
 import kbnCoreTestHelpersModelVersionsObj from './kbn_core_test_helpers_model_versions.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index cb5f59e90c2805..0761d79e0d95e4 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index e818714e9c4f0e..8743138f0298af 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index cb33695a1bf1b6..444d0a84a8df7c 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index 3eb2726ff8dff9..adc8eb15e68ea9 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index 0f9136192ab628..fc5b8e1a44ae1c 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index ff557a6ee5c84e..4717d5b705d39b 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index 2437e23b3b0633..0132060ef647c4 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 589502a6c70fb0..051290535f7598 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index 695476f91b9129..b226da910d7145 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index b4c5a99ac8c7ca..a07743c906bbef 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index 81e05e971d7b97..9d05216df57ff6 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index 0aaf205f33fbd5..a7250b63482075 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index f325a7cd1500f8..776bb1b3e2a7c8 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index 65f3204acdfcbd..8382c5d6b080c7 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server.mdx b/api_docs/kbn_core_user_settings_server.mdx
index 036325e5cc1fec..6c39b8b24267d4 100644
--- a/api_docs/kbn_core_user_settings_server.mdx
+++ b/api_docs/kbn_core_user_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server
 title: "@kbn/core-user-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server']
 ---
 import kbnCoreUserSettingsServerObj from './kbn_core_user_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server_internal.mdx b/api_docs/kbn_core_user_settings_server_internal.mdx
index c5c04501972416..c68e453848d86d 100644
--- a/api_docs/kbn_core_user_settings_server_internal.mdx
+++ b/api_docs/kbn_core_user_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server-internal
 title: "@kbn/core-user-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server-internal plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server-internal']
 ---
 import kbnCoreUserSettingsServerInternalObj from './kbn_core_user_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server_mocks.mdx b/api_docs/kbn_core_user_settings_server_mocks.mdx
index 8c6fa7792422aa..09c71e11eb188f 100644
--- a/api_docs/kbn_core_user_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_user_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server-mocks
 title: "@kbn/core-user-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server-mocks']
 ---
 import kbnCoreUserSettingsServerMocksObj from './kbn_core_user_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index 3557220b3b2a64..8fd8b457f272fc 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index 6790f3501e4ad7..b741fd434c6541 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_custom_integrations.mdx b/api_docs/kbn_custom_integrations.mdx
index 14801203ee2e87..67837181e54f3b 100644
--- a/api_docs/kbn_custom_integrations.mdx
+++ b/api_docs/kbn_custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-custom-integrations
 title: "@kbn/custom-integrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/custom-integrations plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/custom-integrations']
 ---
 import kbnCustomIntegrationsObj from './kbn_custom_integrations.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index 806ddd39465f05..8e67ef43452c97 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_data_service.mdx b/api_docs/kbn_data_service.mdx
index 7cf005cbc28095..e95124d51e3d4e 100644
--- a/api_docs/kbn_data_service.mdx
+++ b/api_docs/kbn_data_service.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-service
 title: "@kbn/data-service"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-service plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-service']
 ---
 import kbnDataServiceObj from './kbn_data_service.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 563687e0ec1ede..8e4ae3ecdfd036 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_analytics.mdx b/api_docs/kbn_deeplinks_analytics.mdx
index 45c0fa05d081cd..882b9fda4cf344 100644
--- a/api_docs/kbn_deeplinks_analytics.mdx
+++ b/api_docs/kbn_deeplinks_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-analytics
 title: "@kbn/deeplinks-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-analytics plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-analytics']
 ---
 import kbnDeeplinksAnalyticsObj from './kbn_deeplinks_analytics.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_devtools.mdx b/api_docs/kbn_deeplinks_devtools.mdx
index f804a844ff8e14..4adaa6eeec3083 100644
--- a/api_docs/kbn_deeplinks_devtools.mdx
+++ b/api_docs/kbn_deeplinks_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-devtools
 title: "@kbn/deeplinks-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-devtools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-devtools']
 ---
 import kbnDeeplinksDevtoolsObj from './kbn_deeplinks_devtools.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_management.mdx b/api_docs/kbn_deeplinks_management.mdx
index 4f92dbe05e00b8..c575cbfbda2182 100644
--- a/api_docs/kbn_deeplinks_management.mdx
+++ b/api_docs/kbn_deeplinks_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-management
 title: "@kbn/deeplinks-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-management plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-management']
 ---
 import kbnDeeplinksManagementObj from './kbn_deeplinks_management.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_ml.mdx b/api_docs/kbn_deeplinks_ml.mdx
index 7c1d93f0b18f8b..279a828cbe84a0 100644
--- a/api_docs/kbn_deeplinks_ml.mdx
+++ b/api_docs/kbn_deeplinks_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-ml
 title: "@kbn/deeplinks-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-ml plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-ml']
 ---
 import kbnDeeplinksMlObj from './kbn_deeplinks_ml.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_observability.mdx b/api_docs/kbn_deeplinks_observability.mdx
index b942771d9a391a..07c06bd01fe2ba 100644
--- a/api_docs/kbn_deeplinks_observability.mdx
+++ b/api_docs/kbn_deeplinks_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-observability
 title: "@kbn/deeplinks-observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-observability plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-observability']
 ---
 import kbnDeeplinksObservabilityObj from './kbn_deeplinks_observability.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_search.mdx b/api_docs/kbn_deeplinks_search.mdx
index 968890a1990268..bd5117564cbebb 100644
--- a/api_docs/kbn_deeplinks_search.mdx
+++ b/api_docs/kbn_deeplinks_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-search
 title: "@kbn/deeplinks-search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-search plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-search']
 ---
 import kbnDeeplinksSearchObj from './kbn_deeplinks_search.devdocs.json';
diff --git a/api_docs/kbn_default_nav_analytics.mdx b/api_docs/kbn_default_nav_analytics.mdx
index bf90f6f8018c1e..1cda3dfdf6cc9b 100644
--- a/api_docs/kbn_default_nav_analytics.mdx
+++ b/api_docs/kbn_default_nav_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-analytics
 title: "@kbn/default-nav-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-analytics plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-analytics']
 ---
 import kbnDefaultNavAnalyticsObj from './kbn_default_nav_analytics.devdocs.json';
diff --git a/api_docs/kbn_default_nav_devtools.mdx b/api_docs/kbn_default_nav_devtools.mdx
index 55cdf9fb776c71..3878c6f84ee50f 100644
--- a/api_docs/kbn_default_nav_devtools.mdx
+++ b/api_docs/kbn_default_nav_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-devtools
 title: "@kbn/default-nav-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-devtools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-devtools']
 ---
 import kbnDefaultNavDevtoolsObj from './kbn_default_nav_devtools.devdocs.json';
diff --git a/api_docs/kbn_default_nav_management.mdx b/api_docs/kbn_default_nav_management.mdx
index 05484e1161112f..0e79c5c0b93c58 100644
--- a/api_docs/kbn_default_nav_management.mdx
+++ b/api_docs/kbn_default_nav_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-management
 title: "@kbn/default-nav-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-management plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-management']
 ---
 import kbnDefaultNavManagementObj from './kbn_default_nav_management.devdocs.json';
diff --git a/api_docs/kbn_default_nav_ml.mdx b/api_docs/kbn_default_nav_ml.mdx
index a45fdbc62116cb..2910fa34db36d7 100644
--- a/api_docs/kbn_default_nav_ml.mdx
+++ b/api_docs/kbn_default_nav_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-ml
 title: "@kbn/default-nav-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-ml plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-ml']
 ---
 import kbnDefaultNavMlObj from './kbn_default_nav_ml.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index c70a020354634e..63b6d26c64f32e 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index 6516a520cf45b8..3bbf3fa4b50aac 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index 422ea43ace47cb..c8c3a0bbee67ae 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index 8a1e67a87ccd6a..c2796e378be559 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_discover_utils.mdx b/api_docs/kbn_discover_utils.mdx
index 9f15d474a0cb71..c6fd7cf2abb101 100644
--- a/api_docs/kbn_discover_utils.mdx
+++ b/api_docs/kbn_discover_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-discover-utils
 title: "@kbn/discover-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/discover-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/discover-utils']
 ---
 import kbnDiscoverUtilsObj from './kbn_discover_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.devdocs.json b/api_docs/kbn_doc_links.devdocs.json
index c7391407a995ab..4c91d4cbee507b 100644
--- a/api_docs/kbn_doc_links.devdocs.json
+++ b/api_docs/kbn_doc_links.devdocs.json
@@ -658,7 +658,7 @@
             "label": "observability",
             "description": [],
             "signature": [
-              "{ readonly guide: string; readonly infrastructureThreshold: string; readonly logsThreshold: string; readonly metricsThreshold: string; readonly threshold: string; readonly monitorStatus: string; readonly monitorUptime: string; readonly tlsCertificate: string; readonly uptimeDurationAnomaly: string; readonly monitorLogs: string; readonly analyzeMetrics: string; readonly monitorUptimeSynthetics: string; readonly userExperience: string; readonly createAlerts: string; readonly syntheticsAlerting: string; readonly syntheticsCommandReference: string; readonly syntheticsProjectMonitors: string; readonly syntheticsMigrateFromIntegration: string; readonly sloBurnRateRule: string; }"
+              "{ readonly guide: string; readonly infrastructureThreshold: string; readonly logsThreshold: string; readonly metricsThreshold: string; readonly customThreshold: string; readonly monitorStatus: string; readonly monitorUptime: string; readonly tlsCertificate: string; readonly uptimeDurationAnomaly: string; readonly monitorLogs: string; readonly analyzeMetrics: string; readonly monitorUptimeSynthetics: string; readonly userExperience: string; readonly createAlerts: string; readonly syntheticsAlerting: string; readonly syntheticsCommandReference: string; readonly syntheticsProjectMonitors: string; readonly syntheticsMigrateFromIntegration: string; readonly sloBurnRateRule: string; }"
             ],
             "path": "packages/kbn-doc-links/src/types.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index d132a523f673e8..956715f22011e3 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index 1435adc05aa9a1..93ddee1f4b7386 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_dom_drag_drop.mdx b/api_docs/kbn_dom_drag_drop.mdx
index cf006d20f611ac..cfca9512a5004c 100644
--- a/api_docs/kbn_dom_drag_drop.mdx
+++ b/api_docs/kbn_dom_drag_drop.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dom-drag-drop
 title: "@kbn/dom-drag-drop"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dom-drag-drop plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dom-drag-drop']
 ---
 import kbnDomDragDropObj from './kbn_dom_drag_drop.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index 1dd79a773c680a..e5ea9774fd2f53 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx
index ac42a93c6248f4..026ece1775d52b 100644
--- a/api_docs/kbn_ecs.mdx
+++ b/api_docs/kbn_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs
 title: "@kbn/ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs']
 ---
 import kbnEcsObj from './kbn_ecs.devdocs.json';
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.mdx b/api_docs/kbn_ecs_data_quality_dashboard.mdx
index 655633477010a1..e1eb83ecca662d 100644
--- a/api_docs/kbn_ecs_data_quality_dashboard.mdx
+++ b/api_docs/kbn_ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs-data-quality-dashboard
 title: "@kbn/ecs-data-quality-dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs-data-quality-dashboard plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs-data-quality-dashboard']
 ---
 import kbnEcsDataQualityDashboardObj from './kbn_ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/kbn_elastic_assistant.mdx b/api_docs/kbn_elastic_assistant.mdx
index 8c64e7d276b935..5cde4c3ad25ebf 100644
--- a/api_docs/kbn_elastic_assistant.mdx
+++ b/api_docs/kbn_elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-elastic-assistant
 title: "@kbn/elastic-assistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/elastic-assistant plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/elastic-assistant']
 ---
 import kbnElasticAssistantObj from './kbn_elastic_assistant.devdocs.json';
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index 9b6899d046e79a..19e005519406d8 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index cfde8f51320946..feca9bd4bdf1c2 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index ee15d944ea53f4..9abe569c9e6b5f 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index a54cfc339e5e1b..a20beb160dc9d0 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index 2b438ddf0fc73d..5845573fb4ae8a 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index 7ac64671251ed1..366cdec67c8c71 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_event_annotation_common.mdx b/api_docs/kbn_event_annotation_common.mdx
index 98447ee7d00e8e..e0d7211513df71 100644
--- a/api_docs/kbn_event_annotation_common.mdx
+++ b/api_docs/kbn_event_annotation_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-common
 title: "@kbn/event-annotation-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-common']
 ---
 import kbnEventAnnotationCommonObj from './kbn_event_annotation_common.devdocs.json';
diff --git a/api_docs/kbn_event_annotation_components.mdx b/api_docs/kbn_event_annotation_components.mdx
index d9d7f28c771834..03d1d494ef0a5a 100644
--- a/api_docs/kbn_event_annotation_components.mdx
+++ b/api_docs/kbn_event_annotation_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-components
 title: "@kbn/event-annotation-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-components']
 ---
 import kbnEventAnnotationComponentsObj from './kbn_event_annotation_components.devdocs.json';
diff --git a/api_docs/kbn_expandable_flyout.mdx b/api_docs/kbn_expandable_flyout.mdx
index 282dcd8a40ce07..bca15df2c67bdf 100644
--- a/api_docs/kbn_expandable_flyout.mdx
+++ b/api_docs/kbn_expandable_flyout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-expandable-flyout
 title: "@kbn/expandable-flyout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/expandable-flyout plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/expandable-flyout']
 ---
 import kbnExpandableFlyoutObj from './kbn_expandable_flyout.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index 444f905a6ad60d..8ee2498fdb00df 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_field_utils.mdx b/api_docs/kbn_field_utils.mdx
index 4af2dd125e4180..aab8071d09c55d 100644
--- a/api_docs/kbn_field_utils.mdx
+++ b/api_docs/kbn_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-utils
 title: "@kbn/field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-utils']
 ---
 import kbnFieldUtilsObj from './kbn_field_utils.devdocs.json';
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 677aeb3cda9a9e..b3e0721d84b8e5 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 938d20fe119a1b..c6390d89bfdab5 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index 5802e421aab209..27ce99c92bc32a 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_generate_console_definitions.mdx b/api_docs/kbn_generate_console_definitions.mdx
index cc00c519f68430..2a12d265387b35 100644
--- a/api_docs/kbn_generate_console_definitions.mdx
+++ b/api_docs/kbn_generate_console_definitions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-console-definitions
 title: "@kbn/generate-console-definitions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-console-definitions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-console-definitions']
 ---
 import kbnGenerateConsoleDefinitionsObj from './kbn_generate_console_definitions.devdocs.json';
diff --git a/api_docs/kbn_generate_csv.devdocs.json b/api_docs/kbn_generate_csv.devdocs.json
index 2b04c8389060ce..f776c97bdf55cb 100644
--- a/api_docs/kbn_generate_csv.devdocs.json
+++ b/api_docs/kbn_generate_csv.devdocs.json
@@ -9,18 +9,10 @@
     "objects": []
   },
   "server": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [],
-    "objects": []
-  },
-  "common": {
     "classes": [
       {
         "parentPluginId": "@kbn/generate-csv",
-        "id": "def-common.CsvGenerator",
+        "id": "def-server.CsvGenerator",
         "type": "Class",
         "tags": [],
         "label": "CsvGenerator",
@@ -31,7 +23,7 @@
         "children": [
           {
             "parentPluginId": "@kbn/generate-csv",
-            "id": "def-common.CsvGenerator.Unnamed",
+            "id": "def-server.CsvGenerator.Unnamed",
             "type": "Function",
             "tags": [],
             "label": "Constructor",
@@ -45,20 +37,14 @@
             "children": [
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$1",
+                "id": "def-server.CsvGenerator.Unnamed.$1",
                 "type": "Object",
                 "tags": [],
                 "label": "job",
                 "description": [],
                 "signature": [
                   "Omit<",
-                  {
-                    "pluginId": "@kbn/generate-csv-types",
-                    "scope": "common",
-                    "docId": "kibKbnGenerateCsvTypesPluginApi",
-                    "section": "def-common.JobParams",
-                    "text": "JobParams"
-                  },
+                  "JobParamsCSV",
                   ", \"version\">"
                 ],
                 "path": "packages/kbn-generate-csv/src/generate_csv.ts",
@@ -68,19 +54,21 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$2",
+                "id": "def-server.CsvGenerator.Unnamed.$2",
                 "type": "Object",
                 "tags": [],
                 "label": "config",
                 "description": [],
                 "signature": [
+                  "Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   {
-                    "pluginId": "@kbn/generate-csv-types",
+                    "pluginId": "@kbn/config-schema",
                     "scope": "common",
-                    "docId": "kibKbnGenerateCsvTypesPluginApi",
-                    "section": "def-common.CsvConfig",
-                    "text": "CsvConfig"
-                  }
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>"
                 ],
                 "path": "packages/kbn-generate-csv/src/generate_csv.ts",
                 "deprecated": false,
@@ -89,7 +77,7 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$3",
+                "id": "def-server.CsvGenerator.Unnamed.$3",
                 "type": "Object",
                 "tags": [],
                 "label": "clients",
@@ -104,7 +92,7 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$4",
+                "id": "def-server.CsvGenerator.Unnamed.$4",
                 "type": "Object",
                 "tags": [],
                 "label": "dependencies",
@@ -119,7 +107,7 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$5",
+                "id": "def-server.CsvGenerator.Unnamed.$5",
                 "type": "Object",
                 "tags": [],
                 "label": "cancellationToken",
@@ -140,7 +128,7 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$6",
+                "id": "def-server.CsvGenerator.Unnamed.$6",
                 "type": "Object",
                 "tags": [],
                 "label": "logger",
@@ -161,7 +149,7 @@
               },
               {
                 "parentPluginId": "@kbn/generate-csv",
-                "id": "def-common.CsvGenerator.Unnamed.$7",
+                "id": "def-server.CsvGenerator.Unnamed.$7",
                 "type": "Object",
                 "tags": [],
                 "label": "stream",
@@ -179,20 +167,14 @@
           },
           {
             "parentPluginId": "@kbn/generate-csv",
-            "id": "def-common.CsvGenerator.generateData",
+            "id": "def-server.CsvGenerator.generateData",
             "type": "Function",
             "tags": [],
             "label": "generateData",
             "description": [],
             "signature": [
               "() => Promise<",
-              {
-                "pluginId": "@kbn/reporting-common",
-                "scope": "common",
-                "docId": "kibKbnReportingCommonPluginApi",
-                "section": "def-common.TaskRunResult",
-                "text": "TaskRunResult"
-              },
+              "TaskRunResult",
               ">"
             ],
             "path": "packages/kbn-generate-csv/src/generate_csv.ts",
@@ -210,5 +192,13 @@
     "enums": [],
     "misc": [],
     "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
   }
 }
\ No newline at end of file
diff --git a/api_docs/kbn_generate_csv.mdx b/api_docs/kbn_generate_csv.mdx
index 1f6af6e0ce386f..15f0991bf7e3ce 100644
--- a/api_docs/kbn_generate_csv.mdx
+++ b/api_docs/kbn_generate_csv.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-csv
 title: "@kbn/generate-csv"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-csv plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-csv']
 ---
 import kbnGenerateCsvObj from './kbn_generate_csv.devdocs.json';
@@ -21,10 +21,10 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 10 | 0 | 10 | 0 |
+| 10 | 0 | 10 | 1 |
 
-## Common
+## Server
 
 ### Classes
-<DocDefinitionList data={kbnGenerateCsvObj.common.classes}/>
+<DocDefinitionList data={kbnGenerateCsvObj.server.classes}/>
 
diff --git a/api_docs/kbn_generate_csv_types.devdocs.json b/api_docs/kbn_generate_csv_types.devdocs.json
deleted file mode 100644
index c816650afc29ae..00000000000000
--- a/api_docs/kbn_generate_csv_types.devdocs.json
+++ /dev/null
@@ -1,244 +0,0 @@
-{
-  "id": "@kbn/generate-csv-types",
-  "client": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [],
-    "objects": []
-  },
-  "server": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [],
-    "enums": [],
-    "misc": [],
-    "objects": []
-  },
-  "common": {
-    "classes": [],
-    "functions": [],
-    "interfaces": [
-      {
-        "parentPluginId": "@kbn/generate-csv-types",
-        "id": "def-common.CsvConfig",
-        "type": "Interface",
-        "tags": [],
-        "label": "CsvConfig",
-        "description": [],
-        "path": "packages/kbn-generate-csv-types/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.CsvConfig.checkForFormulas",
-            "type": "boolean",
-            "tags": [],
-            "label": "checkForFormulas",
-            "description": [],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.CsvConfig.escapeFormulaValues",
-            "type": "boolean",
-            "tags": [],
-            "label": "escapeFormulaValues",
-            "description": [],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.CsvConfig.maxSizeBytes",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "maxSizeBytes",
-            "description": [],
-            "signature": [
-              "number | ",
-              {
-                "pluginId": "@kbn/config-schema",
-                "scope": "common",
-                "docId": "kibKbnConfigSchemaPluginApi",
-                "section": "def-common.ByteSizeValue",
-                "text": "ByteSizeValue"
-              }
-            ],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.CsvConfig.useByteOrderMarkEncoding",
-            "type": "boolean",
-            "tags": [],
-            "label": "useByteOrderMarkEncoding",
-            "description": [],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.CsvConfig.scroll",
-            "type": "Object",
-            "tags": [],
-            "label": "scroll",
-            "description": [],
-            "signature": [
-              "{ duration: string; size: number; }"
-            ],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/generate-csv-types",
-        "id": "def-common.JobParams",
-        "type": "Interface",
-        "tags": [],
-        "label": "JobParams",
-        "description": [],
-        "path": "packages/kbn-generate-csv-types/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.JobParams.searchSource",
-            "type": "Object",
-            "tags": [],
-            "label": "searchSource",
-            "description": [],
-            "signature": [
-              "{ type?: string | undefined; query?: ",
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.Query",
-                "text": "Query"
-              },
-              " | ",
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.AggregateQuery",
-                "text": "AggregateQuery"
-              },
-              " | undefined; filter?: ",
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.Filter",
-                "text": "Filter"
-              },
-              "[] | undefined; sort?: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.EsQuerySortValue",
-                "text": "EsQuerySortValue"
-              },
-              "[] | undefined; highlight?: ",
-              {
-                "pluginId": "@kbn/utility-types",
-                "scope": "common",
-                "docId": "kibKbnUtilityTypesPluginApi",
-                "section": "def-common.SerializableRecord",
-                "text": "SerializableRecord"
-              },
-              " | undefined; highlightAll?: boolean | undefined; trackTotalHits?: number | boolean | undefined; aggs?: { type: string; enabled?: boolean | undefined; id?: string | undefined; params?: {} | ",
-              {
-                "pluginId": "@kbn/utility-types",
-                "scope": "common",
-                "docId": "kibKbnUtilityTypesPluginApi",
-                "section": "def-common.SerializableRecord",
-                "text": "SerializableRecord"
-              },
-              " | undefined; schema?: string | undefined; }[] | undefined; from?: number | undefined; size?: number | undefined; source?: boolean | ",
-              "Fields",
-              " | undefined; version?: boolean | undefined; fields?: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SearchFieldValue",
-                "text": "SearchFieldValue"
-              },
-              "[] | undefined; fieldsFromSource?: ",
-              "Fields",
-              " | undefined; index?: string | ",
-              {
-                "pluginId": "dataViews",
-                "scope": "common",
-                "docId": "kibDataViewsPluginApi",
-                "section": "def-common.DataViewSpec",
-                "text": "DataViewSpec"
-              },
-              " | undefined; searchAfter?: ",
-              "SortResults",
-              " | undefined; timeout?: string | undefined; terminate_after?: number | undefined; parent?: ",
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.SerializedSearchSourceFields",
-                "text": "SerializedSearchSourceFields"
-              },
-              " | undefined; }"
-            ],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.JobParams.columns",
-            "type": "Array",
-            "tags": [],
-            "label": "columns",
-            "description": [],
-            "signature": [
-              "string[] | undefined"
-            ],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/generate-csv-types",
-            "id": "def-common.JobParams.browserTimezone",
-            "type": "string",
-            "tags": [],
-            "label": "browserTimezone",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "packages/kbn-generate-csv-types/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
-    "enums": [],
-    "misc": [],
-    "objects": []
-  }
-}
\ No newline at end of file
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index 7ca43517a70581..f67f4d9cfb89e6 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index 4d30fb27efc6f1..68b6bf281411a4 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index c274bb3eb113a3..3e1243046ba4e9 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index ff88c770f0a925..9d521afacf7dda 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 73fec5b9715f90..481cb6766e777a 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index 74724f71aac4a3..62b7c2f31e44ce 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 316a26ab2987b8..eff401f76683f4 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index 152f7990d01f51..4822e06ba5a90b 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index c8d453d363af05..173a7796634d70 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_infra_forge.mdx b/api_docs/kbn_infra_forge.mdx
index c80ba436eedca9..9ca66fdfeeadb5 100644
--- a/api_docs/kbn_infra_forge.mdx
+++ b/api_docs/kbn_infra_forge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-infra-forge
 title: "@kbn/infra-forge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/infra-forge plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/infra-forge']
 ---
 import kbnInfraForgeObj from './kbn_infra_forge.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index f7678f9890fc65..e94ffcf8e7796a 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.devdocs.json b/api_docs/kbn_io_ts_utils.devdocs.json
index 76c85df71d2fbb..80107690e8e286 100644
--- a/api_docs/kbn_io_ts_utils.devdocs.json
+++ b/api_docs/kbn_io_ts_utils.devdocs.json
@@ -773,6 +773,41 @@
           }
         ],
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/io-ts-utils",
+        "id": "def-common.UniqueTimeKey",
+        "type": "Interface",
+        "tags": [],
+        "label": "UniqueTimeKey",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/io-ts-utils",
+            "scope": "common",
+            "docId": "kibKbnIoTsUtilsPluginApi",
+            "section": "def-common.UniqueTimeKey",
+            "text": "UniqueTimeKey"
+          },
+          " extends { time: string; tiebreaker: number; } & { gid?: string | undefined; fromAutoReload?: boolean | undefined; }"
+        ],
+        "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/io-ts-utils",
+            "id": "def-common.UniqueTimeKey.gid",
+            "type": "string",
+            "tags": [],
+            "label": "gid",
+            "description": [],
+            "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
       }
     ],
     "enums": [],
@@ -846,6 +881,21 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/io-ts-utils",
+        "id": "def-common.MinimalTimeKey",
+        "type": "Type",
+        "tags": [],
+        "label": "MinimalTimeKey",
+        "description": [],
+        "signature": [
+          "{ time: string; tiebreaker: number; }"
+        ],
+        "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/io-ts-utils",
         "id": "def-common.NonEmptyString",
@@ -870,9 +920,40 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/io-ts-utils",
+        "id": "def-common.TimeKey",
+        "type": "Type",
+        "tags": [],
+        "label": "TimeKey",
+        "description": [],
+        "signature": [
+          "{ time: string; tiebreaker: number; } & { gid?: string | undefined; fromAutoReload?: boolean | undefined; }"
+        ],
+        "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
       }
     ],
     "objects": [
+      {
+        "parentPluginId": "@kbn/io-ts-utils",
+        "id": "def-common.DateFromStringOrNumber",
+        "type": "Object",
+        "tags": [],
+        "label": "DateFromStringOrNumber",
+        "description": [],
+        "signature": [
+          "Type",
+          "<string, string | number, unknown>"
+        ],
+        "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/io-ts-utils",
         "id": "def-common.datemathStringRt",
@@ -961,6 +1042,26 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/io-ts-utils",
+        "id": "def-common.minimalTimeKeyRT",
+        "type": "Object",
+        "tags": [],
+        "label": "minimalTimeKeyRT",
+        "description": [],
+        "signature": [
+          "TypeC",
+          "<{ time: ",
+          "Type",
+          "<string, string | number, unknown>; tiebreaker: ",
+          "NumberC",
+          "; }>"
+        ],
+        "path": "packages/kbn-io-ts-utils/src/time_key_rt/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/io-ts-utils",
         "id": "def-common.nonEmptyStringRt",
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index 010c1ade34cb48..4255f14ce2116f 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 52 | 0 | 52 | 4 |
+| 58 | 0 | 58 | 4 |
 
 ## Common
 
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index 6f153c672e7eb0..f058d33c6cfe19 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 21be3675a11aab..98094849fd802a 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index ef11a7da0bf968..656670cab4d478 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index 5de6d034f507d0..c2a9ffbf099768 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 45dac881957934..e05ea9131bfdf8 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_lens_embeddable_utils.mdx b/api_docs/kbn_lens_embeddable_utils.mdx
index 2f58d6fea986c1..aa1233ffc36b62 100644
--- a/api_docs/kbn_lens_embeddable_utils.mdx
+++ b/api_docs/kbn_lens_embeddable_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-lens-embeddable-utils
 title: "@kbn/lens-embeddable-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/lens-embeddable-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/lens-embeddable-utils']
 ---
 import kbnLensEmbeddableUtilsObj from './kbn_lens_embeddable_utils.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index d4d5fbe85d7938..bb27e52d7b2449 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index 59f4fb2b93434c..f0706e42dd29c9 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 64dd616d28ddc5..8cbb1448f6f94c 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_management_cards_navigation.mdx b/api_docs/kbn_management_cards_navigation.mdx
index f6a0840ccf9bfb..f509a205739f79 100644
--- a/api_docs/kbn_management_cards_navigation.mdx
+++ b/api_docs/kbn_management_cards_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-cards-navigation
 title: "@kbn/management-cards-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-cards-navigation plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-cards-navigation']
 ---
 import kbnManagementCardsNavigationObj from './kbn_management_cards_navigation.devdocs.json';
diff --git a/api_docs/kbn_management_settings_application.mdx b/api_docs/kbn_management_settings_application.mdx
index 68b3e804e6e356..dff4e250a66585 100644
--- a/api_docs/kbn_management_settings_application.mdx
+++ b/api_docs/kbn_management_settings_application.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-application
 title: "@kbn/management-settings-application"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-application plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-application']
 ---
 import kbnManagementSettingsApplicationObj from './kbn_management_settings_application.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_category.mdx b/api_docs/kbn_management_settings_components_field_category.mdx
index 1e8fb3e17c2b97..0300ff570e0d9e 100644
--- a/api_docs/kbn_management_settings_components_field_category.mdx
+++ b/api_docs/kbn_management_settings_components_field_category.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-category
 title: "@kbn/management-settings-components-field-category"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-category plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-category']
 ---
 import kbnManagementSettingsComponentsFieldCategoryObj from './kbn_management_settings_components_field_category.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_input.mdx b/api_docs/kbn_management_settings_components_field_input.mdx
index f7f0e50d492603..996684cf890a85 100644
--- a/api_docs/kbn_management_settings_components_field_input.mdx
+++ b/api_docs/kbn_management_settings_components_field_input.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-input
 title: "@kbn/management-settings-components-field-input"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-input plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-input']
 ---
 import kbnManagementSettingsComponentsFieldInputObj from './kbn_management_settings_components_field_input.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_row.mdx b/api_docs/kbn_management_settings_components_field_row.mdx
index 634dc16c0ca57e..b7d9c63d46c7ed 100644
--- a/api_docs/kbn_management_settings_components_field_row.mdx
+++ b/api_docs/kbn_management_settings_components_field_row.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-row
 title: "@kbn/management-settings-components-field-row"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-row plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-row']
 ---
 import kbnManagementSettingsComponentsFieldRowObj from './kbn_management_settings_components_field_row.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_form.mdx b/api_docs/kbn_management_settings_components_form.mdx
index f2c8b1117eb524..7b6d4111710ba0 100644
--- a/api_docs/kbn_management_settings_components_form.mdx
+++ b/api_docs/kbn_management_settings_components_form.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-form
 title: "@kbn/management-settings-components-form"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-form plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-form']
 ---
 import kbnManagementSettingsComponentsFormObj from './kbn_management_settings_components_form.devdocs.json';
diff --git a/api_docs/kbn_management_settings_field_definition.mdx b/api_docs/kbn_management_settings_field_definition.mdx
index bbaf9cfa3fd3d8..cd4c29c89a5e16 100644
--- a/api_docs/kbn_management_settings_field_definition.mdx
+++ b/api_docs/kbn_management_settings_field_definition.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-field-definition
 title: "@kbn/management-settings-field-definition"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-field-definition plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-field-definition']
 ---
 import kbnManagementSettingsFieldDefinitionObj from './kbn_management_settings_field_definition.devdocs.json';
diff --git a/api_docs/kbn_management_settings_ids.mdx b/api_docs/kbn_management_settings_ids.mdx
index 4362d975e2b02a..3c40ac2affa6fd 100644
--- a/api_docs/kbn_management_settings_ids.mdx
+++ b/api_docs/kbn_management_settings_ids.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-ids
 title: "@kbn/management-settings-ids"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-ids plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-ids']
 ---
 import kbnManagementSettingsIdsObj from './kbn_management_settings_ids.devdocs.json';
diff --git a/api_docs/kbn_management_settings_section_registry.mdx b/api_docs/kbn_management_settings_section_registry.mdx
index e3c5f1d14528f5..d3b0e6f85de4da 100644
--- a/api_docs/kbn_management_settings_section_registry.mdx
+++ b/api_docs/kbn_management_settings_section_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-section-registry
 title: "@kbn/management-settings-section-registry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-section-registry plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-section-registry']
 ---
 import kbnManagementSettingsSectionRegistryObj from './kbn_management_settings_section_registry.devdocs.json';
diff --git a/api_docs/kbn_management_settings_types.mdx b/api_docs/kbn_management_settings_types.mdx
index 32919445c9ada3..e1707d5e5c4e83 100644
--- a/api_docs/kbn_management_settings_types.mdx
+++ b/api_docs/kbn_management_settings_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-types
 title: "@kbn/management-settings-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-types']
 ---
 import kbnManagementSettingsTypesObj from './kbn_management_settings_types.devdocs.json';
diff --git a/api_docs/kbn_management_settings_utilities.mdx b/api_docs/kbn_management_settings_utilities.mdx
index 18f31e9ba65844..d6c1d9205dfbc6 100644
--- a/api_docs/kbn_management_settings_utilities.mdx
+++ b/api_docs/kbn_management_settings_utilities.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-utilities
 title: "@kbn/management-settings-utilities"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-utilities plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-utilities']
 ---
 import kbnManagementSettingsUtilitiesObj from './kbn_management_settings_utilities.devdocs.json';
diff --git a/api_docs/kbn_management_storybook_config.mdx b/api_docs/kbn_management_storybook_config.mdx
index be0b3dc7d5831b..88eef8bd37464f 100644
--- a/api_docs/kbn_management_storybook_config.mdx
+++ b/api_docs/kbn_management_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-storybook-config
 title: "@kbn/management-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-storybook-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-storybook-config']
 ---
 import kbnManagementStorybookConfigObj from './kbn_management_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index dc43329b36e4d9..36922e69254533 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_maps_vector_tile_utils.mdx b/api_docs/kbn_maps_vector_tile_utils.mdx
index 2393fa9c52e42f..c39dc03e509a3c 100644
--- a/api_docs/kbn_maps_vector_tile_utils.mdx
+++ b/api_docs/kbn_maps_vector_tile_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-maps-vector-tile-utils
 title: "@kbn/maps-vector-tile-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/maps-vector-tile-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/maps-vector-tile-utils']
 ---
 import kbnMapsVectorTileUtilsObj from './kbn_maps_vector_tile_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.devdocs.json b/api_docs/kbn_ml_agg_utils.devdocs.json
index 950d7c821d368c..27c02edf9fc006 100644
--- a/api_docs/kbn_ml_agg_utils.devdocs.json
+++ b/api_docs/kbn_ml_agg_utils.devdocs.json
@@ -698,12 +698,12 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.isSignificantTerm",
+        "id": "def-common.isSignificantItem",
         "type": "Function",
         "tags": [],
-        "label": "isSignificantTerm",
+        "label": "isSignificantItem",
         "description": [
-          "\nType guard for a significant term.\nNote this is used as a custom type within Log Rate Analysis\nfor a p-value based variant, not a generic significant terms\naggregation type."
+          "\nType guard for a significant item.\nNote this is used as a custom type within Log Rate Analysis\nfor a p-value based variant, not a generic significant terms\naggregation type."
         ],
         "signature": [
           "(arg: unknown) => boolean"
@@ -714,7 +714,7 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.isSignificantTerm.$1",
+            "id": "def-common.isSignificantItem.$1",
             "type": "Unknown",
             "tags": [],
             "label": "arg",
@@ -731,7 +731,7 @@
           }
         ],
         "returnComment": [
-          "whether arg is of type SignificantTerm"
+          "whether arg is of type SignificantItem"
         ],
         "initialIsOpen": false
       },
@@ -1191,23 +1191,23 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTerm",
+        "id": "def-common.SignificantItem",
         "type": "Interface",
         "tags": [
           "interface",
           "extends"
         ],
-        "label": "SignificantTerm",
+        "label": "SignificantItem",
         "description": [
-          "\nRepresents significant term metadata for a field/value pair.\nThis interface is used as a custom type within Log Rate Analysis\nfor a p-value based variant, not related to the generic\nsignificant terms aggregation type.\n"
+          "\nRepresents significant item metadata for a field/value pair.\nThis interface is used as a custom type within Log Rate Analysis\nfor a p-value based variant, not related to the generic\nsignificant terms aggregation type.\n"
         ],
         "signature": [
           {
             "pluginId": "@kbn/ml-agg-utils",
             "scope": "common",
             "docId": "kibKbnMlAggUtilsPluginApi",
-            "section": "def-common.SignificantTerm",
-            "text": "SignificantTerm"
+            "section": "def-common.SignificantItem",
+            "text": "SignificantItem"
           },
           " extends ",
           {
@@ -1224,12 +1224,12 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.key",
+            "id": "def-common.SignificantItem.key",
             "type": "string",
             "tags": [],
             "label": "key",
             "description": [
-              "The key associated with the significant term."
+              "The key associated with the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1237,12 +1237,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.type",
+            "id": "def-common.SignificantItem.type",
             "type": "CompoundType",
             "tags": [],
             "label": "type",
             "description": [
-              "The type of the significant term."
+              "The type of the significant item."
             ],
             "signature": [
               "\"keyword\" | \"log_pattern\""
@@ -1253,12 +1253,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.doc_count",
+            "id": "def-common.SignificantItem.doc_count",
             "type": "number",
             "tags": [],
             "label": "doc_count",
             "description": [
-              "The document count for the significant term."
+              "The document count for the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1266,12 +1266,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.bg_count",
+            "id": "def-common.SignificantItem.bg_count",
             "type": "number",
             "tags": [],
             "label": "bg_count",
             "description": [
-              "The background count for the significant term."
+              "The background count for the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1279,12 +1279,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.total_doc_count",
+            "id": "def-common.SignificantItem.total_doc_count",
             "type": "number",
             "tags": [],
             "label": "total_doc_count",
             "description": [
-              "The total document count for all terms."
+              "The total document count for all items."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1292,12 +1292,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.total_bg_count",
+            "id": "def-common.SignificantItem.total_bg_count",
             "type": "number",
             "tags": [],
             "label": "total_bg_count",
             "description": [
-              "The total background count for all terms."
+              "The total background count for all items."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1305,12 +1305,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.score",
+            "id": "def-common.SignificantItem.score",
             "type": "number",
             "tags": [],
             "label": "score",
             "description": [
-              "The score associated with the significant term."
+              "The score associated with the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1318,12 +1318,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.pValue",
+            "id": "def-common.SignificantItem.pValue",
             "type": "CompoundType",
             "tags": [],
             "label": "pValue",
             "description": [
-              "The p-value for the significant term, or null if not available."
+              "The p-value for the significant item, or null if not available."
             ],
             "signature": [
               "number | null"
@@ -1334,12 +1334,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.normalizedScore",
+            "id": "def-common.SignificantItem.normalizedScore",
             "type": "number",
             "tags": [],
             "label": "normalizedScore",
             "description": [
-              "The normalized score for the significant term."
+              "The normalized score for the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1347,20 +1347,20 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.histogram",
+            "id": "def-common.SignificantItem.histogram",
             "type": "Array",
             "tags": [],
             "label": "histogram",
             "description": [
-              "An optional histogram of significant term items."
+              "An optional histogram for the significant item."
             ],
             "signature": [
               {
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermHistogramItem",
-                "text": "SignificantTermHistogramItem"
+                "section": "def-common.SignificantItemHistogramItem",
+                "text": "SignificantItemHistogramItem"
               },
               "[] | undefined"
             ],
@@ -1370,12 +1370,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTerm.unique",
+            "id": "def-common.SignificantItem.unique",
             "type": "CompoundType",
             "tags": [],
             "label": "unique",
             "description": [
-              "Indicates if the significant term is unique within a group."
+              "Indicates if the significant item is unique within a group."
             ],
             "signature": [
               "boolean | undefined"
@@ -1389,14 +1389,14 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermGroup",
+        "id": "def-common.SignificantItemGroup",
         "type": "Interface",
         "tags": [
           "interface"
         ],
-        "label": "SignificantTermGroup",
+        "label": "SignificantItemGroup",
         "description": [
-          "\nRepresents a significant term group."
+          "\nRepresents a significant item group."
         ],
         "path": "x-pack/packages/ml/agg_utils/src/types.ts",
         "deprecated": false,
@@ -1404,7 +1404,7 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroup.id",
+            "id": "def-common.SignificantItemGroup.id",
             "type": "string",
             "tags": [],
             "label": "id",
@@ -1417,20 +1417,20 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroup.group",
+            "id": "def-common.SignificantItemGroup.group",
             "type": "Array",
             "tags": [],
             "label": "group",
             "description": [
-              "An array of significant term group items."
+              "An array of significant item group items."
             ],
             "signature": [
               {
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermGroupItem",
-                "text": "SignificantTermGroupItem"
+                "section": "def-common.SignificantItemGroupItem",
+                "text": "SignificantItemGroupItem"
               },
               "[]"
             ],
@@ -1440,7 +1440,7 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroup.docCount",
+            "id": "def-common.SignificantItemGroup.docCount",
             "type": "number",
             "tags": [],
             "label": "docCount",
@@ -1453,7 +1453,7 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroup.pValue",
+            "id": "def-common.SignificantItemGroup.pValue",
             "type": "CompoundType",
             "tags": [],
             "label": "pValue",
@@ -1469,20 +1469,20 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroup.histogram",
+            "id": "def-common.SignificantItemGroup.histogram",
             "type": "Array",
             "tags": [],
             "label": "histogram",
             "description": [
-              "An optional array of significant term histogram items."
+              "An optional array of significant item histogram items."
             ],
             "signature": [
               {
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermHistogramItem",
-                "text": "SignificantTermHistogramItem"
+                "section": "def-common.SignificantItemHistogramItem",
+                "text": "SignificantItemHistogramItem"
               },
               "[] | undefined"
             ],
@@ -1495,12 +1495,12 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermGroupHistogram",
+        "id": "def-common.SignificantItemGroupHistogram",
         "type": "Interface",
         "tags": [
           "interface"
         ],
-        "label": "SignificantTermGroupHistogram",
+        "label": "SignificantItemGroupHistogram",
         "description": [
           "\nRepresents histogram data for a group of field/value pairs."
         ],
@@ -1510,7 +1510,7 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupHistogram.id",
+            "id": "def-common.SignificantItemGroupHistogram.id",
             "type": "string",
             "tags": [],
             "label": "id",
@@ -1523,20 +1523,20 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupHistogram.histogram",
+            "id": "def-common.SignificantItemGroupHistogram.histogram",
             "type": "Array",
             "tags": [],
             "label": "histogram",
             "description": [
-              "An array of significant term histogram items."
+              "An array of significant item histogram items."
             ],
             "signature": [
               {
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermHistogramItem",
-                "text": "SignificantTermHistogramItem"
+                "section": "def-common.SignificantItemHistogramItem",
+                "text": "SignificantItemHistogramItem"
               },
               "[]"
             ],
@@ -1549,22 +1549,22 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermGroupItem",
+        "id": "def-common.SignificantItemGroupItem",
         "type": "Interface",
         "tags": [
           "interface"
         ],
-        "label": "SignificantTermGroupItem",
+        "label": "SignificantItemGroupItem",
         "description": [
-          "\nRepresents an item in a significant term group."
+          "\nRepresents an item in a significant item group."
         ],
         "signature": [
           {
             "pluginId": "@kbn/ml-agg-utils",
             "scope": "common",
             "docId": "kibKbnMlAggUtilsPluginApi",
-            "section": "def-common.SignificantTermGroupItem",
-            "text": "SignificantTermGroupItem"
+            "section": "def-common.SignificantItemGroupItem",
+            "text": "SignificantItemGroupItem"
           },
           " extends ",
           {
@@ -1581,12 +1581,12 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupItem.key",
+            "id": "def-common.SignificantItemGroupItem.key",
             "type": "string",
             "tags": [],
             "label": "key",
             "description": [
-              "The key associated with the significant term."
+              "The key associated with the significant item."
             ],
             "path": "x-pack/packages/ml/agg_utils/src/types.ts",
             "deprecated": false,
@@ -1594,12 +1594,12 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupItem.type",
+            "id": "def-common.SignificantItemGroupItem.type",
             "type": "CompoundType",
             "tags": [],
             "label": "type",
             "description": [
-              "The type of the significant term."
+              "The type of the significant item."
             ],
             "signature": [
               "\"keyword\" | \"log_pattern\""
@@ -1610,7 +1610,7 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupItem.docCount",
+            "id": "def-common.SignificantItemGroupItem.docCount",
             "type": "number",
             "tags": [],
             "label": "docCount",
@@ -1623,7 +1623,7 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupItem.pValue",
+            "id": "def-common.SignificantItemGroupItem.pValue",
             "type": "CompoundType",
             "tags": [],
             "label": "pValue",
@@ -1639,7 +1639,7 @@
           },
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermGroupItem.duplicate",
+            "id": "def-common.SignificantItemGroupItem.duplicate",
             "type": "number",
             "tags": [],
             "label": "duplicate",
@@ -1658,12 +1658,12 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermHistogram",
+        "id": "def-common.SignificantItemHistogram",
         "type": "Interface",
         "tags": [
           "interface"
         ],
-        "label": "SignificantTermHistogram",
+        "label": "SignificantItemHistogram",
         "description": [
           "\nRepresents histogram data for a field/value pair."
         ],
@@ -1672,8 +1672,8 @@
             "pluginId": "@kbn/ml-agg-utils",
             "scope": "common",
             "docId": "kibKbnMlAggUtilsPluginApi",
-            "section": "def-common.SignificantTermHistogram",
-            "text": "SignificantTermHistogram"
+            "section": "def-common.SignificantItemHistogram",
+            "text": "SignificantItemHistogram"
           },
           " extends ",
           {
@@ -1690,20 +1690,20 @@
         "children": [
           {
             "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermHistogram.histogram",
+            "id": "def-common.SignificantItemHistogram.histogram",
             "type": "Array",
             "tags": [],
             "label": "histogram",
             "description": [
-              "An array of significant term histogram items."
+              "An array of significant item histogram items."
             ],
             "signature": [
               {
                 "pluginId": "@kbn/ml-agg-utils",
                 "scope": "common",
                 "docId": "kibKbnMlAggUtilsPluginApi",
-                "section": "def-common.SignificantTermHistogramItem",
-                "text": "SignificantTermHistogramItem"
+                "section": "def-common.SignificantItemHistogramItem",
+                "text": "SignificantItemHistogramItem"
               },
               "[]"
             ],
@@ -1713,76 +1713,6 @@
           }
         ],
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermHistogramItem",
-        "type": "Interface",
-        "tags": [
-          "interface"
-        ],
-        "label": "SignificantTermHistogramItem",
-        "description": [
-          "\nRepresents a data item in a significant term histogram."
-        ],
-        "path": "x-pack/packages/ml/agg_utils/src/types.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermHistogramItem.doc_count_overall",
-            "type": "number",
-            "tags": [],
-            "label": "doc_count_overall",
-            "description": [
-              "The document count for this item in the overall context."
-            ],
-            "path": "x-pack/packages/ml/agg_utils/src/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermHistogramItem.doc_count_significant_term",
-            "type": "number",
-            "tags": [],
-            "label": "doc_count_significant_term",
-            "description": [
-              "The document count for this item in the significant term context."
-            ],
-            "path": "x-pack/packages/ml/agg_utils/src/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermHistogramItem.key",
-            "type": "number",
-            "tags": [],
-            "label": "key",
-            "description": [
-              "The numeric key associated with this item."
-            ],
-            "path": "x-pack/packages/ml/agg_utils/src/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/ml-agg-utils",
-            "id": "def-common.SignificantTermHistogramItem.key_as_string",
-            "type": "string",
-            "tags": [],
-            "label": "key_as_string",
-            "description": [
-              "The string representation of the key."
-            ],
-            "path": "x-pack/packages/ml/agg_utils/src/types.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
       }
     ],
     "enums": [
@@ -1871,12 +1801,29 @@
       },
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SignificantTermType",
+        "id": "def-common.SignificantItemHistogramItem",
+        "type": "Type",
+        "tags": [],
+        "label": "SignificantItemHistogramItem",
+        "description": [
+          "\nRepresents a data item in a significant term histogram."
+        ],
+        "signature": [
+          "SignificantItemHistogramItemV1 | SignificantItemHistogramItemV2"
+        ],
+        "path": "x-pack/packages/ml/agg_utils/src/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/ml-agg-utils",
+        "id": "def-common.SignificantItemType",
         "type": "Type",
         "tags": [],
-        "label": "SignificantTermType",
+        "label": "SignificantItemType",
         "description": [
-          "\nRepresents the type of significant term as determined by the SIGNIFICANT_TERM_TYPE enumeration."
+          "\nRepresents the type of significant item as determined by the SIGNIFICANT_ITEM_TYPE enumeration."
         ],
         "signature": [
           "\"keyword\" | \"log_pattern\""
@@ -1890,12 +1837,12 @@
     "objects": [
       {
         "parentPluginId": "@kbn/ml-agg-utils",
-        "id": "def-common.SIGNIFICANT_TERM_TYPE",
+        "id": "def-common.SIGNIFICANT_ITEM_TYPE",
         "type": "Object",
         "tags": [],
-        "label": "SIGNIFICANT_TERM_TYPE",
+        "label": "SIGNIFICANT_ITEM_TYPE",
         "description": [
-          "\nEnumeration of significant term types."
+          "\nEnumeration of significant item types."
         ],
         "signature": [
           "{ readonly KEYWORD: \"keyword\"; readonly LOG_PATTERN: \"log_pattern\"; }"
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index bd992efab920d7..a69c8cd6b562fb 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) for questi
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 99 | 2 | 0 | 0 |
+| 95 | 2 | 0 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_ml_anomaly_utils.mdx b/api_docs/kbn_ml_anomaly_utils.mdx
index 55f2e0a8ec191d..e779cc10839915 100644
--- a/api_docs/kbn_ml_anomaly_utils.mdx
+++ b/api_docs/kbn_ml_anomaly_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-anomaly-utils
 title: "@kbn/ml-anomaly-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-anomaly-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-anomaly-utils']
 ---
 import kbnMlAnomalyUtilsObj from './kbn_ml_anomaly_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_category_validator.mdx b/api_docs/kbn_ml_category_validator.mdx
index a8d1ad72fc6159..ed4d9fefe747d4 100644
--- a/api_docs/kbn_ml_category_validator.mdx
+++ b/api_docs/kbn_ml_category_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-category-validator
 title: "@kbn/ml-category-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-category-validator plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-category-validator']
 ---
 import kbnMlCategoryValidatorObj from './kbn_ml_category_validator.devdocs.json';
diff --git a/api_docs/kbn_ml_chi2test.mdx b/api_docs/kbn_ml_chi2test.mdx
index a44266c0f9a626..f160234bd3f7b0 100644
--- a/api_docs/kbn_ml_chi2test.mdx
+++ b/api_docs/kbn_ml_chi2test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-chi2test
 title: "@kbn/ml-chi2test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-chi2test plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-chi2test']
 ---
 import kbnMlChi2testObj from './kbn_ml_chi2test.devdocs.json';
diff --git a/api_docs/kbn_ml_data_frame_analytics_utils.mdx b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
index 1b24bb55f21a18..5a0f3fdffe9505 100644
--- a/api_docs/kbn_ml_data_frame_analytics_utils.mdx
+++ b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-frame-analytics-utils
 title: "@kbn/ml-data-frame-analytics-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-frame-analytics-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-frame-analytics-utils']
 ---
 import kbnMlDataFrameAnalyticsUtilsObj from './kbn_ml_data_frame_analytics_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_data_grid.mdx b/api_docs/kbn_ml_data_grid.mdx
index 676f7d5cf674e2..e0ca15fc4d7511 100644
--- a/api_docs/kbn_ml_data_grid.mdx
+++ b/api_docs/kbn_ml_data_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-grid
 title: "@kbn/ml-data-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-grid plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-grid']
 ---
 import kbnMlDataGridObj from './kbn_ml_data_grid.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index a335e71c63b845..fa09cdc394da96 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
diff --git a/api_docs/kbn_ml_date_utils.mdx b/api_docs/kbn_ml_date_utils.mdx
index 3aaa696572ec09..cc6eb09ac8d3ef 100644
--- a/api_docs/kbn_ml_date_utils.mdx
+++ b/api_docs/kbn_ml_date_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-utils
 title: "@kbn/ml-date-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-utils']
 ---
 import kbnMlDateUtilsObj from './kbn_ml_date_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_error_utils.mdx b/api_docs/kbn_ml_error_utils.mdx
index c591337628e1ed..abb315ecc6a99e 100644
--- a/api_docs/kbn_ml_error_utils.mdx
+++ b/api_docs/kbn_ml_error_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-error-utils
 title: "@kbn/ml-error-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-error-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-error-utils']
 ---
 import kbnMlErrorUtilsObj from './kbn_ml_error_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_in_memory_table.mdx b/api_docs/kbn_ml_in_memory_table.mdx
index 541335f302c89d..16e23cfc25c487 100644
--- a/api_docs/kbn_ml_in_memory_table.mdx
+++ b/api_docs/kbn_ml_in_memory_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-in-memory-table
 title: "@kbn/ml-in-memory-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-in-memory-table plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-in-memory-table']
 ---
 import kbnMlInMemoryTableObj from './kbn_ml_in_memory_table.devdocs.json';
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index d52bbbf3cfc6d1..9bd7dd87854a7d 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index 3a2a11db262c27..8d467f203c2bf0 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_kibana_theme.mdx b/api_docs/kbn_ml_kibana_theme.mdx
index 70ebaf2191303b..0f87482f4ae3d2 100644
--- a/api_docs/kbn_ml_kibana_theme.mdx
+++ b/api_docs/kbn_ml_kibana_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-kibana-theme
 title: "@kbn/ml-kibana-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-kibana-theme plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-kibana-theme']
 ---
 import kbnMlKibanaThemeObj from './kbn_ml_kibana_theme.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 16b14fc2224ec6..c22ed444a38466 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index a7229680877cec..0b2a5c31fae69b 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_number_utils.mdx b/api_docs/kbn_ml_number_utils.mdx
index bac5531a272e42..0867d6b273f7ad 100644
--- a/api_docs/kbn_ml_number_utils.mdx
+++ b/api_docs/kbn_ml_number_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-number-utils
 title: "@kbn/ml-number-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-number-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-number-utils']
 ---
 import kbnMlNumberUtilsObj from './kbn_ml_number_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index 023a1b30198f17..de86a37513a8c0 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_random_sampler_utils.mdx b/api_docs/kbn_ml_random_sampler_utils.mdx
index 2d5dac3d224775..2aea55e5a1e646 100644
--- a/api_docs/kbn_ml_random_sampler_utils.mdx
+++ b/api_docs/kbn_ml_random_sampler_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-random-sampler-utils
 title: "@kbn/ml-random-sampler-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-random-sampler-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-random-sampler-utils']
 ---
 import kbnMlRandomSamplerUtilsObj from './kbn_ml_random_sampler_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_route_utils.mdx b/api_docs/kbn_ml_route_utils.mdx
index ab284617e97364..0b2babc59f2070 100644
--- a/api_docs/kbn_ml_route_utils.mdx
+++ b/api_docs/kbn_ml_route_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-route-utils
 title: "@kbn/ml-route-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-route-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-route-utils']
 ---
 import kbnMlRouteUtilsObj from './kbn_ml_route_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_runtime_field_utils.mdx b/api_docs/kbn_ml_runtime_field_utils.mdx
index ca8be667ad077d..1a286951d58643 100644
--- a/api_docs/kbn_ml_runtime_field_utils.mdx
+++ b/api_docs/kbn_ml_runtime_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-runtime-field-utils
 title: "@kbn/ml-runtime-field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-runtime-field-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-runtime-field-utils']
 ---
 import kbnMlRuntimeFieldUtilsObj from './kbn_ml_runtime_field_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index e9aa70d1342981..0459040752e4d9 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_trained_models_utils.mdx b/api_docs/kbn_ml_trained_models_utils.mdx
index dcc416aefcd296..0a09588940bd31 100644
--- a/api_docs/kbn_ml_trained_models_utils.mdx
+++ b/api_docs/kbn_ml_trained_models_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-trained-models-utils
 title: "@kbn/ml-trained-models-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-trained-models-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-trained-models-utils']
 ---
 import kbnMlTrainedModelsUtilsObj from './kbn_ml_trained_models_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index d9326f42d3ab31..17b5193dbc83e0 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_monaco.devdocs.json b/api_docs/kbn_monaco.devdocs.json
index c7d87a27c08726..f15a94ffd55414 100644
--- a/api_docs/kbn_monaco.devdocs.json
+++ b/api_docs/kbn_monaco.devdocs.json
@@ -630,7 +630,7 @@
             "label": "kind",
             "description": [],
             "signature": [
-              "\"type\" | \"keyword\" | \"property\" | \"field\" | \"method\" | \"class\" | \"constructor\""
+              "\"type\" | \"keyword\" | \"property\" | \"field\" | \"class\" | \"method\" | \"constructor\""
             ],
             "path": "packages/kbn-monaco/src/painless/types.ts",
             "deprecated": false,
@@ -798,7 +798,7 @@
         "label": "PainlessCompletionKind",
         "description": [],
         "signature": [
-          "\"type\" | \"keyword\" | \"property\" | \"field\" | \"method\" | \"class\" | \"constructor\""
+          "\"type\" | \"keyword\" | \"property\" | \"field\" | \"class\" | \"method\" | \"constructor\""
         ],
         "path": "packages/kbn-monaco/src/painless/types.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index 50bb7fd91029ff..f8ef704a8ff1f2 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_object_versioning.mdx b/api_docs/kbn_object_versioning.mdx
index adff97b496ef41..56e5bbb6482f89 100644
--- a/api_docs/kbn_object_versioning.mdx
+++ b/api_docs/kbn_object_versioning.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-object-versioning
 title: "@kbn/object-versioning"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/object-versioning plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/object-versioning']
 ---
 import kbnObjectVersioningObj from './kbn_object_versioning.devdocs.json';
diff --git a/api_docs/kbn_observability_alert_details.mdx b/api_docs/kbn_observability_alert_details.mdx
index 8be4d3ec13e90b..ccda394924ffc2 100644
--- a/api_docs/kbn_observability_alert_details.mdx
+++ b/api_docs/kbn_observability_alert_details.mdx
@@ -8,14 +8,14 @@ slug: /kibana-dev-docs/api/kbn-observability-alert-details
 title: "@kbn/observability-alert-details"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-alert-details plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-alert-details']
 ---
 import kbnObservabilityAlertDetailsObj from './kbn_observability_alert_details.devdocs.json';
 
 
 
-Contact [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) for questions regarding this plugin.
+Contact [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) for questions regarding this plugin.
 
 **Code health stats**
 
diff --git a/api_docs/kbn_observability_alerting_test_data.devdocs.json b/api_docs/kbn_observability_alerting_test_data.devdocs.json
index 71f9df827784d0..96da803aa4b606 100644
--- a/api_docs/kbn_observability_alerting_test_data.devdocs.json
+++ b/api_docs/kbn_observability_alerting_test_data.devdocs.json
@@ -434,9 +434,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; filter: string; aggType: ",
                       "Aggregators",
@@ -599,9 +597,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; filter: string; aggType: ",
                       "Aggregators",
@@ -778,9 +774,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; filter: string; aggType: ",
                       "Aggregators",
@@ -943,9 +937,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; field: string; aggType: ",
                       "Aggregators",
@@ -1108,9 +1100,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; field: string; aggType: ",
                       "Aggregators",
@@ -1287,9 +1277,7 @@
                     "label": "criteria",
                     "description": [],
                     "signature": [
-                      "{ aggType: ",
-                      "Aggregators",
-                      "; comparator: ",
+                      "{ aggType: string; comparator: ",
                       "Comparator",
                       "; threshold: number[]; timeSize: number; timeUnit: string; metrics: { name: string; field: string; aggType: ",
                       "Aggregators",
diff --git a/api_docs/kbn_observability_alerting_test_data.mdx b/api_docs/kbn_observability_alerting_test_data.mdx
index 4f4dcef65b1b04..596f990e31fa81 100644
--- a/api_docs/kbn_observability_alerting_test_data.mdx
+++ b/api_docs/kbn_observability_alerting_test_data.mdx
@@ -8,14 +8,14 @@ slug: /kibana-dev-docs/api/kbn-observability-alerting-test-data
 title: "@kbn/observability-alerting-test-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-alerting-test-data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-alerting-test-data']
 ---
 import kbnObservabilityAlertingTestDataObj from './kbn_observability_alerting_test_data.devdocs.json';
 
 
 
-Contact [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) for questions regarding this plugin.
+Contact [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) for questions regarding this plugin.
 
 **Code health stats**
 
diff --git a/api_docs/kbn_openapi_generator.mdx b/api_docs/kbn_openapi_generator.mdx
index 1fb54e33a05442..a38da4be530486 100644
--- a/api_docs/kbn_openapi_generator.mdx
+++ b/api_docs/kbn_openapi_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-openapi-generator
 title: "@kbn/openapi-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/openapi-generator plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/openapi-generator']
 ---
 import kbnOpenapiGeneratorObj from './kbn_openapi_generator.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index fb50d3d5303468..9f6322c9f087b8 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index 2de86998a5a02d..7763f9b79e4ee8 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.devdocs.json b/api_docs/kbn_osquery_io_ts_types.devdocs.json
index 65501b5031659c..4fd8870da6eaf9 100644
--- a/api_docs/kbn_osquery_io_ts_types.devdocs.json
+++ b/api_docs/kbn_osquery_io_ts_types.devdocs.json
@@ -457,6 +457,36 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/osquery-io-ts-types",
+        "id": "def-common.Timeout",
+        "type": "Type",
+        "tags": [],
+        "label": "Timeout",
+        "description": [],
+        "signature": [
+          "number"
+        ],
+        "path": "packages/kbn-osquery-io-ts-types/src/live_query/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/osquery-io-ts-types",
+        "id": "def-common.TimeoutOrUndefined",
+        "type": "Type",
+        "tags": [],
+        "label": "TimeoutOrUndefined",
+        "description": [],
+        "signature": [
+          "number | undefined"
+        ],
+        "path": "packages/kbn-osquery-io-ts-types/src/live_query/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/osquery-io-ts-types",
         "id": "def-common.Version",
@@ -1352,6 +1382,42 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/osquery-io-ts-types",
+        "id": "def-common.timeout",
+        "type": "Object",
+        "tags": [],
+        "label": "timeout",
+        "description": [],
+        "signature": [
+          "Type",
+          "<number, number, unknown>"
+        ],
+        "path": "packages/kbn-osquery-io-ts-types/src/live_query/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/osquery-io-ts-types",
+        "id": "def-common.timeoutOrUndefined",
+        "type": "Object",
+        "tags": [],
+        "label": "timeoutOrUndefined",
+        "description": [],
+        "signature": [
+          "UnionC",
+          "<[",
+          "Type",
+          "<number, number, unknown>, ",
+          "UndefinedC",
+          "]>"
+        ],
+        "path": "packages/kbn-osquery-io-ts-types/src/live_query/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/osquery-io-ts-types",
         "id": "def-common.version",
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index be21d9b5803635..df617bbac03d2e 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/security-asset-management](https://github.com/orgs/elastic/tea
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 62 | 0 | 62 | 0 |
+| 66 | 0 | 66 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index 31b082132154b2..4556ae39a65e4c 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index a0adee613bde5e..14421a7c806271 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index 3e310269ff7a56..ec8306b1fd8377 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_profiling_utils.mdx b/api_docs/kbn_profiling_utils.mdx
index 7909bb48bfb9ce..86badc0e585ec9 100644
--- a/api_docs/kbn_profiling_utils.mdx
+++ b/api_docs/kbn_profiling_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-profiling-utils
 title: "@kbn/profiling-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/profiling-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/profiling-utils']
 ---
 import kbnProfilingUtilsObj from './kbn_profiling_utils.devdocs.json';
diff --git a/api_docs/kbn_random_sampling.mdx b/api_docs/kbn_random_sampling.mdx
index 13b5ef7fe02b31..67a8c86aaf8b17 100644
--- a/api_docs/kbn_random_sampling.mdx
+++ b/api_docs/kbn_random_sampling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-random-sampling
 title: "@kbn/random-sampling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/random-sampling plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/random-sampling']
 ---
 import kbnRandomSamplingObj from './kbn_random_sampling.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index f3a6766d9463c1..2575b407c76e29 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_common.mdx b/api_docs/kbn_react_kibana_context_common.mdx
index 37a673eae009e0..b0afe199e9ad2b 100644
--- a/api_docs/kbn_react_kibana_context_common.mdx
+++ b/api_docs/kbn_react_kibana_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-common
 title: "@kbn/react-kibana-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-common']
 ---
 import kbnReactKibanaContextCommonObj from './kbn_react_kibana_context_common.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_render.mdx b/api_docs/kbn_react_kibana_context_render.mdx
index 8ad0ff5e2160dd..36e77747123b65 100644
--- a/api_docs/kbn_react_kibana_context_render.mdx
+++ b/api_docs/kbn_react_kibana_context_render.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-render
 title: "@kbn/react-kibana-context-render"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-render plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-render']
 ---
 import kbnReactKibanaContextRenderObj from './kbn_react_kibana_context_render.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_root.mdx b/api_docs/kbn_react_kibana_context_root.mdx
index f10e288cb222dc..a87316950a556f 100644
--- a/api_docs/kbn_react_kibana_context_root.mdx
+++ b/api_docs/kbn_react_kibana_context_root.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-root
 title: "@kbn/react-kibana-context-root"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-root plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-root']
 ---
 import kbnReactKibanaContextRootObj from './kbn_react_kibana_context_root.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_styled.mdx b/api_docs/kbn_react_kibana_context_styled.mdx
index 73705ad455a5cf..172ff21e7a5171 100644
--- a/api_docs/kbn_react_kibana_context_styled.mdx
+++ b/api_docs/kbn_react_kibana_context_styled.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-styled
 title: "@kbn/react-kibana-context-styled"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-styled plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-styled']
 ---
 import kbnReactKibanaContextStyledObj from './kbn_react_kibana_context_styled.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_theme.mdx b/api_docs/kbn_react_kibana_context_theme.mdx
index 5a1e5cf59dfb8f..b0eb24de31908f 100644
--- a/api_docs/kbn_react_kibana_context_theme.mdx
+++ b/api_docs/kbn_react_kibana_context_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-theme
 title: "@kbn/react-kibana-context-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-theme plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-theme']
 ---
 import kbnReactKibanaContextThemeObj from './kbn_react_kibana_context_theme.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_mount.mdx b/api_docs/kbn_react_kibana_mount.mdx
index 6672d274d7393f..b72b1e56e37a17 100644
--- a/api_docs/kbn_react_kibana_mount.mdx
+++ b/api_docs/kbn_react_kibana_mount.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-mount
 title: "@kbn/react-kibana-mount"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-mount plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-mount']
 ---
 import kbnReactKibanaMountObj from './kbn_react_kibana_mount.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index 0d340875a75f89..dc8ae220028e19 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index 8856e455244044..b70dc4ee827a9c 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index 67879dd6e0765e..bc0a310b96c7f6 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index ce39596ea601c6..04502f0b603d5d 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_reporting_common.devdocs.json b/api_docs/kbn_reporting_common.devdocs.json
index bb90486c2546ca..68cf96719cd617 100644
--- a/api_docs/kbn_reporting_common.devdocs.json
+++ b/api_docs/kbn_reporting_common.devdocs.json
@@ -892,6 +892,39 @@
       }
     ],
     "functions": [
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.buildKibanaPath",
+        "type": "Function",
+        "tags": [],
+        "label": "buildKibanaPath",
+        "description": [],
+        "signature": [
+          "({ basePath, appPath, spaceId }: Args) => string"
+        ],
+        "path": "packages/kbn-reporting/common/build_kibana_path.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-common",
+            "id": "def-common.buildKibanaPath.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "{ basePath, appPath, spaceId }",
+            "description": [],
+            "signature": [
+              "Args"
+            ],
+            "path": "packages/kbn-reporting/common/build_kibana_path.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/reporting-common",
         "id": "def-common.byteSizeValueToNumber",
@@ -973,6 +1006,25 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.getRedirectAppPath",
+        "type": "Function",
+        "tags": [],
+        "label": "getRedirectAppPath",
+        "description": [
+          "\nA way to get the client side route for the reporting redirect app.\n\nTODO: Add a job ID and a locator to use so that we can redirect without expecting state to\nbe injected to the page"
+        ],
+        "signature": [
+          "() => string"
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/reporting-common",
         "id": "def-common.numberToDuration",
@@ -1008,31 +1060,6 @@
       }
     ],
     "interfaces": [
-      {
-        "parentPluginId": "@kbn/reporting-common",
-        "id": "def-common.CsvMetrics",
-        "type": "Interface",
-        "tags": [],
-        "label": "CsvMetrics",
-        "description": [],
-        "path": "packages/kbn-reporting/common/metrics.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.CsvMetrics.rows",
-            "type": "number",
-            "tags": [],
-            "label": "rows",
-            "description": [],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/reporting-common",
         "id": "def-common.ReportingError",
@@ -1064,191 +1091,257 @@
           }
         ],
         "initialIsOpen": false
+      }
+    ],
+    "enums": [
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.JOB_STATUS",
+        "type": "Enum",
+        "tags": [],
+        "label": "JOB_STATUS",
+        "description": [],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.ALLOWED_JOB_CONTENT_TYPES",
+        "type": "Array",
+        "tags": [],
+        "label": "ALLOWED_JOB_CONTENT_TYPES",
+        "description": [],
+        "signature": [
+          "string[]"
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
       },
       {
         "parentPluginId": "@kbn/reporting-common",
-        "id": "def-common.TaskRunMetrics",
-        "type": "Interface",
+        "id": "def-common.API_USAGE_COUNTER_TYPE",
+        "type": "string",
         "tags": [],
-        "label": "TaskRunMetrics",
+        "label": "API_USAGE_COUNTER_TYPE",
         "description": [],
-        "path": "packages/kbn-reporting/common/metrics.ts",
+        "signature": [
+          "\"reportingApi\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
         "deprecated": false,
         "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunMetrics.csv",
-            "type": "Object",
-            "tags": [],
-            "label": "csv",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "@kbn/reporting-common",
-                "scope": "common",
-                "docId": "kibKbnReportingCommonPluginApi",
-                "section": "def-common.CsvMetrics",
-                "text": "CsvMetrics"
-              },
-              " | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunMetrics.png",
-            "type": "Object",
-            "tags": [],
-            "label": "png",
-            "description": [],
-            "signature": [
-              "PerformanceMetrics",
-              " | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunMetrics.pdf",
-            "type": "Object",
-            "tags": [],
-            "label": "pdf",
-            "description": [],
-            "signature": [
-              "PdfScreenshotMetrics",
-              " | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.API_USAGE_ERROR_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "API_USAGE_ERROR_TYPE",
+        "description": [],
+        "signature": [
+          "\"reportingApiError\""
         ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "@kbn/reporting-common",
-        "id": "def-common.TaskRunResult",
-        "type": "Interface",
+        "id": "def-common.ILM_POLICY_NAME",
+        "type": "string",
         "tags": [],
-        "label": "TaskRunResult",
+        "label": "ILM_POLICY_NAME",
         "description": [],
-        "path": "packages/kbn-reporting/common/metrics.ts",
+        "signature": [
+          "\"kibana-reporting\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
         "deprecated": false,
         "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.content_type",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "content_type",
-            "description": [],
-            "signature": [
-              "string | null"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.csv_contains_formulas",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "csv_contains_formulas",
-            "description": [],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.max_size_reached",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "max_size_reached",
-            "description": [],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.warnings",
-            "type": "Array",
-            "tags": [],
-            "label": "warnings",
-            "description": [],
-            "signature": [
-              "string[] | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.metrics",
-            "type": "Object",
-            "tags": [],
-            "label": "metrics",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "@kbn/reporting-common",
-                "scope": "common",
-                "docId": "kibKbnReportingCommonPluginApi",
-                "section": "def-common.TaskRunMetrics",
-                "text": "TaskRunMetrics"
-              },
-              " | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/reporting-common",
-            "id": "def-common.TaskRunResult.error_code",
-            "type": "string",
-            "tags": [],
-            "label": "error_code",
-            "description": [
-              "\nWhen running a report task we may finish with warnings that were triggered\nby an error. We can pass the error code via the task run result to the\ntask runner so that it can be recorded for telemetry.\n\nAlternatively, this field can be populated in the event that the task does\nnot complete in the task runner's error handler."
-            ],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "packages/kbn-reporting/common/metrics.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY",
+        "type": "string",
+        "tags": [],
+        "label": "JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY",
+        "description": [],
+        "signature": [
+          "\"xpack.reporting.jobCompletionNotifications\""
         ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
         "initialIsOpen": false
-      }
-    ],
-    "enums": [],
-    "misc": [
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_BASIC",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_BASIC",
+        "description": [],
+        "signature": [
+          "\"basic\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_CLOUD_STANDARD",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_CLOUD_STANDARD",
+        "description": [],
+        "signature": [
+          "\"standard\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_ENTERPRISE",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_ENTERPRISE",
+        "description": [],
+        "signature": [
+          "\"enterprise\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_GOLD",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_GOLD",
+        "description": [],
+        "signature": [
+          "\"gold\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_PLATINUM",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_PLATINUM",
+        "description": [],
+        "signature": [
+          "\"platinum\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.LICENSE_TYPE_TRIAL",
+        "type": "string",
+        "tags": [],
+        "label": "LICENSE_TYPE_TRIAL",
+        "description": [],
+        "signature": [
+          "\"trial\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.PLUGIN_ID",
+        "type": "string",
+        "tags": [],
+        "label": "PLUGIN_ID",
+        "description": [],
+        "signature": [
+          "\"reporting\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.REPORTING_MANAGEMENT_HOME",
+        "type": "string",
+        "tags": [],
+        "label": "REPORTING_MANAGEMENT_HOME",
+        "description": [],
+        "signature": [
+          "\"/app/management/insightsAndAlerting/reporting\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.REPORTING_REDIRECT_LOCATOR_STORE_KEY",
+        "type": "string",
+        "tags": [],
+        "label": "REPORTING_REDIRECT_LOCATOR_STORE_KEY",
+        "description": [],
+        "signature": [
+          "\"__REPORTING_REDIRECT_LOCATOR_STORE_KEY__\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/reporting-common",
-        "id": "def-common.CSV_REPORTING_ACTION",
+        "id": "def-common.REPORTING_SYSTEM_INDEX",
         "type": "string",
         "tags": [],
-        "label": "CSV_REPORTING_ACTION",
+        "label": "REPORTING_SYSTEM_INDEX",
         "description": [],
         "signature": [
-          "\"downloadCsvReport\""
+          "\".reporting\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.REPORTING_TRANSACTION_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "REPORTING_TRANSACTION_TYPE",
+        "description": [],
+        "signature": [
+          "\"reporting\""
         ],
         "path": "packages/kbn-reporting/common/constants.ts",
         "deprecated": false,
@@ -1299,6 +1392,21 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-common",
+        "id": "def-common.UNVERSIONED_VERSION",
+        "type": "string",
+        "tags": [],
+        "label": "UNVERSIONED_VERSION",
+        "description": [],
+        "signature": [
+          "\"7.14.0\""
+        ],
+        "path": "packages/kbn-reporting/common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
       }
     ],
     "objects": []
diff --git a/api_docs/kbn_reporting_common.mdx b/api_docs/kbn_reporting_common.mdx
index b5c319501040a7..cbabbb3542a21f 100644
--- a/api_docs/kbn_reporting_common.mdx
+++ b/api_docs/kbn_reporting_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-common
 title: "@kbn/reporting-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-common plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-common']
 ---
 import kbnReportingCommonObj from './kbn_reporting_common.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 73 | 0 | 65 | 0 |
+| 80 | 0 | 72 | 7 |
 
 ## Common
 
@@ -34,6 +34,9 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 ### Interfaces
 <DocDefinitionList data={kbnReportingCommonObj.common.interfaces}/>
 
+### Enums
+<DocDefinitionList data={kbnReportingCommonObj.common.enums}/>
+
 ### Consts, variables and types
 <DocDefinitionList data={kbnReportingCommonObj.common.misc}/>
 
diff --git a/api_docs/kbn_reporting_export_types_csv.devdocs.json b/api_docs/kbn_reporting_export_types_csv.devdocs.json
new file mode 100644
index 00000000000000..60f6311b05b9c0
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_csv.devdocs.json
@@ -0,0 +1,1171 @@
+{
+  "id": "@kbn/reporting-export-types-csv",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv",
+        "id": "def-server.CsvSearchSourceExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "CsvSearchSourceExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-csv",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesCsvPluginApi",
+            "section": "def-server.CsvSearchSourceExportType",
+            "text": "CsvSearchSourceExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-csv-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+            "section": "def-common.JobParamsCSV",
+            "text": "JobParamsCSV"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-export-types-csv-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+            "section": "def-common.TaskPayloadCSV",
+            "text": "TaskPayloadCSV"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", CsvSearchSourceExportTypeStartDeps>"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"csv\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "(jobParams: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-csv-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                "section": "def-common.JobParamsCSV",
+                "text": "JobParamsCSV"
+              },
+              ") => Promise<{ searchSource: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SerializedSearchSourceFields",
+                "text": "SerializedSearchSourceFields"
+              },
+              "; columns?: string[] | undefined; layout?: { id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; } | undefined; objectType: string; title: string; browserTimezone: string; version: string; }>"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.createJob.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "jobParams",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-csv-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                    "section": "def-common.JobParamsCSV",
+                    "text": "JobParamsCSV"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [],
+            "signature": [
+              "(jobId: string, job: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-csv-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                "section": "def-common.TaskPayloadCSV",
+                "text": "TaskPayloadCSV"
+              },
+              ", cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.runTask.$2",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "job",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-csv-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                    "section": "def-common.TaskPayloadCSV",
+                    "text": "TaskPayloadCSV"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv",
+        "id": "def-server.CsvSearchSourceImmediateExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "CsvSearchSourceImmediateExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-csv",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesCsvPluginApi",
+            "section": "def-server.CsvSearchSourceImmediateExportType",
+            "text": "CsvSearchSourceImmediateExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-csv-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+            "section": "def-common.JobParamsDownloadCSV",
+            "text": "JobParamsDownloadCSV"
+          },
+          ", ",
+          "ImmediateExecuteFn",
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", CsvSearchSourceImmediateExportTypeStartDeps>"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"csv\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "() => Promise<never>"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvSearchSourceImmediateExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [],
+            "signature": [
+              "(_jobId: string | null, immediateJobParams: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-csv-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                "section": "def-common.JobParamsDownloadCSV",
+                "text": "JobParamsDownloadCSV"
+              },
+              ", context: ",
+              "ReportingRequestHandlerContext",
+              ", stream: ",
+              "Writable",
+              ", req: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>) => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.runTask.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "_jobId",
+                "description": [],
+                "signature": [
+                  "string | null"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.runTask.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "immediateJobParams",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-csv-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                    "section": "def-common.JobParamsDownloadCSV",
+                    "text": "JobParamsDownloadCSV"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.runTask.$3",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  "ReportingRequestHandlerContext"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvSearchSourceImmediateExportType.runTask.$5",
+                "type": "Object",
+                "tags": [],
+                "label": "req",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpServerPluginApi",
+                    "section": "def-common.KibanaRequest",
+                    "text": "KibanaRequest"
+                  },
+                  "<unknown, unknown, unknown, any>"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv",
+        "id": "def-server.CsvV2ExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "CsvV2ExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-csv",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesCsvPluginApi",
+            "section": "def-server.CsvV2ExportType",
+            "text": "CsvV2ExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-csv-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+            "section": "def-common.JobParamsCsvFromSavedObject",
+            "text": "JobParamsCsvFromSavedObject"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-export-types-csv-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+            "section": "def-common.TaskPayloadCsvFromSavedObject",
+            "text": "TaskPayloadCsvFromSavedObject"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", ",
+          "CsvV2ExportTypeStartDeps",
+          ">"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"csv\""
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "(jobParams: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-csv-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                "section": "def-common.JobParamsCsvFromSavedObject",
+                "text": "JobParamsCsvFromSavedObject"
+              },
+              ", _context: ",
+              "ReportingRequestHandlerContext",
+              ", req: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>) => Promise<{ title: string; objectType: string; isDeprecated: boolean; version: string; layout?: { id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; } | undefined; locatorParams: ",
+              "LocatorParams",
+              "<",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              ">[]; browserTimezone: string; }>"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.createJob.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "jobParams",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-csv-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                    "section": "def-common.JobParamsCsvFromSavedObject",
+                    "text": "JobParamsCsvFromSavedObject"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.createJob.$2",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "_context",
+                "description": [],
+                "signature": [
+                  "ReportingRequestHandlerContext"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.createJob.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "req",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpServerPluginApi",
+                    "section": "def-common.KibanaRequest",
+                    "text": "KibanaRequest"
+                  },
+                  "<unknown, unknown, unknown, any>"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv",
+            "id": "def-server.CsvV2ExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [],
+            "signature": [
+              "(jobId: string, job: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-csv-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                "section": "def-common.TaskPayloadCsvFromSavedObject",
+                "text": "TaskPayloadCsvFromSavedObject"
+              },
+              ", cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.runTask.$2",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "job",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-csv-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesCsvCommonPluginApi",
+                    "section": "def-common.TaskPayloadCsvFromSavedObject",
+                    "text": "TaskPayloadCsvFromSavedObject"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-csv",
+                "id": "def-server.CsvV2ExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/csv/csv_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_csv.mdx b/api_docs/kbn_reporting_export_types_csv.mdx
new file mode 100644
index 00000000000000..e59358e3bcaf7f
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_csv.mdx
@@ -0,0 +1,30 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesCsvPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-csv
+title: "@kbn/reporting-export-types-csv"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-csv plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-csv']
+---
+import kbnReportingExportTypesCsvObj from './kbn_reporting_export_types_csv.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 50 | 0 | 50 | 3 |
+
+## Server
+
+### Classes
+<DocDefinitionList data={kbnReportingExportTypesCsvObj.server.classes}/>
+
diff --git a/api_docs/kbn_reporting_export_types_csv_common.devdocs.json b/api_docs/kbn_reporting_export_types_csv_common.devdocs.json
new file mode 100644
index 00000000000000..4e6ff0c91e22cc
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_csv_common.devdocs.json
@@ -0,0 +1,358 @@
+{
+  "id": "@kbn/reporting-export-types-csv-common",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.JobParamsDownloadCSV",
+        "type": "Interface",
+        "tags": [],
+        "label": "JobParamsDownloadCSV",
+        "description": [],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv-common",
+            "id": "def-common.JobParamsDownloadCSV.browserTimezone",
+            "type": "string",
+            "tags": [],
+            "label": "browserTimezone",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv-common",
+            "id": "def-common.JobParamsDownloadCSV.title",
+            "type": "string",
+            "tags": [],
+            "label": "title",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv-common",
+            "id": "def-common.JobParamsDownloadCSV.searchSource",
+            "type": "Object",
+            "tags": [],
+            "label": "searchSource",
+            "description": [],
+            "signature": [
+              "{ type?: string | undefined; query?: ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Query",
+                "text": "Query"
+              },
+              " | ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.AggregateQuery",
+                "text": "AggregateQuery"
+              },
+              " | undefined; filter?: ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Filter",
+                "text": "Filter"
+              },
+              "[] | undefined; sort?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.EsQuerySortValue",
+                "text": "EsQuerySortValue"
+              },
+              "[] | undefined; highlight?: ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              " | undefined; highlightAll?: boolean | undefined; trackTotalHits?: number | boolean | undefined; aggs?: { type: string; enabled?: boolean | undefined; id?: string | undefined; params?: {} | ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              " | undefined; schema?: string | undefined; }[] | undefined; from?: number | undefined; size?: number | undefined; source?: boolean | ",
+              "Fields",
+              " | undefined; version?: boolean | undefined; fields?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SearchFieldValue",
+                "text": "SearchFieldValue"
+              },
+              "[] | undefined; fieldsFromSource?: ",
+              "Fields",
+              " | undefined; index?: string | ",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataViewSpec",
+                "text": "DataViewSpec"
+              },
+              " | undefined; searchAfter?: ",
+              "SortResults",
+              " | undefined; timeout?: string | undefined; terminate_after?: number | undefined; parent?: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataSearchPluginApi",
+                "section": "def-common.SerializedSearchSourceFields",
+                "text": "SerializedSearchSourceFields"
+              },
+              " | undefined; }"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-csv-common",
+            "id": "def-common.JobParamsDownloadCSV.columns",
+            "type": "Array",
+            "tags": [],
+            "label": "columns",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_JOB_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_JOB_TYPE",
+        "description": [],
+        "signature": [
+          "\"csv_searchsource\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_JOB_TYPE_DEPRECATED",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_JOB_TYPE_DEPRECATED",
+        "description": [],
+        "signature": [
+          "\"csv\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_JOB_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_JOB_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"csv_v2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_REPORT_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_REPORT_TYPE",
+        "description": [],
+        "signature": [
+          "\"csv_searchsource\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_REPORT_TYPE_DEPRECATED",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_REPORT_TYPE_DEPRECATED",
+        "description": [],
+        "signature": [
+          "\"CSV\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_REPORT_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_REPORT_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"csv_v2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_REPORTING_ACTION",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_REPORTING_ACTION",
+        "description": [],
+        "signature": [
+          "\"downloadCsvReport\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.CSV_SEARCHSOURCE_IMMEDIATE_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "CSV_SEARCHSOURCE_IMMEDIATE_TYPE",
+        "description": [],
+        "signature": [
+          "\"csv_searchsource_immediate\""
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.JobParamsCSV",
+        "type": "Type",
+        "tags": [],
+        "label": "JobParamsCSV",
+        "description": [],
+        "signature": [
+          "BaseParamsCSV & ",
+          "BaseParams"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.JobParamsCsvFromSavedObject",
+        "type": "Type",
+        "tags": [],
+        "label": "JobParamsCsvFromSavedObject",
+        "description": [
+          "\nMakes title optional, as it can be derived from the saved search object"
+        ],
+        "signature": [
+          "CsvFromSavedObjectBase & Omit<",
+          "BaseParamsV2",
+          ", \"title\"> & { title?: string | undefined; }"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.TaskPayloadCSV",
+        "type": "Type",
+        "tags": [],
+        "label": "TaskPayloadCSV",
+        "description": [],
+        "signature": [
+          "BaseParamsCSV & ",
+          "BasePayload"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-csv-common",
+        "id": "def-common.TaskPayloadCsvFromSavedObject",
+        "type": "Type",
+        "tags": [],
+        "label": "TaskPayloadCsvFromSavedObject",
+        "description": [],
+        "signature": [
+          "CsvFromSavedObjectBase & ",
+          "BasePayloadV2"
+        ],
+        "path": "packages/kbn-reporting/export_types/csv_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_csv_common.mdx b/api_docs/kbn_reporting_export_types_csv_common.mdx
new file mode 100644
index 00000000000000..19723d89f58718
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_csv_common.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesCsvCommonPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-csv-common
+title: "@kbn/reporting-export-types-csv-common"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-csv-common plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-csv-common']
+---
+import kbnReportingExportTypesCsvCommonObj from './kbn_reporting_export_types_csv_common.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 17 | 0 | 16 | 0 |
+
+## Common
+
+### Interfaces
+<DocDefinitionList data={kbnReportingExportTypesCsvCommonObj.common.interfaces}/>
+
+### Consts, variables and types
+<DocDefinitionList data={kbnReportingExportTypesCsvCommonObj.common.misc}/>
+
diff --git a/api_docs/kbn_reporting_export_types_pdf.devdocs.json b/api_docs/kbn_reporting_export_types_pdf.devdocs.json
new file mode 100644
index 00000000000000..48dfb839ff1090
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_pdf.devdocs.json
@@ -0,0 +1,806 @@
+{
+  "id": "@kbn/reporting-export-types-pdf",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf",
+        "id": "def-server.PdfExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "PdfExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesPdfPluginApi",
+            "section": "def-server.PdfExportType",
+            "text": "PdfExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.JobParamsPDFV2",
+            "text": "JobParamsPDFV2"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.TaskPayloadPDFV2",
+            "text": "TaskPayloadPDFV2"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeStartDeps",
+            "text": "BaseExportTypeStartDeps"
+          },
+          ">"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\""
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"pdf\""
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "({ locatorParams, ...jobParams }: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-pdf-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                "section": "def-common.JobParamsPDFV2",
+                "text": "JobParamsPDFV2"
+              },
+              ") => Promise<{ locatorParams: ",
+              "LocatorParams",
+              "<",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              ">[]; isDeprecated: boolean; browserTimezone: string; forceNow: string; layout: { id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }; objectType: string; title: string; version: string; }>"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.createJob.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "{ locatorParams, ...jobParams }",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-pdf-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                    "section": "def-common.JobParamsPDFV2",
+                    "text": "JobParamsPDFV2"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": [
+              "jobParams"
+            ]
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [
+              "\n"
+            ],
+            "signature": [
+              "(jobId: string, payload: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-pdf-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                "section": "def-common.TaskPayloadPDFV2",
+                "text": "TaskPayloadPDFV2"
+              },
+              ", cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.runTask.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "payload",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-pdf-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                    "section": "def-common.TaskPayloadPDFV2",
+                    "text": "TaskPayloadPDFV2"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf",
+        "id": "def-server.PdfV1ExportType",
+        "type": "Class",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "PdfV1ExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesPdfPluginApi",
+            "section": "def-server.PdfV1ExportType",
+            "text": "PdfV1ExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.JobParamsPDFDeprecated",
+            "text": "JobParamsPDFDeprecated"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.TaskPayloadPDF",
+            "text": "TaskPayloadPDF"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeStartDeps",
+            "text": "BaseExportTypeStartDeps"
+          },
+          ">"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+        "deprecated": true,
+        "trackAdoption": false,
+        "references": [
+          {
+            "plugin": "reporting",
+            "path": "x-pack/plugins/reporting/server/core.ts"
+          },
+          {
+            "plugin": "reporting",
+            "path": "x-pack/plugins/reporting/server/core.ts"
+          }
+        ],
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\" | undefined"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"pdf\""
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "({ relativeUrls, ...jobParams }: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-pdf-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                "section": "def-common.JobParamsPDFDeprecated",
+                "text": "JobParamsPDFDeprecated"
+              },
+              ") => Promise<{ isDeprecated: boolean; forceNow: string; objects: { relativeUrl: string; }[]; layout: { id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }; objectType: string; title: string; browserTimezone: string; version: string; }>"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.createJob.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "{ relativeUrls, ...jobParams }",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-pdf-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                    "section": "def-common.JobParamsPDFDeprecated",
+                    "text": "JobParamsPDFDeprecated"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf",
+            "id": "def-server.PdfV1ExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [],
+            "signature": [
+              "(jobId: string, job: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-pdf-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                "section": "def-common.TaskPayloadPDF",
+                "text": "TaskPayloadPDF"
+              },
+              ", cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.runTask.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "job",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-pdf-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+                    "section": "def-common.TaskPayloadPDF",
+                    "text": "TaskPayloadPDF"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-pdf",
+                "id": "def-server.PdfV1ExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_pdf.mdx b/api_docs/kbn_reporting_export_types_pdf.mdx
new file mode 100644
index 00000000000000..6112c4f0bfc3b2
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_pdf.mdx
@@ -0,0 +1,30 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesPdfPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-pdf
+title: "@kbn/reporting-export-types-pdf"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-pdf plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-pdf']
+---
+import kbnReportingExportTypesPdfObj from './kbn_reporting_export_types_pdf.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 32 | 0 | 31 | 0 |
+
+## Server
+
+### Classes
+<DocDefinitionList data={kbnReportingExportTypesPdfObj.server.classes}/>
+
diff --git a/api_docs/kbn_reporting_export_types_pdf_common.devdocs.json b/api_docs/kbn_reporting_export_types_pdf_common.devdocs.json
new file mode 100644
index 00000000000000..335e4e24dbd67a
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_pdf_common.devdocs.json
@@ -0,0 +1,324 @@
+{
+  "id": "@kbn/reporting-export-types-pdf-common",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.TaskPayloadPDF",
+        "type": "Interface",
+        "tags": [],
+        "label": "TaskPayloadPDF",
+        "description": [
+          "\nStructure of stored job data provided by create_job"
+        ],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.TaskPayloadPDF",
+            "text": "TaskPayloadPDF"
+          },
+          " extends ",
+          "BasePayload"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+            "id": "def-common.TaskPayloadPDF.layout",
+            "type": "Object",
+            "tags": [],
+            "label": "layout",
+            "description": [],
+            "signature": [
+              "{ id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+            "id": "def-common.TaskPayloadPDF.forceNow",
+            "type": "string",
+            "tags": [],
+            "label": "forceNow",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+            "id": "def-common.TaskPayloadPDF.objects",
+            "type": "Array",
+            "tags": [],
+            "label": "objects",
+            "description": [],
+            "signature": [
+              "{ relativeUrl: string; }[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.TaskPayloadPDFV2",
+        "type": "Interface",
+        "tags": [],
+        "label": "TaskPayloadPDFV2",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-pdf-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPdfCommonPluginApi",
+            "section": "def-common.TaskPayloadPDFV2",
+            "text": "TaskPayloadPDFV2"
+          },
+          " extends ",
+          "BasePayload",
+          ",BaseParamsPDFV2"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+            "id": "def-common.TaskPayloadPDFV2.layout",
+            "type": "Object",
+            "tags": [],
+            "label": "layout",
+            "description": [],
+            "signature": [
+              "{ id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }"
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+            "id": "def-common.TaskPayloadPDFV2.forceNow",
+            "type": "string",
+            "tags": [],
+            "label": "forceNow",
+            "description": [
+              "\nThe value of forceNow is injected server-side every time a given report is generated."
+            ],
+            "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.JobAppParamsPDFV2",
+        "type": "Type",
+        "tags": [],
+        "label": "JobAppParamsPDFV2",
+        "description": [
+          "\nPublic-facing interface\nApps should use this interface to build job params.\nbrowserTimezone and version is provided by Reporting"
+        ],
+        "signature": [
+          "{ title: string; layout: { id?: ",
+          {
+            "pluginId": "screenshotting",
+            "scope": "common",
+            "docId": "kibScreenshottingPluginApi",
+            "section": "def-common.LayoutType",
+            "text": "LayoutType"
+          },
+          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+          "LayoutSelectorDictionary",
+          "> | undefined; zoom?: number | undefined; }; locatorParams: ",
+          "LocatorParams",
+          "<",
+          {
+            "pluginId": "@kbn/utility-types",
+            "scope": "common",
+            "docId": "kibKbnUtilityTypesPluginApi",
+            "section": "def-common.SerializableRecord",
+            "text": "SerializableRecord"
+          },
+          ">[]; objectType: string; }"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.JobParamsPDFDeprecated",
+        "type": "Type",
+        "tags": [
+          "deprecated"
+        ],
+        "label": "JobParamsPDFDeprecated",
+        "description": [],
+        "signature": [
+          "BaseParamsPDF & ",
+          "BaseParams"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+        "deprecated": true,
+        "trackAdoption": false,
+        "references": [
+          {
+            "plugin": "@kbn/reporting-export-types-pdf",
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts"
+          },
+          {
+            "plugin": "@kbn/reporting-export-types-pdf",
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts"
+          },
+          {
+            "plugin": "@kbn/reporting-export-types-pdf",
+            "path": "packages/kbn-reporting/export_types/pdf/printable_pdf.ts"
+          },
+          {
+            "plugin": "reporting",
+            "path": "x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts"
+          },
+          {
+            "plugin": "reporting",
+            "path": "x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts"
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.JobParamsPDFV2",
+        "type": "Type",
+        "tags": [],
+        "label": "JobParamsPDFV2",
+        "description": [],
+        "signature": [
+          "BaseParamsPDFV2 & ",
+          "BaseParams"
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.PDF_JOB_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "PDF_JOB_TYPE",
+        "description": [],
+        "signature": [
+          "\"printable_pdf\""
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.PDF_JOB_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "PDF_JOB_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"printable_pdf_v2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.PDF_REPORT_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "PDF_REPORT_TYPE",
+        "description": [],
+        "signature": [
+          "\"printablePdf\""
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-pdf-common",
+        "id": "def-common.PDF_REPORT_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "PDF_REPORT_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"printablePdfV2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/pdf_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_pdf_common.mdx b/api_docs/kbn_reporting_export_types_pdf_common.mdx
new file mode 100644
index 00000000000000..e80e700bd2cf93
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_pdf_common.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesPdfCommonPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-pdf-common
+title: "@kbn/reporting-export-types-pdf-common"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-pdf-common plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-pdf-common']
+---
+import kbnReportingExportTypesPdfCommonObj from './kbn_reporting_export_types_pdf_common.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 14 | 0 | 11 | 0 |
+
+## Common
+
+### Interfaces
+<DocDefinitionList data={kbnReportingExportTypesPdfCommonObj.common.interfaces}/>
+
+### Consts, variables and types
+<DocDefinitionList data={kbnReportingExportTypesPdfCommonObj.common.misc}/>
+
diff --git a/api_docs/kbn_reporting_export_types_png.devdocs.json b/api_docs/kbn_reporting_export_types_png.devdocs.json
new file mode 100644
index 00000000000000..176277a8cf6ec8
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_png.devdocs.json
@@ -0,0 +1,420 @@
+{
+  "id": "@kbn/reporting-export-types-png",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png",
+        "id": "def-server.PngExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "PngExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-png",
+            "scope": "server",
+            "docId": "kibKbnReportingExportTypesPngPluginApi",
+            "section": "def-server.PngExportType",
+            "text": "PngExportType"
+          },
+          " extends ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<",
+          {
+            "pluginId": "@kbn/reporting-export-types-png-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+            "section": "def-common.JobParamsPNGV2",
+            "text": "JobParamsPNGV2"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-export-types-png-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+            "section": "def-common.TaskPayloadPNGV2",
+            "text": "TaskPayloadPNGV2"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeSetupDeps",
+            "text": "BaseExportTypeSetupDeps"
+          },
+          ", ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.BaseExportTypeStartDeps",
+            "text": "BaseExportTypeStartDeps"
+          },
+          ">"
+        ],
+        "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.jobContentEncoding",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\""
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.jobContentExtension",
+            "type": "string",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"png\""
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "args",
+                "description": [],
+                "signature": [
+                  "[core: ",
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>, config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, logger: ",
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  },
+                  ", context: ",
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>]"
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.createJob",
+            "type": "Function",
+            "tags": [
+              "params"
+            ],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "({ locatorParams, ...jobParams }: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-png-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+                "section": "def-common.JobParamsPNGV2",
+                "text": "JobParamsPNGV2"
+              },
+              ") => Promise<{ locatorParams: ",
+              "LocatorParams",
+              "<",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              ">[]; isDeprecated: boolean; browserTimezone: string; forceNow: string; layout: { id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }; objectType: string; title: string; version: string; }>"
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.createJob.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "{ locatorParams, ...jobParams }",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-png-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+                    "section": "def-common.JobParamsPNGV2",
+                    "text": "JobParamsPNGV2"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": [
+              "jobParams"
+            ]
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png",
+            "id": "def-server.PngExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [
+              "\n"
+            ],
+            "signature": [
+              "(jobId: string, payload: ",
+              {
+                "pluginId": "@kbn/reporting-export-types-png-common",
+                "scope": "common",
+                "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+                "section": "def-common.TaskPayloadPNGV2",
+                "text": "TaskPayloadPNGV2"
+              },
+              ", cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.runTask.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "payload",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-export-types-png-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+                    "section": "def-common.TaskPayloadPNGV2",
+                    "text": "TaskPayloadPNGV2"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-export-types-png",
+                "id": "def-server.PngExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/export_types/png/png_v2.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_png.mdx b/api_docs/kbn_reporting_export_types_png.mdx
new file mode 100644
index 00000000000000..086d6edf5d3a08
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_png.mdx
@@ -0,0 +1,30 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesPngPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-png
+title: "@kbn/reporting-export-types-png"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-png plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-png']
+---
+import kbnReportingExportTypesPngObj from './kbn_reporting_export_types_png.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 16 | 0 | 15 | 0 |
+
+## Server
+
+### Classes
+<DocDefinitionList data={kbnReportingExportTypesPngObj.server.classes}/>
+
diff --git a/api_docs/kbn_reporting_export_types_png_common.devdocs.json b/api_docs/kbn_reporting_export_types_png_common.devdocs.json
new file mode 100644
index 00000000000000..01af24bb97bc65
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_png_common.devdocs.json
@@ -0,0 +1,280 @@
+{
+  "id": "@kbn/reporting-export-types-png-common",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.JobParamsPNGV2",
+        "type": "Interface",
+        "tags": [],
+        "label": "JobParamsPNGV2",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-png-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+            "section": "def-common.JobParamsPNGV2",
+            "text": "JobParamsPNGV2"
+          },
+          " extends ",
+          "BaseParams"
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png-common",
+            "id": "def-common.JobParamsPNGV2.layout",
+            "type": "Object",
+            "tags": [],
+            "label": "layout",
+            "description": [],
+            "signature": [
+              "{ id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }"
+            ],
+            "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png-common",
+            "id": "def-common.JobParamsPNGV2.locatorParams",
+            "type": "Object",
+            "tags": [],
+            "label": "locatorParams",
+            "description": [
+              "\nThis value is used to re-create the same visual state as when the report was requested as well as navigate to the correct page."
+            ],
+            "signature": [
+              "LocatorParams",
+              "<",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              ">"
+            ],
+            "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.TaskPayloadPNGV2",
+        "type": "Interface",
+        "tags": [],
+        "label": "TaskPayloadPNGV2",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-export-types-png-common",
+            "scope": "common",
+            "docId": "kibKbnReportingExportTypesPngCommonPluginApi",
+            "section": "def-common.TaskPayloadPNGV2",
+            "text": "TaskPayloadPNGV2"
+          },
+          " extends ",
+          "BasePayload"
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png-common",
+            "id": "def-common.TaskPayloadPNGV2.layout",
+            "type": "Object",
+            "tags": [],
+            "label": "layout",
+            "description": [],
+            "signature": [
+              "{ id?: ",
+              {
+                "pluginId": "screenshotting",
+                "scope": "common",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-common.LayoutType",
+                "text": "LayoutType"
+              },
+              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
+              "LayoutSelectorDictionary",
+              "> | undefined; zoom?: number | undefined; }"
+            ],
+            "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png-common",
+            "id": "def-common.TaskPayloadPNGV2.forceNow",
+            "type": "string",
+            "tags": [],
+            "label": "forceNow",
+            "description": [],
+            "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-export-types-png-common",
+            "id": "def-common.TaskPayloadPNGV2.locatorParams",
+            "type": "Array",
+            "tags": [],
+            "label": "locatorParams",
+            "description": [
+              "\nEven though we only ever handle one locator for a PNG, we store it as an array for consistency with how PDFs are stored"
+            ],
+            "signature": [
+              "LocatorParams",
+              "<",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.SerializableRecord",
+                "text": "SerializableRecord"
+              },
+              ">[]"
+            ],
+            "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.JobParamsPNGDeprecated",
+        "type": "Type",
+        "tags": [],
+        "label": "JobParamsPNGDeprecated",
+        "description": [],
+        "signature": [
+          "BaseParamsPNG & ",
+          "BaseParams"
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.PNG_JOB_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "PNG_JOB_TYPE",
+        "description": [],
+        "signature": [
+          "\"PNG\""
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.PNG_JOB_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "PNG_JOB_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"PNGV2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.PNG_REPORT_TYPE",
+        "type": "string",
+        "tags": [],
+        "label": "PNG_REPORT_TYPE",
+        "description": [],
+        "signature": [
+          "\"PNG\""
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.PNG_REPORT_TYPE_V2",
+        "type": "string",
+        "tags": [],
+        "label": "PNG_REPORT_TYPE_V2",
+        "description": [],
+        "signature": [
+          "\"pngV2\""
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/constants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-export-types-png-common",
+        "id": "def-common.TaskPayloadPNG",
+        "type": "Type",
+        "tags": [],
+        "label": "TaskPayloadPNG",
+        "description": [],
+        "signature": [
+          "BaseParamsPNG & ",
+          "BasePayload"
+        ],
+        "path": "packages/kbn-reporting/export_types/png_common/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_export_types_png_common.mdx b/api_docs/kbn_reporting_export_types_png_common.mdx
new file mode 100644
index 00000000000000..33f9aecbbc29b1
--- /dev/null
+++ b/api_docs/kbn_reporting_export_types_png_common.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingExportTypesPngCommonPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-export-types-png-common
+title: "@kbn/reporting-export-types-png-common"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-export-types-png-common plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-export-types-png-common']
+---
+import kbnReportingExportTypesPngCommonObj from './kbn_reporting_export_types_png_common.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 13 | 0 | 11 | 0 |
+
+## Common
+
+### Interfaces
+<DocDefinitionList data={kbnReportingExportTypesPngCommonObj.common.interfaces}/>
+
+### Consts, variables and types
+<DocDefinitionList data={kbnReportingExportTypesPngCommonObj.common.misc}/>
+
diff --git a/api_docs/kbn_reporting_mocks_server.devdocs.json b/api_docs/kbn_reporting_mocks_server.devdocs.json
new file mode 100644
index 00000000000000..12ee6a35918a53
--- /dev/null
+++ b/api_docs/kbn_reporting_mocks_server.devdocs.json
@@ -0,0 +1,88 @@
+{
+  "id": "@kbn/reporting-mocks-server",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/reporting-mocks-server",
+        "id": "def-common.createMockConfigSchema",
+        "type": "Function",
+        "tags": [],
+        "label": "createMockConfigSchema",
+        "description": [],
+        "signature": [
+          "(overrides?: ",
+          "_DeepPartialObject",
+          "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>) => Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>"
+        ],
+        "path": "packages/kbn-reporting/mocks_server/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-mocks-server",
+            "id": "def-common.createMockConfigSchema.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "overrides",
+            "description": [],
+            "signature": [
+              "_DeepPartialObject",
+              "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+              {
+                "pluginId": "@kbn/config-schema",
+                "scope": "common",
+                "docId": "kibKbnConfigSchemaPluginApi",
+                "section": "def-common.ByteSizeValue",
+                "text": "ByteSizeValue"
+              },
+              "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>"
+            ],
+            "path": "packages/kbn-reporting/mocks_server/index.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_mocks_server.mdx b/api_docs/kbn_reporting_mocks_server.mdx
new file mode 100644
index 00000000000000..c67ab41fcf43d2
--- /dev/null
+++ b/api_docs/kbn_reporting_mocks_server.mdx
@@ -0,0 +1,30 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingMocksServerPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-mocks-server
+title: "@kbn/reporting-mocks-server"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-mocks-server plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-mocks-server']
+---
+import kbnReportingMocksServerObj from './kbn_reporting_mocks_server.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 2 | 0 | 2 | 0 |
+
+## Common
+
+### Functions
+<DocDefinitionList data={kbnReportingMocksServerObj.common.functions}/>
+
diff --git a/api_docs/kbn_reporting_public.devdocs.json b/api_docs/kbn_reporting_public.devdocs.json
new file mode 100644
index 00000000000000..5acb381f4e2a36
--- /dev/null
+++ b/api_docs/kbn_reporting_public.devdocs.json
@@ -0,0 +1,98 @@
+{
+  "id": "@kbn/reporting-public",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/reporting-public",
+        "id": "def-public.ClientConfigType",
+        "type": "Interface",
+        "tags": [],
+        "label": "ClientConfigType",
+        "description": [],
+        "path": "packages/kbn-reporting/public/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-public",
+            "id": "def-public.ClientConfigType.poll",
+            "type": "Object",
+            "tags": [],
+            "label": "poll",
+            "description": [],
+            "signature": [
+              "{ jobsRefresh: { interval: number; intervalErrorMultiplier: number; }; }"
+            ],
+            "path": "packages/kbn-reporting/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-public",
+            "id": "def-public.ClientConfigType.roles",
+            "type": "Object",
+            "tags": [],
+            "label": "roles",
+            "description": [],
+            "signature": [
+              "{ enabled: boolean; }"
+            ],
+            "path": "packages/kbn-reporting/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-public",
+            "id": "def-public.ClientConfigType.export_types",
+            "type": "Object",
+            "tags": [],
+            "label": "export_types",
+            "description": [],
+            "signature": [
+              "{ pdf: { enabled: boolean; }; png: { enabled: boolean; }; csv: { enabled: boolean; }; }"
+            ],
+            "path": "packages/kbn-reporting/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-public",
+            "id": "def-public.ClientConfigType.statefulSettings",
+            "type": "Object",
+            "tags": [],
+            "label": "statefulSettings",
+            "description": [],
+            "signature": [
+              "{ enabled: boolean; }"
+            ],
+            "path": "packages/kbn-reporting/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_generate_csv_types.mdx b/api_docs/kbn_reporting_public.mdx
similarity index 55%
rename from api_docs/kbn_generate_csv_types.mdx
rename to api_docs/kbn_reporting_public.mdx
index a4127854b3fc91..6861b7b789720d 100644
--- a/api_docs/kbn_generate_csv_types.mdx
+++ b/api_docs/kbn_reporting_public.mdx
@@ -3,15 +3,15 @@
 #### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
 #### Reach out in #docs-engineering for more info.
 ####
-id: kibKbnGenerateCsvTypesPluginApi
-slug: /kibana-dev-docs/api/kbn-generate-csv-types
-title: "@kbn/generate-csv-types"
+id: kibKbnReportingPublicPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-public
+title: "@kbn/reporting-public"
 image: https://source.unsplash.com/400x175/?github
-description: API docs for the @kbn/generate-csv-types plugin
-date: 2023-11-10
-tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-csv-types']
+description: API docs for the @kbn/reporting-public plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-public']
 ---
-import kbnGenerateCsvTypesObj from './kbn_generate_csv_types.devdocs.json';
+import kbnReportingPublicObj from './kbn_reporting_public.devdocs.json';
 
 
 
@@ -21,10 +21,10 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 10 | 0 | 10 | 0 |
+| 5 | 0 | 5 | 0 |
 
-## Common
+## Client
 
 ### Interfaces
-<DocDefinitionList data={kbnGenerateCsvTypesObj.common.interfaces}/>
+<DocDefinitionList data={kbnReportingPublicObj.client.interfaces}/>
 
diff --git a/api_docs/kbn_reporting_server.devdocs.json b/api_docs/kbn_reporting_server.devdocs.json
new file mode 100644
index 00000000000000..f2c2ef84cfa8c6
--- /dev/null
+++ b/api_docs/kbn_reporting_server.devdocs.json
@@ -0,0 +1,1972 @@
+{
+  "id": "@kbn/reporting-server",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.ExportType",
+        "type": "Class",
+        "tags": [],
+        "label": "ExportType",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ExportType",
+            "text": "ExportType"
+          },
+          "<JobParamsType, TaskPayloadType, SetupDepsType, StartDepsType>"
+        ],
+        "path": "packages/kbn-reporting/server/export_type.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.name",
+            "type": "string",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.jobType",
+            "type": "string",
+            "tags": [],
+            "label": "jobType",
+            "description": [],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.jobContentEncoding",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "jobContentEncoding",
+            "description": [],
+            "signature": [
+              "\"base64\" | \"csv\" | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.jobContentExtension",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "jobContentExtension",
+            "description": [],
+            "signature": [
+              "\"csv\" | \"png\" | \"pdf\""
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.createJob",
+            "type": "Function",
+            "tags": [],
+            "label": "createJob",
+            "description": [],
+            "signature": [
+              "(jobParams: JobParamsType, context: ",
+              {
+                "pluginId": "@kbn/core-http-request-handler-context-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpRequestHandlerContextServerPluginApi",
+                "section": "def-common.CustomRequestHandlerContext",
+                "text": "CustomRequestHandlerContext"
+              },
+              "<{ reporting: ",
+              {
+                "pluginId": "@kbn/reporting-server",
+                "scope": "server",
+                "docId": "kibKbnReportingServerPluginApi",
+                "section": "def-server.ReportingServerPluginSetup",
+                "text": "ReportingServerPluginSetup"
+              },
+              " | null; }>, req: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>) => Promise<Omit<",
+              "BasePayload",
+              ", \"spaceId\" | \"headers\">>"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.createJob.$1",
+                "type": "Uncategorized",
+                "tags": [],
+                "label": "jobParams",
+                "description": [],
+                "signature": [
+                  "JobParamsType"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.createJob.$2",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-request-handler-context-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpRequestHandlerContextServerPluginApi",
+                    "section": "def-common.RequestHandlerContext",
+                    "text": "RequestHandlerContext"
+                  },
+                  " & { reporting: Promise<",
+                  {
+                    "pluginId": "@kbn/reporting-server",
+                    "scope": "server",
+                    "docId": "kibKbnReportingServerPluginApi",
+                    "section": "def-server.ReportingServerPluginSetup",
+                    "text": "ReportingServerPluginSetup"
+                  },
+                  " | null>; }"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.createJob.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "req",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpServerPluginApi",
+                    "section": "def-common.KibanaRequest",
+                    "text": "KibanaRequest"
+                  },
+                  "<unknown, unknown, unknown, any>"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.runTask",
+            "type": "Function",
+            "tags": [],
+            "label": "runTask",
+            "description": [],
+            "signature": [
+              "(jobId: string, payload: TaskPayloadType, cancellationToken: ",
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              },
+              ", stream: ",
+              "Writable",
+              ") => Promise<",
+              "TaskRunResult",
+              ">"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.runTask.$1",
+                "type": "string",
+                "tags": [],
+                "label": "jobId",
+                "description": [],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.runTask.$2",
+                "type": "Uncategorized",
+                "tags": [],
+                "label": "payload",
+                "description": [],
+                "signature": [
+                  "TaskPayloadType"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.runTask.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "cancellationToken",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-common",
+                    "scope": "common",
+                    "docId": "kibKbnReportingCommonPluginApi",
+                    "section": "def-common.CancellationToken",
+                    "text": "CancellationToken"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.runTask.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "stream",
+                "description": [],
+                "signature": [
+                  "Writable"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.validLicenses",
+            "type": "Array",
+            "tags": [],
+            "label": "validLicenses",
+            "description": [],
+            "signature": [
+              "(\"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\")[]"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.setupDeps",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "setupDeps",
+            "description": [],
+            "signature": [
+              "SetupDepsType"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.startDeps",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "startDeps",
+            "description": [],
+            "signature": [
+              "StartDepsType"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.http",
+            "type": "Object",
+            "tags": [],
+            "label": "http",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.HttpServiceSetup",
+                "text": "HttpServiceSetup"
+              },
+              "<",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.RequestHandlerContextBase",
+                "text": "RequestHandlerContextBase"
+              },
+              ">"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.Unnamed.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "core",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-lifecycle-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreLifecycleServerPluginApi",
+                    "section": "def-common.CoreSetup",
+                    "text": "CoreSetup"
+                  },
+                  "<object, unknown>"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.Unnamed.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "config",
+                "description": [],
+                "signature": [
+                  "Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.Unnamed.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "logger",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.Unnamed.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "context",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-plugins-server",
+                    "scope": "common",
+                    "docId": "kibKbnCorePluginsServerPluginApi",
+                    "section": "def-common.PluginInitializerContext",
+                    "text": "PluginInitializerContext"
+                  },
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  {
+                    "pluginId": "@kbn/config-schema",
+                    "scope": "common",
+                    "docId": "kibKbnConfigSchemaPluginApi",
+                    "section": "def-common.ByteSizeValue",
+                    "text": "ByteSizeValue"
+                  },
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>>"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.setup",
+            "type": "Function",
+            "tags": [],
+            "label": "setup",
+            "description": [],
+            "signature": [
+              "(setupDeps: SetupDepsType) => void"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.setup.$1",
+                "type": "Uncategorized",
+                "tags": [],
+                "label": "setupDeps",
+                "description": [],
+                "signature": [
+                  "SetupDepsType"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.start",
+            "type": "Function",
+            "tags": [],
+            "label": "start",
+            "description": [],
+            "signature": [
+              "(startDeps: StartDepsType) => void"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.start.$1",
+                "type": "Uncategorized",
+                "tags": [],
+                "label": "startDeps",
+                "description": [],
+                "signature": [
+                  "StartDepsType"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.getUiSettingsServiceFactory",
+            "type": "Function",
+            "tags": [],
+            "label": "getUiSettingsServiceFactory",
+            "description": [],
+            "signature": [
+              "(savedObjectsClient: ",
+              {
+                "pluginId": "@kbn/core-saved-objects-api-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsApiServerPluginApi",
+                "section": "def-common.SavedObjectsClientContract",
+                "text": "SavedObjectsClientContract"
+              },
+              ") => ",
+              {
+                "pluginId": "@kbn/core-ui-settings-server",
+                "scope": "common",
+                "docId": "kibKbnCoreUiSettingsServerPluginApi",
+                "section": "def-common.IUiSettingsClient",
+                "text": "IUiSettingsClient"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getUiSettingsServiceFactory.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "savedObjectsClient",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-saved-objects-api-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreSavedObjectsApiServerPluginApi",
+                    "section": "def-common.SavedObjectsClientContract",
+                    "text": "SavedObjectsClientContract"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.getUiSettingsClient",
+            "type": "Function",
+            "tags": [],
+            "label": "getUiSettingsClient",
+            "description": [],
+            "signature": [
+              "(request: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>, logger?: ",
+              {
+                "pluginId": "@kbn/logging",
+                "scope": "common",
+                "docId": "kibKbnLoggingPluginApi",
+                "section": "def-common.Logger",
+                "text": "Logger"
+              },
+              ") => Promise<",
+              {
+                "pluginId": "@kbn/core-ui-settings-server",
+                "scope": "common",
+                "docId": "kibKbnCoreUiSettingsServerPluginApi",
+                "section": "def-common.IUiSettingsClient",
+                "text": "IUiSettingsClient"
+              },
+              ">"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getUiSettingsClient.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "request",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpServerPluginApi",
+                    "section": "def-common.KibanaRequest",
+                    "text": "KibanaRequest"
+                  },
+                  "<unknown, unknown, unknown, any>"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getUiSettingsClient.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "logger",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.getFakeRequest",
+            "type": "Function",
+            "tags": [],
+            "label": "getFakeRequest",
+            "description": [],
+            "signature": [
+              "(headers: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.Headers",
+                "text": "Headers"
+              },
+              ", spaceId: string | undefined, logger?: ",
+              {
+                "pluginId": "@kbn/logging",
+                "scope": "common",
+                "docId": "kibKbnLoggingPluginApi",
+                "section": "def-common.Logger",
+                "text": "Logger"
+              },
+              ") => ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getFakeRequest.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "headers",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-http-server",
+                    "scope": "common",
+                    "docId": "kibKbnCoreHttpServerPluginApi",
+                    "section": "def-common.Headers",
+                    "text": "Headers"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getFakeRequest.$2",
+                "type": "string",
+                "tags": [],
+                "label": "spaceId",
+                "description": [],
+                "signature": [
+                  "string | undefined"
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              },
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ExportType.getFakeRequest.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "logger",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/logging",
+                    "scope": "common",
+                    "docId": "kibKbnLoggingPluginApi",
+                    "section": "def-common.Logger",
+                    "text": "Logger"
+                  }
+                ],
+                "path": "packages/kbn-reporting/server/export_type.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ExportType.getServerInfo",
+            "type": "Function",
+            "tags": [],
+            "label": "getServerInfo",
+            "description": [],
+            "signature": [
+              "() => ",
+              "ReportingServerInfo"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.cryptoFactory",
+        "type": "Function",
+        "tags": [],
+        "label": "cryptoFactory",
+        "description": [],
+        "signature": [
+          "(encryptionKey: string | undefined) => ",
+          "Crypto"
+        ],
+        "path": "packages/kbn-reporting/server/crypto.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.cryptoFactory.$1",
+            "type": "string",
+            "tags": [],
+            "label": "encryptionKey",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/crypto.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.decryptJobHeaders",
+        "type": "Function",
+        "tags": [],
+        "label": "decryptJobHeaders",
+        "description": [],
+        "signature": [
+          "(encryptionKey: string | undefined, headers: string, logger: ",
+          {
+            "pluginId": "@kbn/logging",
+            "scope": "common",
+            "docId": "kibKbnLoggingPluginApi",
+            "section": "def-common.Logger",
+            "text": "Logger"
+          },
+          ") => Promise<Record<string, string>>"
+        ],
+        "path": "packages/kbn-reporting/server/decrypt_job_headers.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.decryptJobHeaders.$1",
+            "type": "string",
+            "tags": [],
+            "label": "encryptionKey",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/decrypt_job_headers.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.decryptJobHeaders.$2",
+            "type": "string",
+            "tags": [],
+            "label": "headers",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "packages/kbn-reporting/server/decrypt_job_headers.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.decryptJobHeaders.$3",
+            "type": "Object",
+            "tags": [],
+            "label": "logger",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/logging",
+                "scope": "common",
+                "docId": "kibKbnLoggingPluginApi",
+                "section": "def-common.Logger",
+                "text": "Logger"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/decrypt_job_headers.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.getFieldFormats",
+        "type": "Function",
+        "tags": [],
+        "label": "getFieldFormats",
+        "description": [],
+        "signature": [
+          "() => ",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "server",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-server.FieldFormatsStart",
+            "text": "FieldFormatsStart"
+          }
+        ],
+        "path": "packages/kbn-reporting/server/services.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.getFullRedirectAppUrl",
+        "type": "Function",
+        "tags": [],
+        "label": "getFullRedirectAppUrl",
+        "description": [],
+        "signature": [
+          "(config: Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>, serverInfo: ",
+          "ReportingServerInfo",
+          ", spaceId: string | undefined, forceNow: string | undefined) => string"
+        ],
+        "path": "packages/kbn-reporting/server/get_full_redirect_app_url.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.getFullRedirectAppUrl.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "config",
+            "description": [],
+            "signature": [
+              "Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; capture: Readonly<{} & { maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+              {
+                "pluginId": "@kbn/config-schema",
+                "scope": "common",
+                "docId": "kibKbnConfigSchemaPluginApi",
+                "section": "def-common.ByteSizeValue",
+                "text": "ByteSizeValue"
+              },
+              "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; statefulSettings: Readonly<{} & { enabled: boolean; }>; }>"
+            ],
+            "path": "packages/kbn-reporting/server/get_full_redirect_app_url.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.getFullRedirectAppUrl.$2",
+            "type": "Object",
+            "tags": [],
+            "label": "serverInfo",
+            "description": [],
+            "signature": [
+              "ReportingServerInfo"
+            ],
+            "path": "packages/kbn-reporting/server/get_full_redirect_app_url.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.getFullRedirectAppUrl.$3",
+            "type": "string",
+            "tags": [],
+            "label": "spaceId",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/get_full_redirect_app_url.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.getFullRedirectAppUrl.$4",
+            "type": "string",
+            "tags": [],
+            "label": "forceNow",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/get_full_redirect_app_url.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": false
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.setFieldFormats",
+        "type": "Function",
+        "tags": [],
+        "label": "setFieldFormats",
+        "description": [],
+        "signature": [
+          "(value: ",
+          {
+            "pluginId": "fieldFormats",
+            "scope": "server",
+            "docId": "kibFieldFormatsPluginApi",
+            "section": "def-server.FieldFormatsStart",
+            "text": "FieldFormatsStart"
+          },
+          ") => void"
+        ],
+        "path": "packages/kbn-reporting/server/services.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.setFieldFormats.$1",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "value",
+            "description": [],
+            "signature": [
+              "T"
+            ],
+            "path": "src/plugins/kibana_utils/common/create_getter_setter.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.BaseExportTypeSetupDeps",
+        "type": "Interface",
+        "tags": [],
+        "label": "BaseExportTypeSetupDeps",
+        "description": [],
+        "path": "packages/kbn-reporting/server/export_type.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeSetupDeps.basePath",
+            "type": "Object",
+            "tags": [],
+            "label": "basePath",
+            "description": [],
+            "signature": [
+              "{ set: (request: ",
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>, requestSpecificBasePath: string) => void; }"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeSetupDeps.spaces",
+            "type": "Object",
+            "tags": [],
+            "label": "spaces",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "spaces",
+                "scope": "server",
+                "docId": "kibSpacesPluginApi",
+                "section": "def-server.SpacesPluginSetup",
+                "text": "SpacesPluginSetup"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.BaseExportTypeStartDeps",
+        "type": "Interface",
+        "tags": [],
+        "label": "BaseExportTypeStartDeps",
+        "description": [],
+        "path": "packages/kbn-reporting/server/export_type.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeStartDeps.savedObjects",
+            "type": "Object",
+            "tags": [],
+            "label": "savedObjects",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsServiceStart",
+                "text": "SavedObjectsServiceStart"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeStartDeps.uiSettings",
+            "type": "Object",
+            "tags": [],
+            "label": "uiSettings",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-ui-settings-server",
+                "scope": "common",
+                "docId": "kibKbnCoreUiSettingsServerPluginApi",
+                "section": "def-common.UiSettingsServiceStart",
+                "text": "UiSettingsServiceStart"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeStartDeps.esClient",
+            "type": "Object",
+            "tags": [],
+            "label": "esClient",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-elasticsearch-server",
+                "scope": "common",
+                "docId": "kibKbnCoreElasticsearchServerPluginApi",
+                "section": "def-common.IClusterClient",
+                "text": "IClusterClient"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.BaseExportTypeStartDeps.screenshotting",
+            "type": "Object",
+            "tags": [],
+            "label": "screenshotting",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "screenshotting",
+                "scope": "server",
+                "docId": "kibScreenshottingPluginApi",
+                "section": "def-server.ScreenshottingStart",
+                "text": "ScreenshottingStart"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/export_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.ReportingServerPluginSetup",
+        "type": "Interface",
+        "tags": [],
+        "label": "ReportingServerPluginSetup",
+        "description": [],
+        "path": "packages/kbn-reporting/server/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ReportingServerPluginSetup.registerExportTypes",
+            "type": "Function",
+            "tags": [],
+            "label": "registerExportTypes",
+            "description": [],
+            "signature": [
+              "(item: ",
+              {
+                "pluginId": "@kbn/reporting-server",
+                "scope": "server",
+                "docId": "kibKbnReportingServerPluginApi",
+                "section": "def-server.ExportType",
+                "text": "ExportType"
+              },
+              "<any, any, ",
+              {
+                "pluginId": "@kbn/reporting-server",
+                "scope": "server",
+                "docId": "kibKbnReportingServerPluginApi",
+                "section": "def-server.BaseExportTypeSetupDeps",
+                "text": "BaseExportTypeSetupDeps"
+              },
+              ", ",
+              {
+                "pluginId": "@kbn/reporting-server",
+                "scope": "server",
+                "docId": "kibKbnReportingServerPluginApi",
+                "section": "def-server.BaseExportTypeStartDeps",
+                "text": "BaseExportTypeStartDeps"
+              },
+              ">) => void"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/reporting-server",
+                "id": "def-server.ReportingServerPluginSetup.registerExportTypes.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "item",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/reporting-server",
+                    "scope": "server",
+                    "docId": "kibKbnReportingServerPluginApi",
+                    "section": "def-server.ExportType",
+                    "text": "ExportType"
+                  },
+                  "<any, any, ",
+                  {
+                    "pluginId": "@kbn/reporting-server",
+                    "scope": "server",
+                    "docId": "kibKbnReportingServerPluginApi",
+                    "section": "def-server.BaseExportTypeSetupDeps",
+                    "text": "BaseExportTypeSetupDeps"
+                  },
+                  ", ",
+                  {
+                    "pluginId": "@kbn/reporting-server",
+                    "scope": "server",
+                    "docId": "kibKbnReportingServerPluginApi",
+                    "section": "def-server.BaseExportTypeStartDeps",
+                    "text": "BaseExportTypeStartDeps"
+                  },
+                  ">"
+                ],
+                "path": "packages/kbn-reporting/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.ReportingServerPluginSetup.usesUiCapabilities",
+            "type": "Function",
+            "tags": [],
+            "label": "usesUiCapabilities",
+            "description": [
+              "\nUsed to inform plugins if Reporting config is compatible with UI Capabilities / Application Sub-Feature Controls"
+            ],
+            "signature": [
+              "() => boolean"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.TimeRangeParams",
+        "type": "Interface",
+        "tags": [],
+        "label": "TimeRangeParams",
+        "description": [],
+        "path": "packages/kbn-reporting/server/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.TimeRangeParams.min",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "min",
+            "description": [],
+            "signature": [
+              "string | number | Date | null | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.TimeRangeParams.max",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "max",
+            "description": [],
+            "signature": [
+              "string | number | Date | null | undefined"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.CreateJobFn",
+        "type": "Type",
+        "tags": [],
+        "label": "CreateJobFn",
+        "description": [],
+        "signature": [
+          "(jobParams: JobParamsType, context: ",
+          {
+            "pluginId": "@kbn/core-http-request-handler-context-server",
+            "scope": "common",
+            "docId": "kibKbnCoreHttpRequestHandlerContextServerPluginApi",
+            "section": "def-common.CustomRequestHandlerContext",
+            "text": "CustomRequestHandlerContext"
+          },
+          "<{ reporting: ",
+          {
+            "pluginId": "@kbn/reporting-server",
+            "scope": "server",
+            "docId": "kibKbnReportingServerPluginApi",
+            "section": "def-server.ReportingServerPluginSetup",
+            "text": "ReportingServerPluginSetup"
+          },
+          " | null; }>, req: ",
+          {
+            "pluginId": "@kbn/core-http-server",
+            "scope": "common",
+            "docId": "kibKbnCoreHttpServerPluginApi",
+            "section": "def-common.KibanaRequest",
+            "text": "KibanaRequest"
+          },
+          "<unknown, unknown, unknown, any>) => Promise<Omit<JobPayloadType, \"spaceId\" | \"headers\">>"
+        ],
+        "path": "packages/kbn-reporting/server/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.CreateJobFn.$1",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "jobParams",
+            "description": [],
+            "signature": [
+              "JobParamsType"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.CreateJobFn.$2",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "context",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-http-request-handler-context-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpRequestHandlerContextServerPluginApi",
+                "section": "def-common.RequestHandlerContext",
+                "text": "RequestHandlerContext"
+              },
+              " & { reporting: Promise<",
+              {
+                "pluginId": "@kbn/reporting-server",
+                "scope": "server",
+                "docId": "kibKbnReportingServerPluginApi",
+                "section": "def-server.ReportingServerPluginSetup",
+                "text": "ReportingServerPluginSetup"
+              },
+              " | null>; }"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.CreateJobFn.$3",
+            "type": "Object",
+            "tags": [],
+            "label": "req",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/core-http-server",
+                "scope": "common",
+                "docId": "kibKbnCoreHttpServerPluginApi",
+                "section": "def-common.KibanaRequest",
+                "text": "KibanaRequest"
+              },
+              "<unknown, unknown, unknown, any>"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.ReportingConfigType",
+        "type": "Type",
+        "tags": [],
+        "label": "ReportingConfigType",
+        "description": [],
+        "signature": [
+          "{ readonly encryptionKey?: string | undefined; readonly enabled: boolean; readonly capture: Readonly<{} & { maxAttempts: number; }>; readonly kibanaServer: Readonly<{ hostname?: string | undefined; protocol?: string | undefined; port?: number | undefined; } & {}>; readonly queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; readonly csv: Readonly<{} & { scroll: Readonly<{} & { duration: string; size: number; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          "; useByteOrderMarkEncoding: boolean; }>; readonly roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; readonly poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; readonly export_types: Readonly<{} & { csv: Readonly<{} & { enabled: boolean; }>; png: Readonly<{} & { enabled: boolean; }>; pdf: Readonly<{} & { enabled: boolean; }>; }>; readonly statefulSettings: Readonly<{} & { enabled: boolean; }>; }"
+        ],
+        "path": "packages/kbn-reporting/server/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.RunTaskFn",
+        "type": "Type",
+        "tags": [],
+        "label": "RunTaskFn",
+        "description": [],
+        "signature": [
+          "(jobId: string, payload: TaskPayloadType, cancellationToken: ",
+          {
+            "pluginId": "@kbn/reporting-common",
+            "scope": "common",
+            "docId": "kibKbnReportingCommonPluginApi",
+            "section": "def-common.CancellationToken",
+            "text": "CancellationToken"
+          },
+          ", stream: ",
+          "Writable",
+          ") => Promise<",
+          "TaskRunResult",
+          ">"
+        ],
+        "path": "packages/kbn-reporting/server/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "returnComment": [],
+        "children": [
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.RunTaskFn.$1",
+            "type": "string",
+            "tags": [],
+            "label": "jobId",
+            "description": [],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.RunTaskFn.$2",
+            "type": "Uncategorized",
+            "tags": [],
+            "label": "payload",
+            "description": [],
+            "signature": [
+              "TaskPayloadType"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.RunTaskFn.$3",
+            "type": "Object",
+            "tags": [],
+            "label": "cancellationToken",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/reporting-common",
+                "scope": "common",
+                "docId": "kibKbnReportingCommonPluginApi",
+                "section": "def-common.CancellationToken",
+                "text": "CancellationToken"
+              }
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/reporting-server",
+            "id": "def-server.RunTaskFn.$4",
+            "type": "Object",
+            "tags": [],
+            "label": "stream",
+            "description": [],
+            "signature": [
+              "Writable"
+            ],
+            "path": "packages/kbn-reporting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "objects": [
+      {
+        "parentPluginId": "@kbn/reporting-server",
+        "id": "def-server.ConfigSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "ConfigSchema",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; kibanaServer: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ hostname: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<string | undefined>; port: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number | undefined>; protocol: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<string | undefined>; }>; queue: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ indexInterval: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<string>; pollEnabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; pollInterval: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number | moment.Duration>; pollIntervalErrorMultiplier: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; timeout: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number | moment.Duration>; }>; capture: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ maxAttempts: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, number, number>; }>; csv: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ checkForFormulas: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; escapeFormulaValues: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; enablePanelActionDownload: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; maxSizeBytes: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number | ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ByteSizeValue",
+            "text": "ByteSizeValue"
+          },
+          ">; useByteOrderMarkEncoding: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; scroll: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ duration: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<string>; size: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; }>; }>; encryptionKey: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, string | undefined, string>; roles: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, boolean, boolean>; allow: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, string[], string[]>; }>; poll: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ jobCompletionNotifier: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ interval: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; intervalErrorMultiplier: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; }>; jobsRefresh: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ interval: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; intervalErrorMultiplier: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<number>; }>; }>; export_types: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ csv: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.Type",
+            "text": "Type"
+          },
+          "<boolean>; }>; png: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, boolean, boolean>; }>; pdf: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, boolean, boolean>; }>; }>; statefulSettings: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ObjectType",
+            "text": "ObjectType"
+          },
+          "<{ enabled: ",
+          {
+            "pluginId": "@kbn/config-schema",
+            "scope": "common",
+            "docId": "kibKbnConfigSchemaPluginApi",
+            "section": "def-common.ConditionalType",
+            "text": "ConditionalType"
+          },
+          "<true, boolean, boolean>; }>; }>"
+        ],
+        "path": "packages/kbn-reporting/server/config_schema.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ]
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_reporting_server.mdx b/api_docs/kbn_reporting_server.mdx
new file mode 100644
index 00000000000000..d3e6352855a00f
--- /dev/null
+++ b/api_docs/kbn_reporting_server.mdx
@@ -0,0 +1,42 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnReportingServerPluginApi
+slug: /kibana-dev-docs/api/kbn-reporting-server
+title: "@kbn/reporting-server"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/reporting-server plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-server']
+---
+import kbnReportingServerObj from './kbn_reporting_server.devdocs.json';
+
+
+
+Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 78 | 0 | 77 | 0 |
+
+## Server
+
+### Objects
+<DocDefinitionList data={kbnReportingServerObj.server.objects}/>
+
+### Functions
+<DocDefinitionList data={kbnReportingServerObj.server.functions}/>
+
+### Classes
+<DocDefinitionList data={kbnReportingServerObj.server.classes}/>
+
+### Interfaces
+<DocDefinitionList data={kbnReportingServerObj.server.interfaces}/>
+
+### Consts, variables and types
+<DocDefinitionList data={kbnReportingServerObj.server.misc}/>
+
diff --git a/api_docs/kbn_resizable_layout.mdx b/api_docs/kbn_resizable_layout.mdx
index ce646a218bec63..a99eafa2538ebf 100644
--- a/api_docs/kbn_resizable_layout.mdx
+++ b/api_docs/kbn_resizable_layout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-resizable-layout
 title: "@kbn/resizable-layout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/resizable-layout plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/resizable-layout']
 ---
 import kbnResizableLayoutObj from './kbn_resizable_layout.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index 6675f7b7a2676c..e7cf47e62c84e4 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_rrule.mdx b/api_docs/kbn_rrule.mdx
index abc9f781b2569d..c93ae48160847f 100644
--- a/api_docs/kbn_rrule.mdx
+++ b/api_docs/kbn_rrule.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rrule
 title: "@kbn/rrule"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rrule plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rrule']
 ---
 import kbnRruleObj from './kbn_rrule.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.devdocs.json b/api_docs/kbn_rule_data_utils.devdocs.json
index f721e756a60e20..249759a3164fc3 100644
--- a/api_docs/kbn_rule_data_utils.devdocs.json
+++ b/api_docs/kbn_rule_data_utils.devdocs.json
@@ -1429,7 +1429,7 @@
         "label": "AlertConsumers",
         "description": [],
         "signature": [
-          "\"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
+          "\"ml\" | \"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
         ],
         "path": "packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts",
         "deprecated": false,
@@ -1699,7 +1699,7 @@
         "label": "TechnicalRuleDataFieldName",
         "description": [],
         "signature": [
-          "\"@timestamp\" | \"event.action\" | \"tags\" | \"kibana\" | \"kibana.alert.rule.rule_type_id\" | \"kibana.alert.rule.consumer\" | \"kibana.alert.rule.execution.uuid\" | \"kibana.alert.instance.id\" | \"kibana.alert.rule.category\" | \"kibana.alert.rule.name\" | \"kibana.alert.rule.producer\" | \"kibana.alert.rule.uuid\" | \"kibana.alert.status\" | \"kibana.alert.uuid\" | \"kibana.space_ids\" | \"event.kind\" | \"kibana.alert.action_group\" | \"kibana.alert.case_ids\" | \"kibana.alert.duration.us\" | \"kibana.alert.end\" | \"kibana.alert.flapping\" | \"kibana.alert.maintenance_window_ids\" | \"kibana.alert.reason\" | \"kibana.alert.rule.parameters\" | \"kibana.alert.rule.tags\" | \"kibana.alert.start\" | \"kibana.alert.time_range\" | \"kibana.alert.workflow_status\" | \"kibana.alert.workflow_tags\" | \"kibana.version\" | \"kibana.alert\" | \"kibana.alert.rule\" | \"kibana.alert.risk_score\" | \"kibana.alert.rule.author\" | \"kibana.alert.rule.created_at\" | \"kibana.alert.rule.created_by\" | \"kibana.alert.rule.description\" | \"kibana.alert.rule.enabled\" | \"kibana.alert.rule.from\" | \"kibana.alert.rule.interval\" | \"kibana.alert.rule.license\" | \"kibana.alert.rule.note\" | \"kibana.alert.rule.references\" | \"kibana.alert.rule.rule_id\" | \"kibana.alert.rule.rule_name_override\" | \"kibana.alert.rule.to\" | \"kibana.alert.rule.type\" | \"kibana.alert.rule.updated_at\" | \"kibana.alert.rule.updated_by\" | \"kibana.alert.rule.version\" | \"kibana.alert.severity\" | \"kibana.alert.suppression.docs_count\" | \"kibana.alert.suppression.end\" | \"kibana.alert.suppression.terms\" | \"kibana.alert.suppression.terms.field\" | \"kibana.alert.suppression.start\" | \"kibana.alert.suppression.terms.value\" | \"kibana.alert.system_status\" | \"kibana.alert.workflow_reason\" | \"kibana.alert.workflow_user\" | \"ecs.version\" | \"kibana.alert.evaluation.threshold\" | \"kibana.alert.evaluation.value\" | \"kibana.alert.context\" | \"kibana.alert.evaluation.values\" | \"kibana.alert.group\" | \"kibana.alert.group.field\" | \"kibana.alert.group.value\" | \"event.module\" | \"kibana.alert.building_block_type\" | \"kibana.alert.rule.exceptions_list\" | \"kibana.alert.rule.namespace\" | \"kibana.alert.rule.threat.framework\" | \"kibana.alert.rule.threat.tactic.id\" | \"kibana.alert.rule.threat.tactic.name\" | \"kibana.alert.rule.threat.tactic.reference\" | \"kibana.alert.rule.threat.technique.id\" | \"kibana.alert.rule.threat.technique.name\" | \"kibana.alert.rule.threat.technique.reference\" | \"kibana.alert.rule.threat.technique.subtechnique.id\" | \"kibana.alert.rule.threat.technique.subtechnique.name\" | \"kibana.alert.rule.threat.technique.subtechnique.reference\""
+          "\"@timestamp\" | \"event.action\" | \"tags\" | \"kibana\" | \"kibana.alert.rule.rule_type_id\" | \"kibana.alert.rule.consumer\" | \"kibana.alert.rule.execution.uuid\" | \"kibana.alert.instance.id\" | \"kibana.alert.rule.category\" | \"kibana.alert.rule.name\" | \"kibana.alert.rule.producer\" | \"kibana.alert.rule.uuid\" | \"kibana.alert.status\" | \"kibana.alert.uuid\" | \"kibana.space_ids\" | \"event.kind\" | \"kibana.alert.action_group\" | \"kibana.alert.case_ids\" | \"kibana.alert.duration.us\" | \"kibana.alert.end\" | \"kibana.alert.flapping\" | \"kibana.alert.maintenance_window_ids\" | \"kibana.alert.reason\" | \"kibana.alert.rule.parameters\" | \"kibana.alert.rule.tags\" | \"kibana.alert.start\" | \"kibana.alert.time_range\" | \"kibana.alert.workflow_status\" | \"kibana.alert.workflow_tags\" | \"kibana.version\" | \"kibana.alert.context\" | \"kibana.alert.evaluation.threshold\" | \"kibana.alert.evaluation.value\" | \"kibana.alert.evaluation.values\" | \"kibana.alert.group\" | \"ecs.version\" | \"kibana.alert.risk_score\" | \"kibana.alert.rule.author\" | \"kibana.alert.rule.created_at\" | \"kibana.alert.rule.created_by\" | \"kibana.alert.rule.description\" | \"kibana.alert.rule.enabled\" | \"kibana.alert.rule.from\" | \"kibana.alert.rule.interval\" | \"kibana.alert.rule.license\" | \"kibana.alert.rule.note\" | \"kibana.alert.rule.references\" | \"kibana.alert.rule.rule_id\" | \"kibana.alert.rule.rule_name_override\" | \"kibana.alert.rule.to\" | \"kibana.alert.rule.type\" | \"kibana.alert.rule.updated_at\" | \"kibana.alert.rule.updated_by\" | \"kibana.alert.rule.version\" | \"kibana.alert.severity\" | \"kibana.alert.suppression.docs_count\" | \"kibana.alert.suppression.end\" | \"kibana.alert.suppression.start\" | \"kibana.alert.suppression.terms.field\" | \"kibana.alert.suppression.terms.value\" | \"kibana.alert.system_status\" | \"kibana.alert.workflow_reason\" | \"kibana.alert.workflow_user\" | \"event.module\" | \"kibana.alert.rule.threat.framework\" | \"kibana.alert.rule.threat.tactic.id\" | \"kibana.alert.rule.threat.tactic.name\" | \"kibana.alert.rule.threat.tactic.reference\" | \"kibana.alert.rule.threat.technique.id\" | \"kibana.alert.rule.threat.technique.name\" | \"kibana.alert.rule.threat.technique.reference\" | \"kibana.alert.rule.threat.technique.subtechnique.id\" | \"kibana.alert.rule.threat.technique.subtechnique.name\" | \"kibana.alert.rule.threat.technique.subtechnique.reference\" | \"kibana.alert.building_block_type\" | \"kibana.alert\" | \"kibana.alert.rule\" | \"kibana.alert.suppression.terms\" | \"kibana.alert.group.field\" | \"kibana.alert.group.value\" | \"kibana.alert.rule.exceptions_list\" | \"kibana.alert.rule.namespace\""
         ],
         "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
         "deprecated": false,
@@ -1744,7 +1744,7 @@
         "label": "ValidFeatureId",
         "description": [],
         "signature": [
-          "\"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
+          "\"ml\" | \"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
         ],
         "path": "packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts",
         "deprecated": false,
@@ -1793,7 +1793,7 @@
           "\nregistering a new instance of the rule data client\nin a new plugin will require updating the below data structure\nto include the index name where the alerts as data will be written to."
         ],
         "signature": [
-          "{ readonly APM: \"apm\"; readonly LOGS: \"logs\"; readonly INFRASTRUCTURE: \"infrastructure\"; readonly OBSERVABILITY: \"observability\"; readonly SLO: \"slo\"; readonly SIEM: \"siem\"; readonly UPTIME: \"uptime\"; }"
+          "{ readonly APM: \"apm\"; readonly LOGS: \"logs\"; readonly INFRASTRUCTURE: \"infrastructure\"; readonly OBSERVABILITY: \"observability\"; readonly SLO: \"slo\"; readonly SIEM: \"siem\"; readonly UPTIME: \"uptime\"; readonly ML: \"ml\"; }"
         ],
         "path": "packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts",
         "deprecated": false,
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index 57322a84712a52..d542afec010cbb 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
diff --git a/api_docs/kbn_saved_objects_settings.mdx b/api_docs/kbn_saved_objects_settings.mdx
index f8812a5f99a073..3c377155867d45 100644
--- a/api_docs/kbn_saved_objects_settings.mdx
+++ b/api_docs/kbn_saved_objects_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-saved-objects-settings
 title: "@kbn/saved-objects-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/saved-objects-settings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/saved-objects-settings']
 ---
 import kbnSavedObjectsSettingsObj from './kbn_saved_objects_settings.devdocs.json';
diff --git a/api_docs/kbn_search_api_panels.devdocs.json b/api_docs/kbn_search_api_panels.devdocs.json
index 52bb065a5c52b8..8558d593d42907 100644
--- a/api_docs/kbn_search_api_panels.devdocs.json
+++ b/api_docs/kbn_search_api_panels.devdocs.json
@@ -460,7 +460,7 @@
         "label": "SelectClientPanel",
         "description": [],
         "signature": [
-          "({ docLinks, children, http, isPanelLeft, overviewPanelProps, }: React.PropsWithChildren<",
+          "({ docLinks, children, http, isPanelLeft, overviewPanelProps, callout, }: React.PropsWithChildren<",
           {
             "pluginId": "@kbn/search-api-panels",
             "scope": "common",
@@ -479,7 +479,7 @@
             "id": "def-common.SelectClientPanel.$1",
             "type": "CompoundType",
             "tags": [],
-            "label": "{\n  docLinks,\n  children,\n  http,\n  isPanelLeft = true,\n  overviewPanelProps,\n}",
+            "label": "{\n  docLinks,\n  children,\n  http,\n  isPanelLeft = true,\n  overviewPanelProps,\n  callout,\n}",
             "description": [],
             "signature": [
               "React.PropsWithChildren<",
@@ -1042,6 +1042,20 @@
             "path": "packages/kbn-search-api-panels/components/select_client.tsx",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/search-api-panels",
+            "id": "def-common.SelectClientPanelProps.callout",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "callout",
+            "description": [],
+            "signature": [
+              "boolean | React.ReactChild | React.ReactFragment | React.ReactPortal | null | undefined"
+            ],
+            "path": "packages/kbn-search-api-panels/components/select_client.tsx",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/kbn_search_api_panels.mdx b/api_docs/kbn_search_api_panels.mdx
index 4d5bb7c6ee285a..d9f68be0e350d2 100644
--- a/api_docs/kbn_search_api_panels.mdx
+++ b/api_docs/kbn_search_api_panels.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-api-panels
 title: "@kbn/search-api-panels"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-api-panels plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-api-panels']
 ---
 import kbnSearchApiPanelsObj from './kbn_search_api_panels.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/te
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 68 | 0 | 68 | 0 |
+| 69 | 0 | 69 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_search_connectors.mdx b/api_docs/kbn_search_connectors.mdx
index b54f6751fc94ff..c76aff70b345ba 100644
--- a/api_docs/kbn_search_connectors.mdx
+++ b/api_docs/kbn_search_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-connectors
 title: "@kbn/search-connectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-connectors plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-connectors']
 ---
 import kbnSearchConnectorsObj from './kbn_search_connectors.devdocs.json';
diff --git a/api_docs/kbn_search_response_warnings.mdx b/api_docs/kbn_search_response_warnings.mdx
index 717727a6f8abac..945b2ae3e6997e 100644
--- a/api_docs/kbn_search_response_warnings.mdx
+++ b/api_docs/kbn_search_response_warnings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-response-warnings
 title: "@kbn/search-response-warnings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-response-warnings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-response-warnings']
 ---
 import kbnSearchResponseWarningsObj from './kbn_search_response_warnings.devdocs.json';
diff --git a/api_docs/kbn_security_solution_features.mdx b/api_docs/kbn_security_solution_features.mdx
index 40f2ec9326b91d..acfe12918e43a2 100644
--- a/api_docs/kbn_security_solution_features.mdx
+++ b/api_docs/kbn_security_solution_features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-features
 title: "@kbn/security-solution-features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-features plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-features']
 ---
 import kbnSecuritySolutionFeaturesObj from './kbn_security_solution_features.devdocs.json';
diff --git a/api_docs/kbn_security_solution_navigation.mdx b/api_docs/kbn_security_solution_navigation.mdx
index f1ea786251d028..83314b028e90ce 100644
--- a/api_docs/kbn_security_solution_navigation.mdx
+++ b/api_docs/kbn_security_solution_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-navigation
 title: "@kbn/security-solution-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-navigation plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-navigation']
 ---
 import kbnSecuritySolutionNavigationObj from './kbn_security_solution_navigation.devdocs.json';
diff --git a/api_docs/kbn_security_solution_side_nav.mdx b/api_docs/kbn_security_solution_side_nav.mdx
index f6a85eb1b22b08..954e8635746a89 100644
--- a/api_docs/kbn_security_solution_side_nav.mdx
+++ b/api_docs/kbn_security_solution_side_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-side-nav
 title: "@kbn/security-solution-side-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-side-nav plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-side-nav']
 ---
 import kbnSecuritySolutionSideNavObj from './kbn_security_solution_side_nav.devdocs.json';
diff --git a/api_docs/kbn_security_solution_storybook_config.mdx b/api_docs/kbn_security_solution_storybook_config.mdx
index c2a939ccbcad79..8314689fb67270 100644
--- a/api_docs/kbn_security_solution_storybook_config.mdx
+++ b/api_docs/kbn_security_solution_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-storybook-config
 title: "@kbn/security-solution-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-storybook-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-storybook-config']
 ---
 import kbnSecuritySolutionStorybookConfigObj from './kbn_security_solution_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index ffdcdf056987a2..9a5e450d64ca59 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_data_table.mdx b/api_docs/kbn_securitysolution_data_table.mdx
index 1190ca76448213..a47ddc3626bedc 100644
--- a/api_docs/kbn_securitysolution_data_table.mdx
+++ b/api_docs/kbn_securitysolution_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-data-table
 title: "@kbn/securitysolution-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-data-table plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-data-table']
 ---
 import kbnSecuritysolutionDataTableObj from './kbn_securitysolution_data_table.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
index 0cbeffbcdff275..37d81e7a893d17 100644
--- a/api_docs/kbn_securitysolution_ecs.mdx
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
 title: "@kbn/securitysolution-ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-ecs plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
 ---
 import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index 323c13e48fb534..2139e894450e1c 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index 1c7d1357c04498..a60e455be19035 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_grouping.mdx b/api_docs/kbn_securitysolution_grouping.mdx
index 35b71a8f9af684..a5f7d5a720963f 100644
--- a/api_docs/kbn_securitysolution_grouping.mdx
+++ b/api_docs/kbn_securitysolution_grouping.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-grouping
 title: "@kbn/securitysolution-grouping"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-grouping plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-grouping']
 ---
 import kbnSecuritysolutionGroupingObj from './kbn_securitysolution_grouping.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index 77957415ef3ed2..1230620c33ce09 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index 3f48ae66fbb0e9..4d7f46b3fbae4d 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 918cb773c4e876..72e993e176104f 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index 6e30d2c48b41e4..b8f33bd2765186 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index 246a043063f7f8..9358eaf1778c04 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index 4e488db5b32907..43ff4d8d86e7c0 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index 84080bd4212369..da004a21dfea14 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index 31d83b7b417784..a89758a11264aa 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index 512c6a09d094b9..ed415baa56521f 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index 719cba8a9b6d0e..78284029c6d3cd 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index 4e03cdf5b73c08..d89bf951b89099 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index c8457990219b93..f1ca29e4324d76 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index e9b483fb891803..39dd797375d761 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index e3b44fd839da4a..50fecfe29e162d 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_serverless_common_settings.mdx b/api_docs/kbn_serverless_common_settings.mdx
index db838d30b6ba31..6dceb8358359c3 100644
--- a/api_docs/kbn_serverless_common_settings.mdx
+++ b/api_docs/kbn_serverless_common_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-common-settings
 title: "@kbn/serverless-common-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-common-settings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-common-settings']
 ---
 import kbnServerlessCommonSettingsObj from './kbn_serverless_common_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_observability_settings.mdx b/api_docs/kbn_serverless_observability_settings.mdx
index 819abbf3430c16..9cfec640319085 100644
--- a/api_docs/kbn_serverless_observability_settings.mdx
+++ b/api_docs/kbn_serverless_observability_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-observability-settings
 title: "@kbn/serverless-observability-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-observability-settings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-observability-settings']
 ---
 import kbnServerlessObservabilitySettingsObj from './kbn_serverless_observability_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_project_switcher.mdx b/api_docs/kbn_serverless_project_switcher.mdx
index 25ade2bc4c5ff4..63f0b32b0f2fda 100644
--- a/api_docs/kbn_serverless_project_switcher.mdx
+++ b/api_docs/kbn_serverless_project_switcher.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-project-switcher
 title: "@kbn/serverless-project-switcher"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-project-switcher plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-project-switcher']
 ---
 import kbnServerlessProjectSwitcherObj from './kbn_serverless_project_switcher.devdocs.json';
diff --git a/api_docs/kbn_serverless_search_settings.mdx b/api_docs/kbn_serverless_search_settings.mdx
index 1f12da911ce273..27dd6e08fe4517 100644
--- a/api_docs/kbn_serverless_search_settings.mdx
+++ b/api_docs/kbn_serverless_search_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-search-settings
 title: "@kbn/serverless-search-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-search-settings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-search-settings']
 ---
 import kbnServerlessSearchSettingsObj from './kbn_serverless_search_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_security_settings.mdx b/api_docs/kbn_serverless_security_settings.mdx
index a55c03c341224c..7f594a11d155d7 100644
--- a/api_docs/kbn_serverless_security_settings.mdx
+++ b/api_docs/kbn_serverless_security_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-security-settings
 title: "@kbn/serverless-security-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-security-settings plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-security-settings']
 ---
 import kbnServerlessSecuritySettingsObj from './kbn_serverless_security_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_storybook_config.mdx b/api_docs/kbn_serverless_storybook_config.mdx
index d0a65c9583006d..b50171c4b28f52 100644
--- a/api_docs/kbn_serverless_storybook_config.mdx
+++ b/api_docs/kbn_serverless_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-storybook-config
 title: "@kbn/serverless-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-storybook-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-storybook-config']
 ---
 import kbnServerlessStorybookConfigObj from './kbn_serverless_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index 7e629bb13419c3..30112dfacaec22 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index 8a53913f9f7e75..0ad6bb9cae25df 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index d085adbf782b61..4f62db815bb12e 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.devdocs.json b/api_docs/kbn_shared_ux_button_toolbar.devdocs.json
index 612b861b36f385..3c4e59e38b5442 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.devdocs.json
+++ b/api_docs/kbn_shared_ux_button_toolbar.devdocs.json
@@ -176,7 +176,7 @@
         "label": "ToolbarButton",
         "description": [],
         "signature": [
-          "({ label, type, iconSide, size, isDisabled, ...rest }: React.PropsWithChildren<",
+          "(props: ",
           {
             "pluginId": "@kbn/shared-ux-button-toolbar",
             "scope": "common",
@@ -184,7 +184,7 @@
             "section": "def-common.Props",
             "text": "Props"
           },
-          ">) => JSX.Element"
+          "<T>) => JSX.Element"
         ],
         "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
         "deprecated": false,
@@ -193,12 +193,11 @@
           {
             "parentPluginId": "@kbn/shared-ux-button-toolbar",
             "id": "def-common.ToolbarButton.$1",
-            "type": "CompoundType",
+            "type": "Uncategorized",
             "tags": [],
-            "label": "{\n  label,\n  type = 'empty',\n  iconSide = 'left',\n  size = 'm',\n  isDisabled,\n  ...rest\n}",
+            "label": "props",
             "description": [],
             "signature": [
-              "React.PropsWithChildren<",
               {
                 "pluginId": "@kbn/shared-ux-button-toolbar",
                 "scope": "common",
@@ -206,7 +205,7 @@
                 "section": "def-common.Props",
                 "text": "Props"
               },
-              ">"
+              "<T>"
             ],
             "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
             "deprecated": false,
@@ -431,59 +430,6 @@
         ],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "@kbn/shared-ux-button-toolbar",
-        "id": "def-common.Props",
-        "type": "Interface",
-        "tags": [],
-        "label": "Props",
-        "description": [
-          "\nProps for `PrimaryButton`."
-        ],
-        "signature": [
-          {
-            "pluginId": "@kbn/shared-ux-button-toolbar",
-            "scope": "common",
-            "docId": "kibKbnSharedUxButtonToolbarPluginApi",
-            "section": "def-common.Props",
-            "text": "Props"
-          },
-          " extends Pick<",
-          "EuiButtonPropsForButton",
-          ", \"onClick\" | \"data-test-subj\" | \"isDisabled\" | \"iconType\" | \"size\" | \"iconSide\">"
-        ],
-        "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "@kbn/shared-ux-button-toolbar",
-            "id": "def-common.Props.label",
-            "type": "string",
-            "tags": [],
-            "label": "label",
-            "description": [],
-            "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "@kbn/shared-ux-button-toolbar",
-            "id": "def-common.Props.type",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "type",
-            "description": [],
-            "signature": [
-              "ToolbarButtonTypes | undefined"
-            ],
-            "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/shared-ux-button-toolbar",
         "id": "def-common.Props",
@@ -525,15 +471,32 @@
         "label": "Props",
         "description": [],
         "signature": [
-          "{ onClick?: React.MouseEventHandler<HTMLButtonElement> | undefined; 'data-test-subj'?: string | undefined; isDisabled?: boolean | undefined; size?: \"m\" | \"s\" | undefined; iconSide?: ",
+          "{ fullWidth?: boolean | undefined; onClick?: React.MouseEventHandler<HTMLButtonElement> | undefined; 'data-test-subj'?: string | undefined; isDisabled?: boolean | undefined; isLoading?: boolean | undefined; size?: \"m\" | \"s\" | undefined; as?: \"standard\" | undefined; fontWeight?: ToolbarButtonFontWeights | undefined; iconSide?: ",
           "ButtonContentIconSide",
-          "; }"
+          "; groupPosition?: ButtonPositions | undefined; hasArrow?: boolean | undefined; }"
         ],
         "path": "packages/shared-ux/button_toolbar/src/buttons/add_from_library/add_from_library.tsx",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/shared-ux-button-toolbar",
+        "id": "def-common.Props",
+        "type": "Type",
+        "tags": [],
+        "label": "Props",
+        "description": [
+          "\nProps for `PrimaryButton`."
+        ],
+        "signature": [
+          "T extends \"iconButton\" ? ToolbarIconButton : ToolbarStandardButton"
+        ],
+        "path": "packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/shared-ux-button-toolbar",
         "id": "def-common.Props",
@@ -544,7 +507,7 @@
           "\nProps for `ToolbarPopover`."
         ],
         "signature": [
-          "AllowedButtonProps & AllowedPopoverProps & { children: (arg: { closePopover: () => void; }) => React.ReactNode; }"
+          "AllowedButtonProps & AllowedPopoverProps & { children: (arg: { closePopover: () => void; }) => React.ReactNode; label: boolean | React.ReactChild | React.ReactFragment | React.ReactPortal; }"
         ],
         "path": "packages/shared-ux/button_toolbar/src/popover/popover.tsx",
         "deprecated": false,
@@ -561,7 +524,7 @@
           "type for cases with both button or a popover could be used"
         ],
         "signature": [
-          "React.FunctionComponent<",
+          "(<T extends ButtonRenderStyle>(props: ",
           {
             "pluginId": "@kbn/shared-ux-button-toolbar",
             "scope": "common",
@@ -569,7 +532,7 @@
             "section": "def-common.Props",
             "text": "Props"
           },
-          "> | (({ type, label, iconType, size, children, isDisabled, ...popover }: ",
+          "<T>) => JSX.Element) | (({ type, label, iconType, size, children, isDisabled, ...popover }: ",
           {
             "pluginId": "@kbn/shared-ux-button-toolbar",
             "scope": "common",
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index 4160c23c498640..9af0278eb636af 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 28 | 0 | 10 | 0 |
+| 26 | 0 | 8 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index 2abf35b050f9db..2597afee40c8bd 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index 358782c8b70055..42e8b367cc01c6 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_chrome_navigation.mdx b/api_docs/kbn_shared_ux_chrome_navigation.mdx
index f9ecbe1644a963..5bd9ca718f0d89 100644
--- a/api_docs/kbn_shared_ux_chrome_navigation.mdx
+++ b/api_docs/kbn_shared_ux_chrome_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-chrome-navigation
 title: "@kbn/shared-ux-chrome-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-chrome-navigation plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-chrome-navigation']
 ---
 import kbnSharedUxChromeNavigationObj from './kbn_shared_ux_chrome_navigation.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_error_boundary.mdx b/api_docs/kbn_shared_ux_error_boundary.mdx
index 8e4e4c25d8f09a..d8e841f557bec7 100644
--- a/api_docs/kbn_shared_ux_error_boundary.mdx
+++ b/api_docs/kbn_shared_ux_error_boundary.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-error-boundary
 title: "@kbn/shared-ux-error-boundary"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-error-boundary plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-error-boundary']
 ---
 import kbnSharedUxErrorBoundaryObj from './kbn_shared_ux_error_boundary.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index 3c539c58424ff2..fc319ba7b17273 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index b132bde96a8e37..5d16acbe371a8a 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index f87049da346509..98e21161e49af4 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index 80ab3fa803ebe0..132f52fb52ad74 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index 0133656dffbad6..3cb96a8c84b47b 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_types.mdx b/api_docs/kbn_shared_ux_file_types.mdx
index f05164714efb5c..ba5b55fe70c17f 100644
--- a/api_docs/kbn_shared_ux_file_types.mdx
+++ b/api_docs/kbn_shared_ux_file_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-types
 title: "@kbn/shared-ux-file-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-types']
 ---
 import kbnSharedUxFileTypesObj from './kbn_shared_ux_file_types.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index df743198d5eeb5..36937770ff197b 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index 2dc3ad597bde21..538be5651a6524 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index 533dda0f6af2dd..9b9e16d37e10cc 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index 482c09f26df625..1c9aed91772228 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index 13549825dc01f7..8b9880d8e2c303 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index 6a4b750516e037..4148f5aa9bb7d3 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index 4100d9f348c0f2..ce94459105031c 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index bceeca64e06366..0f0e2b5249369b 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index c492e180e625ec..dfb064bb8f2747 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index aebc621b8120b7..3fcba2e9a7d10d 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index 0afac69e5cc6aa..914f0dfe2e92be 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index cdcdf4ec9c98c8..2014e9f2823957 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index 0b02f9e7ba2ee6..24fb883d80c31c 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index 052729a9704f61..05879319e3bd47 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index d534d9cbce8b6e..3a5f7a3ff9acdc 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index 2fc85cb04f0e4c..7e3bff9e8e1fca 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index 2865602f3f3cf7..7790de025448c4 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index f9b1d12110871b..bf75854940084e 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index 05246fe66de3af..65a4f10bb71651 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index 634779f091cb02..2746bdc980ce42 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index 15cac9a77a8a0f..3968d04cd7954f 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index 68e84be049f44d..5478a5d9d8c608 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index 48a8e9b21915a3..0e019d281ec0ca 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index 59e3d933077215..eb9dc7a265492d 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index cc9ffc9b40385b..b900f78725434b 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.devdocs.json b/api_docs/kbn_slo_schema.devdocs.json
index c782633b8fb9ba..e11a54eb98d658 100644
--- a/api_docs/kbn_slo_schema.devdocs.json
+++ b/api_docs/kbn_slo_schema.devdocs.json
@@ -398,7 +398,115 @@
         "initialIsOpen": false
       }
     ],
-    "interfaces": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.Paginated",
+        "type": "Interface",
+        "tags": [],
+        "label": "Paginated",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Paginated",
+            "text": "Paginated"
+          },
+          "<T>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Paginated.total",
+            "type": "number",
+            "tags": [],
+            "label": "total",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Paginated.page",
+            "type": "number",
+            "tags": [],
+            "label": "page",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Paginated.perPage",
+            "type": "number",
+            "tags": [],
+            "label": "perPage",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Paginated.results",
+            "type": "Array",
+            "tags": [],
+            "label": "results",
+            "description": [],
+            "signature": [
+              "T[]"
+            ],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.Pagination",
+        "type": "Interface",
+        "tags": [],
+        "label": "Pagination",
+        "description": [],
+        "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Pagination.page",
+            "type": "number",
+            "tags": [],
+            "label": "page",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.Pagination.perPage",
+            "type": "number",
+            "tags": [],
+            "label": "perPage",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/models/pagination.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
     "enums": [
       {
         "parentPluginId": "@kbn/slo-schema",
@@ -621,17 +729,28 @@
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.FindSloDefinitionsResponse",
+        "id": "def-common.FindSLODefinitionsParams",
         "type": "Type",
-        "tags": [
-          "private"
-        ],
-        "label": "FindSloDefinitionsResponse",
-        "description": [
-          "\nThe response type for /internal/observability/slo/_definitions\n"
+        "tags": [],
+        "label": "FindSLODefinitionsParams",
+        "description": [],
+        "signature": [
+          "{ search?: string | undefined; includeOutdatedOnly?: boolean | undefined; page?: string | undefined; perPage?: string | undefined; }"
         ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.FindSLODefinitionsResponse",
+        "type": "Type",
+        "tags": [],
+        "label": "FindSLODefinitionsResponse",
+        "description": [],
         "signature": [
-          "({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]"
+          "{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; })[]; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -661,7 +780,7 @@
         "label": "FindSLOResponse",
         "description": [],
         "signature": [
-          "{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }"
+          "{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -751,7 +870,7 @@
         "label": "GetSLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -863,6 +982,36 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.ResetSLOParams",
+        "type": "Type",
+        "tags": [],
+        "label": "ResetSLOParams",
+        "description": [],
+        "signature": [
+          "{ id: string; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.ResetSLOResponse",
+        "type": "Type",
+        "tags": [],
+        "label": "ResetSLOResponse",
+        "description": [],
+        "signature": [
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/slo-schema",
         "id": "def-common.SLOResponse",
@@ -871,7 +1020,7 @@
         "label": "SLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -886,7 +1035,7 @@
         "label": "SLOWithSummaryResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -1046,7 +1195,7 @@
         "label": "UpdateSLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -1945,19 +2094,21 @@
         "parentPluginId": "@kbn/slo-schema",
         "id": "def-common.findSloDefinitionsParamsSchema",
         "type": "Object",
-        "tags": [
-          "private"
-        ],
+        "tags": [],
         "label": "findSloDefinitionsParamsSchema",
-        "description": [
-          "\nThe query params schema for /internal/observability/slo/_definitions\n"
-        ],
+        "description": [],
         "signature": [
-          "TypeC",
+          "PartialC",
           "<{ query: ",
-          "TypeC",
+          "PartialC",
           "<{ search: ",
           "StringC",
+          "; includeOutdatedOnly: ",
+          "Type",
+          "<boolean, boolean, unknown>; page: ",
+          "StringC",
+          "; perPage: ",
+          "StringC",
           "; }>; }>"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
@@ -1969,14 +2120,18 @@
         "parentPluginId": "@kbn/slo-schema",
         "id": "def-common.findSloDefinitionsResponseSchema",
         "type": "Object",
-        "tags": [
-          "private"
-        ],
+        "tags": [],
         "label": "findSloDefinitionsResponseSchema",
-        "description": [
-          "\nThe response schema for /internal/observability/slo/_definitions\n"
-        ],
+        "description": [],
         "signature": [
+          "TypeC",
+          "<{ page: ",
+          "NumberC",
+          "; perPage: ",
+          "NumberC",
+          "; total: ",
+          "NumberC",
+          "; results: ",
           "ArrayC",
           "<",
           "IntersectionC",
@@ -2414,7 +2569,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
@@ -2422,7 +2579,7 @@
           "LiteralC",
           "<\"*\">, ",
           "StringC",
-          "]>; }>]>>"
+          "]>; }>]>>; }>"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -2924,7 +3081,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
@@ -3924,7 +4083,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
@@ -4875,105 +5036,30 @@
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.rollingTimeWindowSchema",
+        "id": "def-common.resetSLOParamsSchema",
         "type": "Object",
         "tags": [],
-        "label": "rollingTimeWindowSchema",
+        "label": "resetSLOParamsSchema",
         "description": [],
         "signature": [
           "TypeC",
-          "<{ duration: ",
-          "Type",
-          "<",
-          {
-            "pluginId": "@kbn/slo-schema",
-            "scope": "common",
-            "docId": "kibKbnSloSchemaPluginApi",
-            "section": "def-common.Duration",
-            "text": "Duration"
-          },
-          ", string, unknown>; type: ",
-          "LiteralC",
-          "<\"rolling\">; }>"
-        ],
-        "path": "x-pack/packages/kbn-slo-schema/src/schema/time_window.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.rollingTimeWindowTypeSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "rollingTimeWindowTypeSchema",
-        "description": [],
-        "signature": [
-          "LiteralC",
-          "<\"rolling\">"
-        ],
-        "path": "x-pack/packages/kbn-slo-schema/src/schema/time_window.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.settingsSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "settingsSchema",
-        "description": [],
-        "signature": [
+          "<{ path: ",
           "TypeC",
-          "<{ syncDelay: ",
-          "Type",
-          "<",
-          {
-            "pluginId": "@kbn/slo-schema",
-            "scope": "common",
-            "docId": "kibKbnSloSchemaPluginApi",
-            "section": "def-common.Duration",
-            "text": "Duration"
-          },
-          ", string, unknown>; frequency: ",
-          "Type",
-          "<",
-          {
-            "pluginId": "@kbn/slo-schema",
-            "scope": "common",
-            "docId": "kibKbnSloSchemaPluginApi",
-            "section": "def-common.Duration",
-            "text": "Duration"
-          },
-          ", string, unknown>; }>"
-        ],
-        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.sloIdSchema",
-        "type": "Object",
-        "tags": [],
-        "label": "sloIdSchema",
-        "description": [],
-        "signature": [
-          "StringC"
+          "<{ id: ",
+          "StringC",
+          "; }>; }>"
         ],
-        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.sloResponseSchema",
+        "id": "def-common.resetSLOResponseSchema",
         "type": "Object",
         "tags": [],
-        "label": "sloResponseSchema",
+        "label": "resetSLOResponseSchema",
         "description": [],
         "signature": [
           "IntersectionC",
@@ -5411,7 +5497,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
@@ -5428,28 +5516,583 @@
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.sloSchema",
+        "id": "def-common.rollingTimeWindowSchema",
         "type": "Object",
         "tags": [],
-        "label": "sloSchema",
+        "label": "rollingTimeWindowSchema",
         "description": [],
         "signature": [
           "TypeC",
-          "<{ id: ",
-          "StringC",
-          "; name: ",
-          "StringC",
-          "; description: ",
-          "StringC",
-          "; indicator: ",
-          "UnionC",
-          "<[",
-          "TypeC",
-          "<{ type: ",
-          "LiteralC",
-          "<\"sli.apm.transactionDuration\">; params: ",
-          "IntersectionC",
-          "<[",
+          "<{ duration: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; type: ",
+          "LiteralC",
+          "<\"rolling\">; }>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/time_window.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.rollingTimeWindowTypeSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "rollingTimeWindowTypeSchema",
+        "description": [],
+        "signature": [
+          "LiteralC",
+          "<\"rolling\">"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/time_window.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.settingsSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "settingsSchema",
+        "description": [],
+        "signature": [
+          "TypeC",
+          "<{ syncDelay: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; frequency: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; }>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.sloIdSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "sloIdSchema",
+        "description": [],
+        "signature": [
+          "StringC"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.sloResponseSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "sloResponseSchema",
+        "description": [],
+        "signature": [
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ id: ",
+          "StringC",
+          "; name: ",
+          "StringC",
+          "; description: ",
+          "StringC",
+          "; indicator: ",
+          "UnionC",
+          "<[",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.apm.transactionDuration\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ environment: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; service: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; transactionType: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; transactionName: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; threshold: ",
+          "NumberC",
+          "; index: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.apm.transactionErrorRate\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ environment: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; service: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; transactionType: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; transactionName: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; index: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.kql.custom\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; good: ",
+          "StringC",
+          "; total: ",
+          "StringC",
+          "; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.metric.custom\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; good: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"sum\">; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; }>; total: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"sum\">; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.histogram.custom\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; timestampField: ",
+          "StringC",
+          "; good: ",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"value_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"range\">; from: ",
+          "NumberC",
+          "; to: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>; total: ",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"value_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"range\">; from: ",
+          "NumberC",
+          "; to: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>]>; timeWindow: ",
+          "UnionC",
+          "<[",
+          "TypeC",
+          "<{ duration: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; type: ",
+          "LiteralC",
+          "<\"rolling\">; }>, ",
+          "TypeC",
+          "<{ duration: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; type: ",
+          "LiteralC",
+          "<\"calendarAligned\">; }>]>; budgetingMethod: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"occurrences\">, ",
+          "LiteralC",
+          "<\"timeslices\">]>; objective: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ target: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ timesliceTarget: ",
+          "NumberC",
+          "; timesliceWindow: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; }>]>; revision: ",
+          "NumberC",
+          "; settings: ",
+          "TypeC",
+          "<{ syncDelay: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; frequency: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; }>; enabled: ",
+          "BooleanC",
+          "; tags: ",
+          "ArrayC",
+          "<",
+          "StringC",
+          ">; groupBy: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; createdAt: ",
+          "Type",
+          "<Date, string, unknown>; updatedAt: ",
+          "Type",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ instanceId: ",
+          "UnionC",
+          "<[",
+          "LiteralC",
+          "<\"*\">, ",
+          "StringC",
+          "]>; }>]>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.sloSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "sloSchema",
+        "description": [],
+        "signature": [
+          "TypeC",
+          "<{ id: ",
+          "StringC",
+          "; name: ",
+          "StringC",
+          "; description: ",
+          "StringC",
+          "; indicator: ",
+          "UnionC",
+          "<[",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.apm.transactionDuration\">; params: ",
+          "IntersectionC",
+          "<[",
           "TypeC",
           "<{ environment: ",
           "UnionC",
@@ -5867,7 +6510,9 @@
           "LiteralC",
           "<\"*\">, ",
           "StringC",
-          "]>; }>"
+          "]>; version: ",
+          "NumberC",
+          "; }>"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
         "deprecated": false,
@@ -6319,7 +6964,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
@@ -6803,7 +7450,9 @@
           "LiteralC",
           "<\"*\">, ",
           "StringC",
-          "]>; }>, ",
+          "]>; version: ",
+          "NumberC",
+          "; }>, ",
           "TypeC",
           "<{ summary: ",
           "TypeC",
@@ -8201,7 +8850,9 @@
           "Type",
           "<Date, string, unknown>; updatedAt: ",
           "Type",
-          "<Date, string, unknown>; }>, ",
+          "<Date, string, unknown>; version: ",
+          "NumberC",
+          "; }>, ",
           "PartialC",
           "<{ instanceId: ",
           "UnionC",
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index de3cbf08d0c985..7c42b258ebdebd 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 131 | 0 | 128 | 0 |
+| 144 | 0 | 144 | 0 |
 
 ## Common
 
@@ -34,6 +34,9 @@ Contact [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/
 ### Classes
 <DocDefinitionList data={kbnSloSchemaObj.common.classes}/>
 
+### Interfaces
+<DocDefinitionList data={kbnSloSchemaObj.common.interfaces}/>
+
 ### Enums
 <DocDefinitionList data={kbnSloSchemaObj.common.enums}/>
 
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index d847191cad35bd..7fee4e17d1c913 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index 6ccf9c12259832..23e06f334a209d 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index dad5ae36ef322a..cd6b795dc72c6a 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index d26aa25b180680..c6d366d7393e40 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_subscription_tracking.mdx b/api_docs/kbn_subscription_tracking.mdx
index aec338d9e3243f..ab44c4c5278cc9 100644
--- a/api_docs/kbn_subscription_tracking.mdx
+++ b/api_docs/kbn_subscription_tracking.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-subscription-tracking
 title: "@kbn/subscription-tracking"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/subscription-tracking plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/subscription-tracking']
 ---
 import kbnSubscriptionTrackingObj from './kbn_subscription_tracking.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index f135c68fd82e81..0945a0e2d111c5 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index f4c516a7b72c15..69bba2fc1f8465 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index e8192760ab8c46..2901e719fe490f 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index 75a62bafb9c3c4..1764322c812e69 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_text_based_editor.mdx b/api_docs/kbn_text_based_editor.mdx
index 14dc22301d438f..e5307829886651 100644
--- a/api_docs/kbn_text_based_editor.mdx
+++ b/api_docs/kbn_text_based_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-text-based-editor
 title: "@kbn/text-based-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/text-based-editor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/text-based-editor']
 ---
 import kbnTextBasedEditorObj from './kbn_text_based_editor.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index bce266d5e3d058..8658e8c3dd4acf 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index 9adb1fd506d4c5..9ced7a66855bc3 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index 920bdacfc58223..77bdb5f91fd4cc 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index ae156a3f67df1b..1274bf25fa9c1d 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index 3aed0337f28758..e9f159428e46a6 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index 33e8784499ade3..04a49d73470805 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_unified_data_table.mdx b/api_docs/kbn_unified_data_table.mdx
index 02e6afdcfb395b..6becec7972d244 100644
--- a/api_docs/kbn_unified_data_table.mdx
+++ b/api_docs/kbn_unified_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-data-table
 title: "@kbn/unified-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-data-table plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-data-table']
 ---
 import kbnUnifiedDataTableObj from './kbn_unified_data_table.devdocs.json';
diff --git a/api_docs/kbn_unified_doc_viewer.mdx b/api_docs/kbn_unified_doc_viewer.mdx
index f5e9c9d1f06bdf..8cf7199ed233e2 100644
--- a/api_docs/kbn_unified_doc_viewer.mdx
+++ b/api_docs/kbn_unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-doc-viewer
 title: "@kbn/unified-doc-viewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-doc-viewer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-doc-viewer']
 ---
 import kbnUnifiedDocViewerObj from './kbn_unified_doc_viewer.devdocs.json';
diff --git a/api_docs/kbn_unified_field_list.mdx b/api_docs/kbn_unified_field_list.mdx
index ab60706a182c7c..81aa7a60b9cf76 100644
--- a/api_docs/kbn_unified_field_list.mdx
+++ b/api_docs/kbn_unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-field-list
 title: "@kbn/unified-field-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-field-list plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-field-list']
 ---
 import kbnUnifiedFieldListObj from './kbn_unified_field_list.devdocs.json';
diff --git a/api_docs/kbn_unsaved_changes_badge.devdocs.json b/api_docs/kbn_unsaved_changes_badge.devdocs.json
new file mode 100644
index 00000000000000..d8bc0bf79d1ec9
--- /dev/null
+++ b/api_docs/kbn_unsaved_changes_badge.devdocs.json
@@ -0,0 +1,273 @@
+{
+  "id": "@kbn/unsaved-changes-badge",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [
+      {
+        "parentPluginId": "@kbn/unsaved-changes-badge",
+        "id": "def-common.getTopNavUnsavedChangesBadge",
+        "type": "Function",
+        "tags": [],
+        "label": "getTopNavUnsavedChangesBadge",
+        "description": [
+          "\nReturns a badge object suitable for the top nav `badges` prop"
+        ],
+        "signature": [
+          "({ onRevert, onSave, onSaveAs, }: ",
+          {
+            "pluginId": "@kbn/unsaved-changes-badge",
+            "scope": "common",
+            "docId": "kibKbnUnsavedChangesBadgePluginApi",
+            "section": "def-common.TopNavUnsavedChangesBadgeParams",
+            "text": "TopNavUnsavedChangesBadgeParams"
+          },
+          ") => ",
+          {
+            "pluginId": "navigation",
+            "scope": "public",
+            "docId": "kibNavigationPluginApi",
+            "section": "def-public.TopNavMenuBadgeProps",
+            "text": "TopNavMenuBadgeProps"
+          }
+        ],
+        "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.getTopNavUnsavedChangesBadge.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "{\n  onRevert,\n  onSave,\n  onSaveAs,\n}",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/unsaved-changes-badge",
+                "scope": "common",
+                "docId": "kibKbnUnsavedChangesBadgePluginApi",
+                "section": "def-common.TopNavUnsavedChangesBadgeParams",
+                "text": "TopNavUnsavedChangesBadgeParams"
+              }
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/unsaved-changes-badge",
+        "id": "def-common.UnsavedChangesBadge",
+        "type": "Function",
+        "tags": [
+          "constructor"
+        ],
+        "label": "UnsavedChangesBadge",
+        "description": [
+          "\nBadge component. It opens a menu panel with actions once pressed."
+        ],
+        "signature": [
+          "({ badgeText, onRevert, onSave, onSaveAs, }: React.PropsWithChildren<",
+          {
+            "pluginId": "@kbn/unsaved-changes-badge",
+            "scope": "common",
+            "docId": "kibKbnUnsavedChangesBadgePluginApi",
+            "section": "def-common.UnsavedChangesBadgeProps",
+            "text": "UnsavedChangesBadgeProps"
+          },
+          ">) => JSX.Element"
+        ],
+        "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.UnsavedChangesBadge.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "{\n  badgeText,\n  onRevert,\n  onSave,\n  onSaveAs,\n}",
+            "description": [],
+            "signature": [
+              "React.PropsWithChildren<",
+              {
+                "pluginId": "@kbn/unsaved-changes-badge",
+                "scope": "common",
+                "docId": "kibKbnUnsavedChangesBadgePluginApi",
+                "section": "def-common.UnsavedChangesBadgeProps",
+                "text": "UnsavedChangesBadgeProps"
+              },
+              ">"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/unsaved-changes-badge",
+        "id": "def-common.TopNavUnsavedChangesBadgeParams",
+        "type": "Interface",
+        "tags": [],
+        "label": "TopNavUnsavedChangesBadgeParams",
+        "description": [
+          "\nParams for getTopNavUnsavedChangesBadge"
+        ],
+        "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.TopNavUnsavedChangesBadgeParams.onRevert",
+            "type": "Function",
+            "tags": [],
+            "label": "onRevert",
+            "description": [],
+            "signature": [
+              "() => Promise<unknown>"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": []
+          },
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.TopNavUnsavedChangesBadgeParams.onSave",
+            "type": "Function",
+            "tags": [],
+            "label": "onSave",
+            "description": [],
+            "signature": [
+              "(() => Promise<unknown>) | undefined"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.TopNavUnsavedChangesBadgeParams.onSaveAs",
+            "type": "Function",
+            "tags": [],
+            "label": "onSaveAs",
+            "description": [],
+            "signature": [
+              "(() => Promise<unknown>) | undefined"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/unsaved-changes-badge",
+        "id": "def-common.UnsavedChangesBadgeProps",
+        "type": "Interface",
+        "tags": [],
+        "label": "UnsavedChangesBadgeProps",
+        "description": [
+          "\nProps for UnsavedChangesBadge"
+        ],
+        "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.UnsavedChangesBadgeProps.onRevert",
+            "type": "Function",
+            "tags": [],
+            "label": "onRevert",
+            "description": [],
+            "signature": [
+              "() => Promise<unknown>"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.UnsavedChangesBadgeProps.onSave",
+            "type": "Function",
+            "tags": [],
+            "label": "onSave",
+            "description": [],
+            "signature": [
+              "(() => Promise<unknown>) | undefined"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.UnsavedChangesBadgeProps.onSaveAs",
+            "type": "Function",
+            "tags": [],
+            "label": "onSaveAs",
+            "description": [],
+            "signature": [
+              "(() => Promise<unknown>) | undefined"
+            ],
+            "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "@kbn/unsaved-changes-badge",
+            "id": "def-common.UnsavedChangesBadgeProps.badgeText",
+            "type": "string",
+            "tags": [],
+            "label": "badgeText",
+            "description": [],
+            "path": "packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_unsaved_changes_badge.mdx b/api_docs/kbn_unsaved_changes_badge.mdx
new file mode 100644
index 00000000000000..6c364636d653b6
--- /dev/null
+++ b/api_docs/kbn_unsaved_changes_badge.mdx
@@ -0,0 +1,33 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnUnsavedChangesBadgePluginApi
+slug: /kibana-dev-docs/api/kbn-unsaved-changes-badge
+title: "@kbn/unsaved-changes-badge"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/unsaved-changes-badge plugin
+date: 2023-11-16
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unsaved-changes-badge']
+---
+import kbnUnsavedChangesBadgeObj from './kbn_unsaved_changes_badge.devdocs.json';
+
+
+
+Contact [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 13 | 0 | 9 | 0 |
+
+## Common
+
+### Functions
+<DocDefinitionList data={kbnUnsavedChangesBadgeObj.common.functions}/>
+
+### Interfaces
+<DocDefinitionList data={kbnUnsavedChangesBadgeObj.common.interfaces}/>
+
diff --git a/api_docs/kbn_url_state.mdx b/api_docs/kbn_url_state.mdx
index c8b7c990839ed2..840b0a4977193a 100644
--- a/api_docs/kbn_url_state.mdx
+++ b/api_docs/kbn_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-url-state
 title: "@kbn/url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/url-state plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/url-state']
 ---
 import kbnUrlStateObj from './kbn_url_state.devdocs.json';
diff --git a/api_docs/kbn_use_tracked_promise.mdx b/api_docs/kbn_use_tracked_promise.mdx
index 45233fbc1cedb1..d786478df658cb 100644
--- a/api_docs/kbn_use_tracked_promise.mdx
+++ b/api_docs/kbn_use_tracked_promise.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-use-tracked-promise
 title: "@kbn/use-tracked-promise"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/use-tracked-promise plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/use-tracked-promise']
 ---
 import kbnUseTrackedPromiseObj from './kbn_use_tracked_promise.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.devdocs.json b/api_docs/kbn_user_profile_components.devdocs.json
index 8a2a61616e98d5..e3e6876539109d 100644
--- a/api_docs/kbn_user_profile_components.devdocs.json
+++ b/api_docs/kbn_user_profile_components.devdocs.json
@@ -560,7 +560,7 @@
           },
           " extends Omit<",
           "EuiAvatarProps",
-          ", \"type\" | \"name\" | \"color\" | \"iconType\" | \"iconColor\" | \"iconSize\" | \"initials\" | \"initialsLength\" | \"imageUrl\">"
+          ", \"type\" | \"name\" | \"color\" | \"iconType\" | \"iconColor\" | \"initials\" | \"initialsLength\" | \"imageUrl\" | \"iconSize\">"
         ],
         "path": "packages/kbn-user-profile-components/src/user_avatar.tsx",
         "deprecated": false,
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index 22ca484767fad0..f7a5f71a4cc1ae 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index 58719f00482f79..e7e71b57227d23 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index 6646d78632b752..f9667564988d44 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index f0758e421a49a2..bb87f0b1f130b4 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_visualization_ui_components.devdocs.json b/api_docs/kbn_visualization_ui_components.devdocs.json
index 80a90a0b589f65..bd1f417ecd328b 100644
--- a/api_docs/kbn_visualization_ui_components.devdocs.json
+++ b/api_docs/kbn_visualization_ui_components.devdocs.json
@@ -1978,38 +1978,6 @@
         "returnComment": [],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "@kbn/visualization-ui-components",
-        "id": "def-public.TruncatedLabel",
-        "type": "Function",
-        "tags": [],
-        "label": "TruncatedLabel",
-        "description": [],
-        "signature": [
-          "React.NamedExoticComponent<{ label: string; search: string; width: number; font: string; }>"
-        ],
-        "path": "packages/kbn-visualization-ui-components/components/field_picker/truncated_label.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "returnComment": [],
-        "children": [
-          {
-            "parentPluginId": "@kbn/visualization-ui-components",
-            "id": "def-public.TruncatedLabel.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "props",
-            "description": [],
-            "signature": [
-              "P"
-            ],
-            "path": "node_modules/@types/react/index.d.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/visualization-ui-components",
         "id": "def-public.useDebouncedValue",
diff --git a/api_docs/kbn_visualization_ui_components.mdx b/api_docs/kbn_visualization_ui_components.mdx
index 2ea082493eb7bd..542a0bbbca6347 100644
--- a/api_docs/kbn_visualization_ui_components.mdx
+++ b/api_docs/kbn_visualization_ui_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-visualization-ui-components
 title: "@kbn/visualization-ui-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/visualization-ui-components plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/visualization-ui-components']
 ---
 import kbnVisualizationUiComponentsObj from './kbn_visualization_ui_components.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/k
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 156 | 0 | 152 | 3 |
+| 154 | 0 | 151 | 3 |
 
 ## Client
 
diff --git a/api_docs/kbn_xstate_utils.mdx b/api_docs/kbn_xstate_utils.mdx
index b3047a5ff7a354..e762b217c83643 100644
--- a/api_docs/kbn_xstate_utils.mdx
+++ b/api_docs/kbn_xstate_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-xstate-utils
 title: "@kbn/xstate-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/xstate-utils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/xstate-utils']
 ---
 import kbnXstateUtilsObj from './kbn_xstate_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index b5c7c8d40499e2..7b7f033b237ead 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kbn_zod_helpers.mdx b/api_docs/kbn_zod_helpers.mdx
index 3f2411d31c72f4..a37c31eea38237 100644
--- a/api_docs/kbn_zod_helpers.mdx
+++ b/api_docs/kbn_zod_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-zod-helpers
 title: "@kbn/zod-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/zod-helpers plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/zod-helpers']
 ---
 import kbnZodHelpersObj from './kbn_zod_helpers.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index 2cee78c2e41e9f..5e4d81d7129a26 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.devdocs.json b/api_docs/kibana_react.devdocs.json
index 1a66a2cf0a4527..4cc2a07f5bad4c 100644
--- a/api_docs/kibana_react.devdocs.json
+++ b/api_docs/kibana_react.devdocs.json
@@ -2520,361 +2520,6 @@
         "returnComment": [],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.RedirectAppLinks",
-        "type": "Function",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "RedirectAppLinks",
-        "description": [
-          "\nUtility component that will intercept click events on children anchor (`<a>`) elements to call\n`application.navigateToUrl` with the link's href. This will trigger SPA friendly navigation\nwhen the link points to a valid Kibana app.\n"
-        ],
-        "signature": [
-          "({ application, children, className, ...otherProps }: React.PropsWithChildren<RedirectCrossAppLinksProps>) => JSX.Element"
-        ],
-        "path": "src/plugins/kibana_react/public/app_links/redirect_app_link.tsx",
-        "deprecated": true,
-        "trackAdoption": false,
-        "references": [
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/application.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/application.tsx"
-          },
-          {
-            "plugin": "home",
-            "path": "src/plugins/home/public/application/application.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx"
-          },
-          {
-            "plugin": "data",
-            "path": "src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx"
-          },
-          {
-            "plugin": "esUiShared",
-            "path": "src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx"
-          },
-          {
-            "plugin": "esUiShared",
-            "path": "src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx"
-          },
-          {
-            "plugin": "esUiShared",
-            "path": "src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx"
-          },
-          {
-            "plugin": "savedObjectsManagement",
-            "path": "src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx"
-          },
-          {
-            "plugin": "exploratoryView",
-            "path": "x-pack/plugins/exploratory_view/public/application/index.tsx"
-          },
-          {
-            "plugin": "exploratoryView",
-            "path": "x-pack/plugins/exploratory_view/public/application/index.tsx"
-          },
-          {
-            "plugin": "exploratoryView",
-            "path": "x-pack/plugins/exploratory_view/public/application/index.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/integrations/app.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/integrations/app.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/integrations/app.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/app.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/app.tsx"
-          },
-          {
-            "plugin": "fleet",
-            "path": "x-pack/plugins/fleet/public/applications/fleet/app.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/routing/app_root/index.tsx"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/routing/app_root/index.tsx"
-          },
-          {
-            "plugin": "apm",
-            "path": "x-pack/plugins/apm/public/components/routing/app_root/index.tsx"
-          },
-          {
-            "plugin": "indexLifecycleManagement",
-            "path": "x-pack/plugins/index_lifecycle_management/public/shared_imports.ts"
-          },
-          {
-            "plugin": "indexLifecycleManagement",
-            "path": "x-pack/plugins/index_lifecycle_management/public/application/index.tsx"
-          },
-          {
-            "plugin": "indexLifecycleManagement",
-            "path": "x-pack/plugins/index_lifecycle_management/public/application/index.tsx"
-          },
-          {
-            "plugin": "indexLifecycleManagement",
-            "path": "x-pack/plugins/index_lifecycle_management/public/application/index.tsx"
-          },
-          {
-            "plugin": "observabilityOnboarding",
-            "path": "x-pack/plugins/observability_onboarding/public/application/app.tsx"
-          },
-          {
-            "plugin": "observabilityOnboarding",
-            "path": "x-pack/plugins/observability_onboarding/public/application/app.tsx"
-          },
-          {
-            "plugin": "observabilityOnboarding",
-            "path": "x-pack/plugins/observability_onboarding/public/application/app.tsx"
-          },
-          {
-            "plugin": "synthetics",
-            "path": "x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx"
-          },
-          {
-            "plugin": "synthetics",
-            "path": "x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx"
-          },
-          {
-            "plugin": "synthetics",
-            "path": "x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx"
-          },
-          {
-            "plugin": "upgradeAssistant",
-            "path": "x-pack/plugins/upgrade_assistant/public/shared_imports.ts"
-          },
-          {
-            "plugin": "upgradeAssistant",
-            "path": "x-pack/plugins/upgrade_assistant/public/application/app.tsx"
-          },
-          {
-            "plugin": "upgradeAssistant",
-            "path": "x-pack/plugins/upgrade_assistant/public/application/app.tsx"
-          },
-          {
-            "plugin": "upgradeAssistant",
-            "path": "x-pack/plugins/upgrade_assistant/public/application/app.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx"
-          },
-          {
-            "plugin": "uptime",
-            "path": "x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx"
-          },
-          {
-            "plugin": "ux",
-            "path": "x-pack/plugins/ux/public/application/ux_app.tsx"
-          },
-          {
-            "plugin": "ux",
-            "path": "x-pack/plugins/ux/public/application/ux_app.tsx"
-          },
-          {
-            "plugin": "ux",
-            "path": "x-pack/plugins/ux/public/application/ux_app.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/add_data/add_data.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx"
-          },
-          {
-            "plugin": "kibanaOverview",
-            "path": "src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx"
-          }
-        ],
-        "children": [
-          {
-            "parentPluginId": "kibanaReact",
-            "id": "def-public.RedirectAppLinks.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "{\n  application,\n  children,\n  className,\n  ...otherProps\n}",
-            "description": [],
-            "signature": [
-              "React.PropsWithChildren<RedirectCrossAppLinksProps>"
-            ],
-            "path": "src/plugins/kibana_react/public/app_links/redirect_app_link.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.toMountPoint",
@@ -2917,59 +2562,59 @@
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/delete_button.tsx"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/extend_button.tsx"
+            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx"
+            "path": "src/plugins/data/public/search/search_service.ts"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/inspect_button.tsx"
+            "path": "src/plugins/data/public/search/search_service.ts"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx"
+            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/session/sessions_mgmt/components/actions/rename_button.tsx"
+            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_service.ts"
+            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
           },
           {
             "plugin": "data",
-            "path": "src/plugins/data/public/search/search_service.ts"
+            "path": "src/plugins/data/public/search/search_interceptor/search_interceptor.ts"
           },
           {
             "plugin": "savedObjects",
@@ -3893,55 +3538,6 @@
         "returnComment": [],
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.ToolbarButton",
-        "type": "Function",
-        "tags": [],
-        "label": "ToolbarButton",
-        "description": [],
-        "signature": [
-          "({ children, className, fontWeight, size, hasArrow, groupPosition, dataTestSubj, ...rest }: React.PropsWithChildren<",
-          {
-            "pluginId": "kibanaReact",
-            "scope": "public",
-            "docId": "kibKibanaReactPluginApi",
-            "section": "def-public.ToolbarButtonProps",
-            "text": "ToolbarButtonProps"
-          },
-          ">) => JSX.Element"
-        ],
-        "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "kibanaReact",
-            "id": "def-public.ToolbarButton.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "{\n  children,\n  className,\n  fontWeight = 'normal',\n  size = 'm',\n  hasArrow = true,\n  groupPosition = 'none',\n  dataTestSubj = '',\n  ...rest\n}",
-            "description": [],
-            "signature": [
-              "React.PropsWithChildren<",
-              {
-                "pluginId": "kibanaReact",
-                "scope": "public",
-                "docId": "kibKibanaReactPluginApi",
-                "section": "def-public.ToolbarButtonProps",
-                "text": "ToolbarButtonProps"
-              },
-              ">"
-            ],
-            "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-            "deprecated": false,
-            "trackAdoption": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.UrlTemplateEditor",
@@ -5691,67 +5287,6 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.POSITIONS",
-        "type": "Array",
-        "tags": [],
-        "label": "POSITIONS",
-        "description": [],
-        "signature": [
-          "(\"none\" | \"right\" | \"left\" | \"center\")[]"
-        ],
-        "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.TOOLBAR_BUTTON_SIZES",
-        "type": "Array",
-        "tags": [],
-        "label": "TOOLBAR_BUTTON_SIZES",
-        "description": [],
-        "signature": [
-          "(\"m\" | \"s\" | undefined)[]"
-        ],
-        "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.ToolbarButtonProps",
-        "type": "Type",
-        "tags": [],
-        "label": "ToolbarButtonProps",
-        "description": [],
-        "signature": [
-          "((",
-          "DisambiguateSet",
-          "<",
-          "EuiButtonPropsForAnchor",
-          ", ",
-          "EuiButtonPropsForButton",
-          "> & ",
-          "EuiButtonProps",
-          " & { onClick?: React.MouseEventHandler<HTMLButtonElement> | undefined; } & React.ButtonHTMLAttributes<HTMLButtonElement> & { buttonRef?: React.Ref<HTMLButtonElement> | undefined; }) | (",
-          "DisambiguateSet",
-          "<",
-          "EuiButtonPropsForButton",
-          ", ",
-          "EuiButtonPropsForAnchor",
-          "> & ",
-          "EuiButtonProps",
-          " & { href?: string | undefined; onClick?: React.MouseEventHandler<HTMLAnchorElement> | undefined; } & React.AnchorHTMLAttributes<HTMLAnchorElement> & { buttonRef?: React.Ref<HTMLAnchorElement> | undefined; })) & { fontWeight?: Weights | undefined; size?: \"m\" | \"s\" | undefined; hasArrow?: boolean | undefined; groupPosition?: \"none\" | \"right\" | \"left\" | \"center\" | undefined; dataTestSubj?: string | undefined; }"
-        ],
-        "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.Value",
@@ -5766,21 +5301,6 @@
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "kibanaReact",
-        "id": "def-public.WEIGHTS",
-        "type": "Array",
-        "tags": [],
-        "label": "WEIGHTS",
-        "description": [],
-        "signature": [
-          "Weights[]"
-        ],
-        "path": "src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
       }
     ],
     "objects": [
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index 22882b08c02f8e..2de9cf5fc08792 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 169 | 0 | 134 | 3 |
+| 161 | 0 | 127 | 3 |
 
 ## Client
 
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index 505cd1eb8ac16b..ca28b725ddd7ea 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index 810752c805ff30..c95eecaf212b3b 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.devdocs.json b/api_docs/lens.devdocs.json
index 74c9767733b921..0808aafa7726d1 100644
--- a/api_docs/lens.devdocs.json
+++ b/api_docs/lens.devdocs.json
@@ -10650,7 +10650,7 @@
           },
           "<",
           "GoalDomainRange",
-          ">; base?: number | undefined; actual?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
+          ">; actual?: number | undefined; base?: number | undefined; bandFillColor?: \"ignore\" | undefined; tickValueFormatter?: \"ignore\" | undefined; labelMajor?: string | ",
           "GoalLabelAccessor",
           " | undefined; labelMinor?: string | ",
           "GoalLabelAccessor",
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index c2f0248c6aa2f6..5f943d19e19c4c 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index b1ccd2542831ff..0b78839bfd9cd8 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 4c76a1a3e2ee4c..b15198d1460fa4 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.devdocs.json b/api_docs/licensing.devdocs.json
index 2d2924491b936c..2fa21b35baeb7e 100644
--- a/api_docs/licensing.devdocs.json
+++ b/api_docs/licensing.devdocs.json
@@ -2208,7 +2208,7 @@
             },
             {
               "plugin": "mapsEms",
-              "path": "src/plugins/maps_ems/server/index.ts"
+              "path": "src/plugins/maps_ems/server/plugin.ts"
             },
             {
               "plugin": "osquery",
@@ -2295,7 +2295,7 @@
           "references": [
             {
               "plugin": "mapsEms",
-              "path": "src/plugins/maps_ems/server/index.ts"
+              "path": "src/plugins/maps_ems/server/plugin.ts"
             }
           ],
           "children": [],
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index 7521a9dc4ac281..404178eee6f7f4 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/links.mdx b/api_docs/links.mdx
index ac1a8616271092..6fef3a10d5d644 100644
--- a/api_docs/links.mdx
+++ b/api_docs/links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/links
 title: "links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the links plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'links']
 ---
 import linksObj from './links.devdocs.json';
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index c19ec2587da2e9..44decb607a9802 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
diff --git a/api_docs/log_explorer.mdx b/api_docs/log_explorer.mdx
index f8dc452b80c8fb..105ccbfe1bf511 100644
--- a/api_docs/log_explorer.mdx
+++ b/api_docs/log_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logExplorer
 title: "logExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logExplorer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logExplorer']
 ---
 import logExplorerObj from './log_explorer.devdocs.json';
diff --git a/api_docs/logs_shared.devdocs.json b/api_docs/logs_shared.devdocs.json
index 7bb6418a73bc78..5e35354e01878e 100644
--- a/api_docs/logs_shared.devdocs.json
+++ b/api_docs/logs_shared.devdocs.json
@@ -1236,7 +1236,7 @@
         "label": "useLogHighlightsStateContext",
         "description": [],
         "signature": [
-          "() => { highlightTerms: string[]; setHighlightTerms: React.Dispatch<React.SetStateAction<string[]>>; logEntryHighlights: ({ topCursor: null; bottomCursor: null; entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "() => { highlightTerms: string[]; setHighlightTerms: React.Dispatch<React.SetStateAction<string[]>>; logEntryHighlights: ({ topCursor: null; bottomCursor: null; entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1252,7 +1252,7 @@
             "section": "def-common.JsonArray",
             "text": "JsonArray"
           },
-          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; } | { topCursor: { time: number; tiebreaker: number; }; bottomCursor: { time: number; tiebreaker: number; }; entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; } | { topCursor: { time: string; tiebreaker: number; }; bottomCursor: { time: string; tiebreaker: number; }; entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1268,7 +1268,7 @@
             "section": "def-common.JsonArray",
             "text": "JsonArray"
           },
-          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; })[]; logEntryHighlightsById: Record<string, { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; })[]; logEntryHighlightsById: Record<string, { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1284,9 +1284,9 @@
             "section": "def-common.JsonArray",
             "text": "JsonArray"
           },
-          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]>; logSummaryHighlights: { start: number; end: number; buckets: ({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: number; tiebreaker: number; }; })[]; }[]; loadLogEntryHighlightsRequest: ",
+          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]>; logSummaryHighlights: { start: number; end: number; buckets: ({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: string; tiebreaker: number; }; })[]; }[]; loadLogEntryHighlightsRequest: ",
           "PromiseState",
-          "<{ data: ({ topCursor: null; bottomCursor: null; entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "<{ data: ({ topCursor: null; bottomCursor: null; entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1302,7 +1302,7 @@
             "section": "def-common.JsonArray",
             "text": "JsonArray"
           },
-          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; } | { topCursor: { time: number; tiebreaker: number; }; bottomCursor: { time: number; tiebreaker: number; }; entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; } | { topCursor: { time: string; tiebreaker: number; }; bottomCursor: { time: string; tiebreaker: number; }; entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1320,8 +1320,14 @@
           },
           "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; })[]; }, unknown>; loadLogSummaryHighlightsRequest: ",
           "PromiseState",
-          "<{ data: { start: number; end: number; buckets: ({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: number; tiebreaker: number; }; })[]; }[]; }, unknown>; currentHighlightKey: ",
-          "UniqueTimeKey",
+          "<{ data: { start: number; end: number; buckets: ({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: string; tiebreaker: number; }; })[]; }[]; }, unknown>; currentHighlightKey: ",
+          {
+            "pluginId": "@kbn/io-ts-utils",
+            "scope": "common",
+            "docId": "kibKbnIoTsUtilsPluginApi",
+            "section": "def-common.UniqueTimeKey",
+            "text": "UniqueTimeKey"
+          },
           " | null; hasPreviousHighlight: boolean; hasNextHighlight: boolean; goToPreviousHighlight: () => void; goToNextHighlight: () => void; }"
         ],
         "path": "x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_highlights.tsx",
@@ -1357,7 +1363,7 @@
         "label": "useLogStreamContext",
         "description": [],
         "signature": [
-          "() => { fetchEntries: () => void; fetchNextEntries: FetchPageCallback; fetchPreviousEntries: FetchPageCallback; fetchNewestEntries: () => void; isLoadingMore: boolean; isReloading: boolean; entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "() => { fetchEntries: () => void; fetchNextEntries: FetchPageCallback; fetchPreviousEntries: FetchPageCallback; fetchNewestEntries: () => void; isLoadingMore: boolean; isReloading: boolean; entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -1373,7 +1379,7 @@
             "section": "def-common.JsonArray",
             "text": "JsonArray"
           },
-          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; topCursor: { time: number; tiebreaker: number; } | null; bottomCursor: { time: number; tiebreaker: number; } | null; hasMoreBefore: boolean; hasMoreAfter: boolean; lastLoadedTime?: Date | undefined; }"
+          "; highlights: string[]; })[]; })[]; context: {} | { 'container.id': string; } | { 'host.name': string; 'log.file.path': string; }; }[]; topCursor: { time: string; tiebreaker: number; } | null; bottomCursor: { time: string; tiebreaker: number; } | null; hasMoreBefore: boolean; hasMoreAfter: boolean; lastLoadedTime?: Date | undefined; }"
         ],
         "path": "x-pack/plugins/logs_shared/public/containers/logs/log_stream/index.ts",
         "deprecated": false,
@@ -2725,7 +2731,7 @@
             "label": "logEntry",
             "description": [],
             "signature": [
-              "{ id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              "{ id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -2755,7 +2761,7 @@
             "label": "highlights",
             "description": [],
             "signature": [
-              "{ id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              "{ id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -3430,7 +3436,7 @@
               },
               ", logView: { logViewId: string; type: \"log-view-reference\"; } | { type: \"log-view-inline\"; id: string; attributes: { name: string; description: string; logIndices: { type: \"data_view\"; dataViewId: string; } | { type: \"index_name\"; indexName: string; }; logColumns: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[]; }; }, params: ",
               "LogEntriesAroundParams",
-              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -3539,7 +3545,7 @@
               },
               ", logView: { logViewId: string; type: \"log-view-reference\"; } | { type: \"log-view-inline\"; id: string; attributes: { name: string; description: string; logIndices: { type: \"data_view\"; dataViewId: string; } | { type: \"index_name\"; indexName: string; }; logColumns: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[]; }; }, params: ",
               "LogEntriesParams",
-              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -3790,7 +3796,7 @@
                 "section": "def-common.JsonObject",
                 "text": "JsonObject"
               },
-              " | undefined) => Promise<({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: number; tiebreaker: number; }; })[][]>"
+              " | undefined) => Promise<({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: string; tiebreaker: number; }; })[][]>"
             ],
             "path": "x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts",
             "deprecated": false,
@@ -4075,7 +4081,7 @@
               },
               ", logView: { logViewId: string; type: \"log-view-reference\"; } | { type: \"log-view-inline\"; id: string; attributes: { name: string; description: string; logIndices: { type: \"data_view\"; dataViewId: string; } | { type: \"index_name\"; indexName: string; }; logColumns: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[]; }; }, params: ",
               "LogEntriesAroundParams",
-              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -4184,7 +4190,7 @@
               },
               ", logView: { logViewId: string; type: \"log-view-reference\"; } | { type: \"log-view-inline\"; id: string; attributes: { name: string; description: string; logIndices: { type: \"data_view\"; dataViewId: string; } | { type: \"index_name\"; indexName: string; }; logColumns: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[]; }; }, params: ",
               "LogEntriesParams",
-              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+              ", columnOverrides?: ({ timestampColumn: { id: string; }; } | { messageColumn: { id: string; }; } | { fieldColumn: { id: string; } & { field: string; }; })[] | undefined) => Promise<{ entries: { id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
               {
                 "pluginId": "@kbn/utility-types",
                 "scope": "common",
@@ -4435,7 +4441,7 @@
                 "section": "def-common.JsonObject",
                 "text": "JsonObject"
               },
-              " | undefined) => Promise<({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: number; tiebreaker: number; }; })[][]>"
+              " | undefined) => Promise<({ start: number; end: number; entriesCount: number; } & { representativeKey: { time: string; tiebreaker: number; }; })[][]>"
             ],
             "path": "x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts",
             "deprecated": false,
@@ -5029,6 +5035,39 @@
       }
     ],
     "functions": [
+      {
+        "parentPluginId": "logsShared",
+        "id": "def-common.convertISODateToNanoPrecision",
+        "type": "Function",
+        "tags": [],
+        "label": "convertISODateToNanoPrecision",
+        "description": [],
+        "signature": [
+          "(date: string) => string"
+        ],
+        "path": "x-pack/plugins/logs_shared/common/utils/date_helpers.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "logsShared",
+            "id": "def-common.convertISODateToNanoPrecision.$1",
+            "type": "string",
+            "tags": [],
+            "label": "date",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "path": "x-pack/plugins/logs_shared/common/utils/date_helpers.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "logsShared",
         "id": "def-common.getLogEntryCursorFromHit",
@@ -5037,7 +5076,7 @@
         "label": "getLogEntryCursorFromHit",
         "description": [],
         "signature": [
-          "(hit: { sort: [number, number]; }) => { time: number; tiebreaker: number; }"
+          "(hit: { sort: [string, number]; }) => { time: string; tiebreaker: number; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
         "deprecated": false,
@@ -5062,7 +5101,7 @@
                 "label": "sort",
                 "description": [],
                 "signature": [
-                  "[number, number]"
+                  "[string, number]"
                 ],
                 "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
                 "deprecated": false,
@@ -5448,7 +5487,7 @@
         "label": "LogColumn",
         "description": [],
         "signature": [
-          "{ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "{ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -5509,7 +5548,7 @@
         "label": "LogEntriesSummaryHighlightsBucket",
         "description": [],
         "signature": [
-          "{ start: number; end: number; entriesCount: number; } & { representativeKey: { time: number; tiebreaker: number; }; }"
+          "{ start: number; end: number; entriesCount: number; } & { representativeKey: { time: string; tiebreaker: number; }; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/http_api/log_entries/v1/summary_highlights.ts",
         "deprecated": false,
@@ -5524,7 +5563,7 @@
         "label": "LogEntry",
         "description": [],
         "signature": [
-          "{ id: string; index: string; cursor: { time: number; tiebreaker: number; }; columns: ({ columnId: string; timestamp: number; } | { columnId: string; field: string; value: ",
+          "{ id: string; index: string; cursor: { time: string; tiebreaker: number; }; columns: ({ columnId: string; time: string; } | { columnId: string; field: string; value: ",
           {
             "pluginId": "@kbn/utility-types",
             "scope": "common",
@@ -5555,7 +5594,7 @@
         "label": "LogEntryAfterCursor",
         "description": [],
         "signature": [
-          "{ after: { time: number; tiebreaker: number; } | \"first\"; }"
+          "{ after: { time: string; tiebreaker: number; } | \"first\"; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
         "deprecated": false,
@@ -5570,7 +5609,7 @@
         "label": "LogEntryAroundCursor",
         "description": [],
         "signature": [
-          "{ center: { time: number; tiebreaker: number; }; }"
+          "{ center: { time: string; tiebreaker: number; }; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
         "deprecated": false,
@@ -5585,7 +5624,7 @@
         "label": "LogEntryBeforeCursor",
         "description": [],
         "signature": [
-          "{ before: { time: number; tiebreaker: number; } | \"last\"; }"
+          "{ before: { time: string; tiebreaker: number; } | \"last\"; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
         "deprecated": false,
@@ -5615,7 +5654,7 @@
         "label": "LogEntryCursor",
         "description": [],
         "signature": [
-          "{ time: number; tiebreaker: number; }"
+          "{ time: string; tiebreaker: number; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts",
         "deprecated": false,
@@ -5653,7 +5692,7 @@
         "label": "LogEntryTime",
         "description": [],
         "signature": [
-          "{ time: number; tiebreaker: number; } & { gid?: string | undefined; fromAutoReload?: boolean | undefined; }"
+          "{ time: string; tiebreaker: number; } & { gid?: string | undefined; fromAutoReload?: boolean | undefined; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry.ts",
         "deprecated": false,
@@ -5820,7 +5859,7 @@
         "label": "LogTimestampColumn",
         "description": [],
         "signature": [
-          "{ columnId: string; timestamp: number; }"
+          "{ columnId: string; time: string; }"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry.ts",
         "deprecated": false,
@@ -6158,8 +6197,8 @@
           "TypeC",
           "<{ columnId: ",
           "StringC",
-          "; timestamp: ",
-          "NumberC",
+          "; time: ",
+          "StringC",
           "; }>, ",
           "TypeC",
           "<{ columnId: ",
@@ -6555,7 +6594,7 @@
           "<[",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>, ",
@@ -6711,7 +6750,7 @@
           "<[",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>, ",
@@ -6865,7 +6904,7 @@
           "<{ center: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; }>]>]>"
@@ -6905,7 +6944,7 @@
           "; cursor: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; columns: ",
@@ -6916,8 +6955,8 @@
           "TypeC",
           "<{ columnId: ",
           "StringC",
-          "; timestamp: ",
-          "NumberC",
+          "; time: ",
+          "StringC",
           "; }>, ",
           "TypeC",
           "<{ columnId: ",
@@ -7003,13 +7042,13 @@
           "<{ topCursor: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; bottomCursor: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; entries: ",
@@ -7023,7 +7062,7 @@
           "; cursor: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; columns: ",
@@ -7034,8 +7073,8 @@
           "TypeC",
           "<{ columnId: ",
           "StringC",
-          "; timestamp: ",
-          "NumberC",
+          "; time: ",
+          "StringC",
           "; }>, ",
           "TypeC",
           "<{ columnId: ",
@@ -7277,7 +7316,7 @@
           "<[",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>, ",
@@ -7301,7 +7340,7 @@
           "<{ center: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; }>"
@@ -7325,7 +7364,7 @@
           "<[",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>, ",
@@ -7377,7 +7416,7 @@
         "signature": [
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>"
@@ -7441,7 +7480,7 @@
           "; cursor: ",
           "TypeC",
           "<{ time: ",
-          "NumberC",
+          "StringC",
           "; tiebreaker: ",
           "NumberC",
           "; }>; columns: ",
@@ -7452,8 +7491,8 @@
           "TypeC",
           "<{ columnId: ",
           "StringC",
-          "; timestamp: ",
-          "NumberC",
+          "; time: ",
+          "StringC",
           "; }>, ",
           "TypeC",
           "<{ columnId: ",
@@ -7774,8 +7813,8 @@
           "TypeC",
           "<{ columnId: ",
           "StringC",
-          "; timestamp: ",
-          "NumberC",
+          "; time: ",
+          "StringC",
           "; }>"
         ],
         "path": "x-pack/plugins/logs_shared/common/log_entry/log_entry.ts",
diff --git a/api_docs/logs_shared.mdx b/api_docs/logs_shared.mdx
index 1bcc3fe34feec6..f84708561f3ddc 100644
--- a/api_docs/logs_shared.mdx
+++ b/api_docs/logs_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logsShared
 title: "logsShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logsShared plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logsShared']
 ---
 import logsSharedObj from './logs_shared.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 287 | 11 | 272 | 28 |
+| 289 | 11 | 274 | 27 |
 
 ## Client
 
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index aa783f0036d36f..4715b32b3c07ce 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.devdocs.json b/api_docs/maps.devdocs.json
index b95d0314243bec..56ef9cf8b744fd 100644
--- a/api_docs/maps.devdocs.json
+++ b/api_docs/maps.devdocs.json
@@ -9,7 +9,7 @@
         "tags": [],
         "label": "DataRequest",
         "description": [],
-        "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+        "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
         "deprecated": false,
         "trackAdoption": false,
         "children": [
@@ -23,7 +23,7 @@
             "signature": [
               "any"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [
@@ -37,7 +37,7 @@
                 "signature": [
                   "DataRequestDescriptor"
                 ],
-                "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+                "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
                 "deprecated": false,
                 "trackAdoption": false,
                 "isRequired": true
@@ -55,7 +55,7 @@
             "signature": [
               "() => object | undefined"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -71,7 +71,7 @@
             "signature": [
               "() => boolean"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -88,7 +88,7 @@
               "() => ",
               "DataRequestMeta"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -104,7 +104,7 @@
             "signature": [
               "() => boolean"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -120,7 +120,7 @@
             "signature": [
               "() => boolean"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -136,7 +136,7 @@
             "signature": [
               "() => string"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -152,7 +152,7 @@
             "signature": [
               "() => symbol | undefined"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
@@ -160,15 +160,15 @@
           },
           {
             "parentPluginId": "maps",
-            "id": "def-public.DataRequest.getError",
+            "id": "def-public.DataRequest.renderError",
             "type": "Function",
             "tags": [],
-            "label": "getError",
+            "label": "renderError",
             "description": [],
             "signature": [
-              "() => string | undefined"
+              "() => React.ReactNode"
             ],
-            "path": "x-pack/plugins/maps/public/classes/util/data_request.ts",
+            "path": "x-pack/plugins/maps/public/classes/util/data_request.tsx",
             "deprecated": false,
             "trackAdoption": false,
             "children": [],
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index f5d502d0bf5a50..62a9a54b192cce 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
diff --git a/api_docs/maps_ems.devdocs.json b/api_docs/maps_ems.devdocs.json
index 697a5dd4c1c2f6..2c555e52a83bc0 100644
--- a/api_docs/maps_ems.devdocs.json
+++ b/api_docs/maps_ems.devdocs.json
@@ -416,251 +416,65 @@
           }
         ],
         "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "mapsEms",
-        "id": "def-server.MapsEmsPlugin",
-        "type": "Class",
-        "tags": [],
-        "label": "MapsEmsPlugin",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "mapsEms",
-            "scope": "server",
-            "docId": "kibMapsEmsPluginApi",
-            "section": "def-server.MapsEmsPlugin",
-            "text": "MapsEmsPlugin"
-          },
-          " implements ",
-          {
-            "pluginId": "@kbn/core-plugins-server",
-            "scope": "common",
-            "docId": "kibKbnCorePluginsServerPluginApi",
-            "section": "def-common.Plugin",
-            "text": "Plugin"
-          },
-          "<",
-          {
-            "pluginId": "mapsEms",
-            "scope": "server",
-            "docId": "kibMapsEmsPluginApi",
-            "section": "def-server.MapsEmsPluginServerSetup",
-            "text": "MapsEmsPluginServerSetup"
-          },
-          ", void, object, object>"
-        ],
-        "path": "src/plugins/maps_ems/server/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPlugin._initializerContext",
-            "type": "Object",
-            "tags": [],
-            "label": "_initializerContext",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "@kbn/core-plugins-server",
-                "scope": "common",
-                "docId": "kibKbnCorePluginsServerPluginApi",
-                "section": "def-common.PluginInitializerContext",
-                "text": "PluginInitializerContext"
-              },
-              "<Readonly<{} & { tilemap: Readonly<{ url?: string | undefined; } & { options: Readonly<{ default?: boolean | undefined; tileSize?: number | undefined; subdomains?: string[] | undefined; errorTileUrl?: string | undefined; tms?: boolean | undefined; reuseTiles?: boolean | undefined; bounds?: number[] | undefined; } & { attribution: string; minZoom: number; maxZoom: number; }>; }>; includeElasticMapsService: boolean; emsUrl: string; emsFileApiUrl: string; emsTileApiUrl: string; emsLandingPageUrl: string; emsFontLibraryUrl: string; emsTileLayerId: Readonly<{} & { dark: string; bright: string; desaturated: string; }>; }>>"
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPlugin.Unnamed",
-            "type": "Function",
-            "tags": [],
-            "label": "Constructor",
-            "description": [],
-            "signature": [
-              "any"
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "mapsEms",
-                "id": "def-server.MapsEmsPlugin.Unnamed.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "initializerContext",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "@kbn/core-plugins-server",
-                    "scope": "common",
-                    "docId": "kibKbnCorePluginsServerPluginApi",
-                    "section": "def-common.PluginInitializerContext",
-                    "text": "PluginInitializerContext"
-                  },
-                  "<Readonly<{} & { tilemap: Readonly<{ url?: string | undefined; } & { options: Readonly<{ default?: boolean | undefined; tileSize?: number | undefined; subdomains?: string[] | undefined; errorTileUrl?: string | undefined; tms?: boolean | undefined; reuseTiles?: boolean | undefined; bounds?: number[] | undefined; } & { attribution: string; minZoom: number; maxZoom: number; }>; }>; includeElasticMapsService: boolean; emsUrl: string; emsFileApiUrl: string; emsTileApiUrl: string; emsLandingPageUrl: string; emsFontLibraryUrl: string; emsTileLayerId: Readonly<{} & { dark: string; bright: string; desaturated: string; }>; }>>"
-                ],
-                "path": "src/plugins/maps_ems/server/index.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPlugin.setup",
-            "type": "Function",
-            "tags": [],
-            "label": "setup",
-            "description": [],
-            "signature": [
-              "(core: ",
-              {
-                "pluginId": "@kbn/core-lifecycle-server",
-                "scope": "common",
-                "docId": "kibKbnCoreLifecycleServerPluginApi",
-                "section": "def-common.CoreSetup",
-                "text": "CoreSetup"
-              },
-              "<object, unknown>, plugins: MapsEmsSetupServerDependencies) => { config: Readonly<{} & { tilemap: Readonly<{ url?: string | undefined; } & { options: Readonly<{ default?: boolean | undefined; tileSize?: number | undefined; subdomains?: string[] | undefined; errorTileUrl?: string | undefined; tms?: boolean | undefined; reuseTiles?: boolean | undefined; bounds?: number[] | undefined; } & { attribution: string; minZoom: number; maxZoom: number; }>; }>; includeElasticMapsService: boolean; emsUrl: string; emsFileApiUrl: string; emsTileApiUrl: string; emsLandingPageUrl: string; emsFontLibraryUrl: string; emsTileLayerId: Readonly<{} & { dark: string; bright: string; desaturated: string; }>; }>; createEMSSettings: () => ",
-              {
-                "pluginId": "mapsEms",
-                "scope": "common",
-                "docId": "kibMapsEmsPluginApi",
-                "section": "def-common.EMSSettings",
-                "text": "EMSSettings"
-              },
-              "; }"
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "mapsEms",
-                "id": "def-server.MapsEmsPlugin.setup.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "core",
-                "description": [],
-                "signature": [
-                  {
-                    "pluginId": "@kbn/core-lifecycle-server",
-                    "scope": "common",
-                    "docId": "kibKbnCoreLifecycleServerPluginApi",
-                    "section": "def-common.CoreSetup",
-                    "text": "CoreSetup"
-                  },
-                  "<object, unknown>"
-                ],
-                "path": "src/plugins/maps_ems/server/index.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "mapsEms",
-                "id": "def-server.MapsEmsPlugin.setup.$2",
-                "type": "Object",
-                "tags": [],
-                "label": "plugins",
-                "description": [],
-                "signature": [
-                  "MapsEmsSetupServerDependencies"
-                ],
-                "path": "src/plugins/maps_ems/server/index.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPlugin.start",
-            "type": "Function",
-            "tags": [],
-            "label": "start",
-            "description": [],
-            "signature": [
-              "() => void"
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [],
-            "returnComment": []
-          }
-        ],
-        "initialIsOpen": false
       }
     ],
     "functions": [],
-    "interfaces": [
-      {
-        "parentPluginId": "mapsEms",
-        "id": "def-server.MapsEmsPluginServerSetup",
-        "type": "Interface",
-        "tags": [],
-        "label": "MapsEmsPluginServerSetup",
-        "description": [],
-        "path": "src/plugins/maps_ems/server/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPluginServerSetup.config",
-            "type": "Object",
-            "tags": [],
-            "label": "config",
-            "description": [],
-            "signature": [
-              "{ readonly tilemap: Readonly<{ url?: string | undefined; } & { options: Readonly<{ default?: boolean | undefined; tileSize?: number | undefined; subdomains?: string[] | undefined; errorTileUrl?: string | undefined; tms?: boolean | undefined; reuseTiles?: boolean | undefined; bounds?: number[] | undefined; } & { attribution: string; minZoom: number; maxZoom: number; }>; }>; readonly includeElasticMapsService: boolean; readonly emsUrl: string; readonly emsFileApiUrl: string; readonly emsTileApiUrl: string; readonly emsLandingPageUrl: string; readonly emsFontLibraryUrl: string; readonly emsTileLayerId: Readonly<{} & { dark: string; bright: string; desaturated: string; }>; }"
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "mapsEms",
-            "id": "def-server.MapsEmsPluginServerSetup.createEMSSettings",
-            "type": "Function",
-            "tags": [],
-            "label": "createEMSSettings",
-            "description": [],
-            "signature": [
-              "() => ",
-              {
-                "pluginId": "mapsEms",
-                "scope": "common",
-                "docId": "kibMapsEmsPluginApi",
-                "section": "def-common.EMSSettings",
-                "text": "EMSSettings"
-              }
-            ],
-            "path": "src/plugins/maps_ems/server/index.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [],
-            "returnComment": []
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
+    "interfaces": [],
     "enums": [],
     "misc": [],
-    "objects": []
+    "objects": [],
+    "setup": {
+      "parentPluginId": "mapsEms",
+      "id": "def-server.MapsEmsPluginServerSetup",
+      "type": "Interface",
+      "tags": [],
+      "label": "MapsEmsPluginServerSetup",
+      "description": [],
+      "path": "src/plugins/maps_ems/server/plugin.ts",
+      "deprecated": false,
+      "trackAdoption": false,
+      "children": [
+        {
+          "parentPluginId": "mapsEms",
+          "id": "def-server.MapsEmsPluginServerSetup.config",
+          "type": "Object",
+          "tags": [],
+          "label": "config",
+          "description": [],
+          "signature": [
+            "{ readonly tilemap: Readonly<{ url?: string | undefined; } & { options: Readonly<{ default?: boolean | undefined; tileSize?: number | undefined; subdomains?: string[] | undefined; errorTileUrl?: string | undefined; tms?: boolean | undefined; reuseTiles?: boolean | undefined; bounds?: number[] | undefined; } & { attribution: string; minZoom: number; maxZoom: number; }>; }>; readonly includeElasticMapsService: boolean; readonly emsUrl: string; readonly emsFileApiUrl: string; readonly emsTileApiUrl: string; readonly emsLandingPageUrl: string; readonly emsFontLibraryUrl: string; readonly emsTileLayerId: Readonly<{} & { dark: string; bright: string; desaturated: string; }>; }"
+          ],
+          "path": "src/plugins/maps_ems/server/plugin.ts",
+          "deprecated": false,
+          "trackAdoption": false
+        },
+        {
+          "parentPluginId": "mapsEms",
+          "id": "def-server.MapsEmsPluginServerSetup.createEMSSettings",
+          "type": "Function",
+          "tags": [],
+          "label": "createEMSSettings",
+          "description": [],
+          "signature": [
+            "() => ",
+            {
+              "pluginId": "mapsEms",
+              "scope": "common",
+              "docId": "kibMapsEmsPluginApi",
+              "section": "def-common.EMSSettings",
+              "text": "EMSSettings"
+            }
+          ],
+          "path": "src/plugins/maps_ems/server/plugin.ts",
+          "deprecated": false,
+          "trackAdoption": false,
+          "children": [],
+          "returnComment": []
+        }
+      ],
+      "lifecycle": "setup",
+      "initialIsOpen": true
+    }
   },
   "common": {
     "classes": [
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index f007519399b52d..6abe3da16aadbb 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis)
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 68 | 0 | 68 | 0 |
+| 60 | 0 | 60 | 0 |
 
 ## Client
 
@@ -39,12 +39,12 @@ Contact [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis)
 
 ## Server
 
+### Setup
+<DocDefinitionList data={[mapsEmsObj.server.setup]}/>
+
 ### Classes
 <DocDefinitionList data={mapsEmsObj.server.classes}/>
 
-### Interfaces
-<DocDefinitionList data={mapsEmsObj.server.interfaces}/>
-
 ## Common
 
 ### Classes
diff --git a/api_docs/metrics_data_access.mdx b/api_docs/metrics_data_access.mdx
index 7852488e4c3944..95b7422071971c 100644
--- a/api_docs/metrics_data_access.mdx
+++ b/api_docs/metrics_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/metricsDataAccess
 title: "metricsDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the metricsDataAccess plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'metricsDataAccess']
 ---
 import metricsDataAccessObj from './metrics_data_access.devdocs.json';
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index 4777f154c8204d..c1ad326590a832 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index 74f95298cc6d23..4b2a335daee9cd 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index d96d48b661d551..14d4b44e3f5209 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.devdocs.json b/api_docs/navigation.devdocs.json
index a0835a4a19476d..00f1ae69aaf035 100644
--- a/api_docs/navigation.devdocs.json
+++ b/api_docs/navigation.devdocs.json
@@ -672,6 +672,24 @@
     ],
     "enums": [],
     "misc": [
+      {
+        "parentPluginId": "navigation",
+        "id": "def-public.TopNavMenuBadgeProps",
+        "type": "Type",
+        "tags": [],
+        "label": "TopNavMenuBadgeProps",
+        "description": [],
+        "signature": [
+          "EuiBadgeProps",
+          " & { badgeText: string; toolTipProps?: Partial<",
+          "EuiToolTipProps",
+          "> | undefined; renderCustomBadge?: ((props: { badgeText: string; }) => React.ReactElement<any, string | React.JSXElementConstructor<any>>) | undefined; }"
+        ],
+        "path": "src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "navigation",
         "id": "def-public.TopNavMenuProps",
@@ -696,7 +714,15 @@
             "section": "def-public.TopNavMenuData",
             "text": "TopNavMenuData"
           },
-          "[] | undefined; badges?: Badge[] | undefined; showSearchBar?: boolean | undefined; showQueryInput?: boolean | undefined; showDatePicker?: boolean | undefined; showFilterBar?: boolean | undefined; unifiedSearch?: ",
+          "[] | undefined; badges?: ",
+          {
+            "pluginId": "navigation",
+            "scope": "public",
+            "docId": "kibNavigationPluginApi",
+            "section": "def-public.TopNavMenuBadgeProps",
+            "text": "TopNavMenuBadgeProps"
+          },
+          "[] | undefined; showSearchBar?: boolean | undefined; showQueryInput?: boolean | undefined; showDatePicker?: boolean | undefined; showFilterBar?: boolean | undefined; unifiedSearch?: ",
           {
             "pluginId": "unifiedSearch",
             "scope": "public",
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index 238e7abab807a2..8e5fe7c5e044dc 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 34 | 0 | 34 | 2 |
+| 35 | 0 | 35 | 2 |
 
 ## Client
 
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index c09b5ff9ce8ba0..3af33a3c7facd6 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/no_data_page.mdx b/api_docs/no_data_page.mdx
index d324fbaf4638fb..81ef92527b9f42 100644
--- a/api_docs/no_data_page.mdx
+++ b/api_docs/no_data_page.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/noDataPage
 title: "noDataPage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the noDataPage plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'noDataPage']
 ---
 import noDataPageObj from './no_data_page.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index 9be02bb30098e5..d46bcbbda45c68 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json
index 0610ed9ace5c93..f0d4f0c019ba55 100644
--- a/api_docs/observability.devdocs.json
+++ b/api_docs/observability.devdocs.json
@@ -3339,7 +3339,7 @@
             "label": "format",
             "description": [],
             "signature": [
-              "(options: { fields: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
+              "(options: { fields: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
               "Maybe",
               "<number>, { defaultValue, extended }?: FormatterOptions) => string; asPercent: (numerator: ",
               "Maybe",
@@ -3358,7 +3358,7 @@
                 "label": "options",
                 "description": [],
                 "signature": [
-                  "{ fields: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
+                  "{ fields: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
                   "Maybe",
                   "<number>, { defaultValue, extended }?: FormatterOptions) => string; asPercent: (numerator: ",
                   "Maybe",
@@ -3566,7 +3566,7 @@
             "label": "fields",
             "description": [],
             "signature": [
-              "OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>> & TAdditionalMetaFields"
+              "OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>> & TAdditionalMetaFields"
             ],
             "path": "x-pack/plugins/observability/public/typings/alerts.ts",
             "deprecated": false,
@@ -4366,7 +4366,7 @@
         "label": "ObservabilityRuleTypeFormatter",
         "description": [],
         "signature": [
-          "(options: { fields: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
+          "(options: { fields: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
           "Maybe",
           "<number>, { defaultValue, extended }?: FormatterOptions) => string; asPercent: (numerator: ",
           "Maybe",
@@ -4385,7 +4385,7 @@
             "label": "options",
             "description": [],
             "signature": [
-              "{ fields: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
+              "{ fields: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & Record<string, any>; formatters: { asDuration: (value: ",
               "Maybe",
               "<number>, { defaultValue, extended }?: FormatterOptions) => string; asPercent: (numerator: ",
               "Maybe",
@@ -8156,7 +8156,29 @@
         "label": "ObservabilityAPIReturnType",
         "description": [],
         "signature": [
-          "{ \"GET /internal/observability/slos/{id}/_instances\": { endpoint: \"GET /internal/observability/slos/{id}/_instances\"; params?: ",
+          "{ \"POST /api/observability/slos/{id}/_reset 2023-10-31\": { endpoint: \"POST /api/observability/slos/{id}/_reset 2023-10-31\"; params?: ",
+          "TypeC",
+          "<{ path: ",
+          "TypeC",
+          "<{ id: ",
+          "StringC",
+          "; }>; }> | undefined; handler: ({}: ",
+          {
+            "pluginId": "observability",
+            "scope": "server",
+            "docId": "kibObservabilityPluginApi",
+            "section": "def-server.ObservabilityRouteHandlerResources",
+            "text": "ObservabilityRouteHandlerResources"
+          },
+          " & { params: { path: { id: string; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }>; } & ",
+          {
+            "pluginId": "observability",
+            "scope": "server",
+            "docId": "kibObservabilityPluginApi",
+            "section": "def-server.ObservabilityRouteCreateOptions",
+            "text": "ObservabilityRouteCreateOptions"
+          },
+          "; \"GET /internal/observability/slos/{id}/_instances\": { endpoint: \"GET /internal/observability/slos/{id}/_instances\"; params?: ",
           "TypeC",
           "<{ path: ",
           "TypeC",
@@ -9082,7 +9104,7 @@
             "section": "def-common.Duration",
             "text": "Duration"
           },
-          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
+          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -9116,7 +9138,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
+          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -9158,7 +9180,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
+          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -9166,12 +9188,18 @@
             "section": "def-server.ObservabilityRouteCreateOptions",
             "text": "ObservabilityRouteCreateOptions"
           },
-          "; \"GET /internal/observability/slos/_definitions\": { endpoint: \"GET /internal/observability/slos/_definitions\"; params?: ",
-          "TypeC",
+          "; \"GET /api/observability/slos/_definitions 2023-10-31\": { endpoint: \"GET /api/observability/slos/_definitions 2023-10-31\"; params?: ",
+          "PartialC",
           "<{ query: ",
-          "TypeC",
+          "PartialC",
           "<{ search: ",
           "StringC",
+          "; includeOutdatedOnly: ",
+          "Type",
+          "<boolean, boolean, unknown>; page: ",
+          "StringC",
+          "; perPage: ",
+          "StringC",
           "; }>; }> | undefined; handler: ({}: ",
           {
             "pluginId": "observability",
@@ -9180,7 +9208,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
+          " & { params?: { query?: { search?: string | undefined; includeOutdatedOnly?: boolean | undefined; page?: string | undefined; perPage?: string | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -9860,7 +9888,29 @@
         "label": "ObservabilityServerRouteRepository",
         "description": [],
         "signature": [
-          "{ \"GET /internal/observability/slos/{id}/_instances\": { endpoint: \"GET /internal/observability/slos/{id}/_instances\"; params?: ",
+          "{ \"POST /api/observability/slos/{id}/_reset 2023-10-31\": { endpoint: \"POST /api/observability/slos/{id}/_reset 2023-10-31\"; params?: ",
+          "TypeC",
+          "<{ path: ",
+          "TypeC",
+          "<{ id: ",
+          "StringC",
+          "; }>; }> | undefined; handler: ({}: ",
+          {
+            "pluginId": "observability",
+            "scope": "server",
+            "docId": "kibObservabilityPluginApi",
+            "section": "def-server.ObservabilityRouteHandlerResources",
+            "text": "ObservabilityRouteHandlerResources"
+          },
+          " & { params: { path: { id: string; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }>; } & ",
+          {
+            "pluginId": "observability",
+            "scope": "server",
+            "docId": "kibObservabilityPluginApi",
+            "section": "def-server.ObservabilityRouteCreateOptions",
+            "text": "ObservabilityRouteCreateOptions"
+          },
+          "; \"GET /internal/observability/slos/{id}/_instances\": { endpoint: \"GET /internal/observability/slos/{id}/_instances\"; params?: ",
           "TypeC",
           "<{ path: ",
           "TypeC",
@@ -10786,7 +10836,7 @@
             "section": "def-common.Duration",
             "text": "Duration"
           },
-          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
+          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10820,7 +10870,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
+          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10862,7 +10912,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
+          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10870,12 +10920,18 @@
             "section": "def-server.ObservabilityRouteCreateOptions",
             "text": "ObservabilityRouteCreateOptions"
           },
-          "; \"GET /internal/observability/slos/_definitions\": { endpoint: \"GET /internal/observability/slos/_definitions\"; params?: ",
-          "TypeC",
+          "; \"GET /api/observability/slos/_definitions 2023-10-31\": { endpoint: \"GET /api/observability/slos/_definitions 2023-10-31\"; params?: ",
+          "PartialC",
           "<{ query: ",
-          "TypeC",
+          "PartialC",
           "<{ search: ",
           "StringC",
+          "; includeOutdatedOnly: ",
+          "Type",
+          "<boolean, boolean, unknown>; page: ",
+          "StringC",
+          "; perPage: ",
+          "StringC",
           "; }>; }> | undefined; handler: ({}: ",
           {
             "pluginId": "observability",
@@ -10884,7 +10940,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
+          " & { params?: { query?: { search?: string | undefined; includeOutdatedOnly?: boolean | undefined; page?: string | undefined; perPage?: string | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; total: { metrics: (({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }))[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; version: number; } & { instanceId?: string | undefined; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 3628c75b6ceeda..0c57a24e4c4493 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
diff --git a/api_docs/observability_a_i_assistant.devdocs.json b/api_docs/observability_a_i_assistant.devdocs.json
index 9ef9ee9d5273f9..29b5cec0de5078 100644
--- a/api_docs/observability_a_i_assistant.devdocs.json
+++ b/api_docs/observability_a_i_assistant.devdocs.json
@@ -415,7 +415,7 @@
           "Type",
           "<boolean, boolean, unknown>; }>]>; }> | undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
-          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
+          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
           "ObservabilityAIAssistantRouteCreateOptions",
           "; \"GET /internal/observability_ai_assistant/functions/kb_status\": { endpoint: \"GET /internal/observability_ai_assistant/functions/kb_status\"; params?: undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
@@ -814,7 +814,7 @@
           "Type",
           "<boolean, boolean, unknown>; }>]>; }> | undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
-          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
+          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
           "ObservabilityAIAssistantRouteCreateOptions",
           "; \"GET /internal/observability_ai_assistant/functions/kb_status\": { endpoint: \"GET /internal/observability_ai_assistant/functions/kb_status\"; params?: undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
@@ -1319,7 +1319,7 @@
           "Type",
           "<boolean, boolean, unknown>; }>]>; }> | undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
-          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
+          " & { params: { body: { featureIds: string[]; start: string; end: string; } & { filter?: string | undefined; includeRecovered?: boolean | undefined; }; }; }) => Promise<{ content: { total: number; alerts: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>[]; }; }>; } & ",
           "ObservabilityAIAssistantRouteCreateOptions",
           "; \"GET /internal/observability_ai_assistant/functions/kb_status\": { endpoint: \"GET /internal/observability_ai_assistant/functions/kb_status\"; params?: undefined; handler: ({}: ",
           "ObservabilityAIAssistantRouteHandlerResources",
diff --git a/api_docs/observability_a_i_assistant.mdx b/api_docs/observability_a_i_assistant.mdx
index 3af073c1f66f04..dca8e221f5e7ab 100644
--- a/api_docs/observability_a_i_assistant.mdx
+++ b/api_docs/observability_a_i_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityAIAssistant
 title: "observabilityAIAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityAIAssistant plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityAIAssistant']
 ---
 import observabilityAIAssistantObj from './observability_a_i_assistant.devdocs.json';
diff --git a/api_docs/observability_log_explorer.mdx b/api_docs/observability_log_explorer.mdx
index 156ff2060adf6c..a49295da03a0fa 100644
--- a/api_docs/observability_log_explorer.mdx
+++ b/api_docs/observability_log_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityLogExplorer
 title: "observabilityLogExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityLogExplorer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityLogExplorer']
 ---
 import observabilityLogExplorerObj from './observability_log_explorer.devdocs.json';
diff --git a/api_docs/observability_onboarding.mdx b/api_docs/observability_onboarding.mdx
index 395daffaed93d1..7d96d1aca7a949 100644
--- a/api_docs/observability_onboarding.mdx
+++ b/api_docs/observability_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityOnboarding
 title: "observabilityOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityOnboarding plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityOnboarding']
 ---
 import observabilityOnboardingObj from './observability_onboarding.devdocs.json';
diff --git a/api_docs/observability_shared.mdx b/api_docs/observability_shared.mdx
index 49b4b7060b8f74..5b32bb8b68359b 100644
--- a/api_docs/observability_shared.mdx
+++ b/api_docs/observability_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityShared
 title: "observabilityShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityShared plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityShared']
 ---
 import observabilitySharedObj from './observability_shared.devdocs.json';
diff --git a/api_docs/osquery.devdocs.json b/api_docs/osquery.devdocs.json
index 915835e36711ba..f03a3b873a0caf 100644
--- a/api_docs/osquery.devdocs.json
+++ b/api_docs/osquery.devdocs.json
@@ -301,7 +301,7 @@
           "label": "createActionService",
           "description": [],
           "signature": [
-            "{ create: (params: { agent_ids?: string[] | undefined; agent_all?: boolean | undefined; agent_platforms?: string[] | undefined; agent_policy_ids?: string[] | undefined; query?: string | undefined; queries?: { id: string; query: string; ecs_mapping: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; version: string | undefined; platform: string | undefined; removed: boolean | undefined; snapshot: boolean | undefined; }[] | undefined; saved_query_id?: string | undefined; ecs_mapping?: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; pack_id?: string | undefined; alert_ids?: string[] | undefined; case_ids?: string[] | undefined; event_ids?: string[] | undefined; metadata?: object | undefined; }, alertData?: OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined) => Promise<{ response: { action_id: string; '@timestamp': string; expiration: string; type: string; input_type: string; alert_ids: string[] | undefined; event_ids: string[] | undefined; case_ids: string[] | undefined; agent_ids: string[] | undefined; agent_all: boolean | undefined; agent_platforms: string[] | undefined; agent_policy_ids: string[] | undefined; agents: string[]; user_id: string | undefined; metadata: object | undefined; pack_id: string | undefined; pack_name: string | undefined; pack_prebuilt: boolean | undefined; queries: ",
+            "{ create: (params: { agent_ids?: string[] | undefined; agent_all?: boolean | undefined; agent_platforms?: string[] | undefined; agent_policy_ids?: string[] | undefined; query?: string | undefined; queries?: { id: string; query: string; ecs_mapping: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; version: string | undefined; platform: string | undefined; removed: boolean | undefined; snapshot: boolean | undefined; }[] | undefined; saved_query_id?: string | undefined; timeout?: number | undefined; ecs_mapping?: { [x: string]: { field?: string | undefined; value?: string | string[] | undefined; }; } | undefined; pack_id?: string | undefined; alert_ids?: string[] | undefined; case_ids?: string[] | undefined; event_ids?: string[] | undefined; metadata?: object | undefined; }, alertData?: OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined) => Promise<{ response: { action_id: string; '@timestamp': string; expiration: string; type: string; input_type: string; alert_ids: string[] | undefined; event_ids: string[] | undefined; case_ids: string[] | undefined; agent_ids: string[] | undefined; agent_all: boolean | undefined; agent_platforms: string[] | undefined; agent_policy_ids: string[] | undefined; agents: string[]; user_id: string | undefined; metadata: object | undefined; pack_id: string | undefined; pack_name: string | undefined; pack_prebuilt: boolean | undefined; queries: ",
             "Dictionary",
             "<any>[]; }; fleetActionsCount: number; }>; stop: () => void; }"
           ],
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index 48b66b1e51692d..34c0045ada1907 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/painless_lab.mdx b/api_docs/painless_lab.mdx
index 57e905be4b5af7..fbebc63aaa1f86 100644
--- a/api_docs/painless_lab.mdx
+++ b/api_docs/painless_lab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/painlessLab
 title: "painlessLab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the painlessLab plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'painlessLab']
 ---
 import painlessLabObj from './painless_lab.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 898241c4b14130..bb621aec7465ad 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -15,13 +15,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams |
 |--------------|----------|------------------------|
-| 700 | 592 | 41 |
+| 711 | 603 | 40 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 76089 | 233 | 65049 | 1597 |
+| 76352 | 233 | 65301 | 1602 |
 
 ## Plugin Directory
 
@@ -30,7 +30,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibActionsPluginApi" text="actions"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 269 | 0 | 263 | 31 |
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [@elastic/appex-sharedux @elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 17 | 1 | 15 | 2 |
 | <DocLink id="kibAiopsPluginApi" text="aiops"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | AIOps plugin maintained by ML team. | 69 | 1 | 4 | 1 |
-| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 809 | 1 | 778 | 50 |
+| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 810 | 1 | 779 | 50 |
 | <DocLink id="kibApmPluginApi" text="apm"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | The user interface for Elastic APM | 29 | 0 | 29 | 120 |
 | <DocLink id="kibApmDataAccessPluginApi" text="apmDataAccess"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibAssetManagerPluginApi" text="assetManager"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | Asset manager plugin for entity assets (inventory, topology, etc) | 9 | 0 | 9 | 2 |
@@ -56,14 +56,15 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 268 | 0 | 249 | 1 |
 | <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 109 | 0 | 106 | 11 |
 | <DocLink id="kibDashboardEnhancedPluginApi" text="dashboardEnhanced"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | - | 54 | 0 | 51 | 0 |
-| <DocLink id="kibDataPluginApi" text="data"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3193 | 32 | 2542 | 22 |
+| <DocLink id="kibDataPluginApi" text="data"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3197 | 32 | 2545 | 22 |
 | <DocLink id="kibDataViewEditorPluginApi" text="dataViewEditor"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin provides the ability to create data views via a modal flyout inside Kibana apps | 35 | 0 | 25 | 5 |
 | <DocLink id="kibDataViewFieldEditorPluginApi" text="dataViewFieldEditor"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Reusable data view field editor across Kibana | 72 | 0 | 33 | 0 |
 | <DocLink id="kibDataViewManagementPluginApi" text="dataViewManagement"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data view management app | 2 | 0 | 2 | 0 |
-| <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 918 | 0 | 255 | 4 |
+| <DocLink id="kibDataViewsPluginApi" text="dataViews"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 922 | 0 | 257 | 4 |
 | <DocLink id="kibDataVisualizerPluginApi" text="dataVisualizer"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 31 | 3 | 25 | 1 |
+| <DocLink id="kibDatasetQualityPluginApi" text="datasetQuality"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | This plugin introduces the concept of dataset quality, where users can easily get an overview on the datasets they have. | 3 | 0 | 3 | 0 |
 | <DocLink id="kibDevToolsPluginApi" text="devTools"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 12 | 0 | 10 | 3 |
-| <DocLink id="kibDiscoverPluginApi" text="discover"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 130 | 0 | 87 | 18 |
+| <DocLink id="kibDiscoverPluginApi" text="discover"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 133 | 0 | 90 | 20 |
 | <DocLink id="kibDiscoverEnhancedPluginApi" text="discoverEnhanced"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 37 | 0 | 35 | 2 |
 | <DocLink id="kibEcsDataQualityDashboardPluginApi" text="ecsDataQualityDashboard"/> | [@elastic/security-threat-hunting-investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | APIs used to assess the quality of data in Elasticsearch indexes | 2 | 0 | 0 | 0 |
 | <DocLink id="kibElasticAssistantPluginApi" text="elasticAssistant"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | Server APIs for the Elastic AI Assistant | 4 | 0 | 2 | 0 |
@@ -93,7 +94,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibFeaturesPluginApi" text="features"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 235 | 0 | 99 | 2 |
 | <DocLink id="kibFieldFormatsPluginApi" text="fieldFormats"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Index pattern fields and ambiguous values formatters | 292 | 5 | 253 | 3 |
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 59 | 0 | 59 | 2 |
-| <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 239 | 0 | 24 | 9 |
+| <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 240 | 0 | 24 | 9 |
 | <DocLink id="kibFilesManagementPluginApi" text="filesManagement"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 0 | 2 | 0 |
 | <DocLink id="kibFleetPluginApi" text="fleet"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1212 | 3 | 1094 | 46 |
 | ftrApis | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
@@ -106,14 +107,14 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibHomePluginApi" text="home"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 149 | 0 | 109 | 0 |
 | <DocLink id="kibImageEmbeddablePluginApi" text="imageEmbeddable"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Image embeddable | 3 | 0 | 3 | 1 |
 | <DocLink id="kibIndexLifecycleManagementPluginApi" text="indexLifecycleManagement"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 4 | 0 | 4 | 0 |
-| <DocLink id="kibIndexManagementPluginApi" text="indexManagement"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 206 | 0 | 201 | 4 |
+| <DocLink id="kibIndexManagementPluginApi" text="indexManagement"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 215 | 0 | 210 | 4 |
 | <DocLink id="kibInfraPluginApi" text="infra"/> | [@elastic/infra-monitoring-ui](https://github.com/orgs/elastic/teams/infra-monitoring-ui) | This plugin visualizes data from Filebeat and Metricbeat, and integrates with other Observability solutions | 32 | 0 | 29 | 8 |
 | ingestPipelines | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 0 | 0 | 0 | 0 |
 | inputControlVis | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Input Control visualization to Kibana | 0 | 0 | 0 | 0 |
 | <DocLink id="kibInspectorPluginApi" text="inspector"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | - | 123 | 2 | 96 | 4 |
 | <DocLink id="kibInteractiveSetupPluginApi" text="interactiveSetup"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides UI and APIs for the interactive setup mode. | 28 | 0 | 18 | 0 |
 | <DocLink id="kibKibanaOverviewPluginApi" text="kibanaOverview"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 6 | 0 | 6 | 0 |
-| <DocLink id="kibKibanaReactPluginApi" text="kibanaReact"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 169 | 0 | 134 | 3 |
+| <DocLink id="kibKibanaReactPluginApi" text="kibanaReact"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 161 | 0 | 127 | 3 |
 | kibanaUsageCollection | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibKibanaUtilsPluginApi" text="kibanaUtils"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 610 | 3 | 417 | 9 |
 | <DocLink id="kibKubernetesSecurityPluginApi" text="kubernetesSecurity"/> | [@elastic/kibana-cloud-security-posture](https://github.com/orgs/elastic/teams/kibana-cloud-security-posture) | - | 5 | 0 | 5 | 1 |
@@ -124,16 +125,16 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibLinksPluginApi" text="links"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | A dashboard panel for creating links to dashboards or external links. | 64 | 0 | 62 | 7 |
 | <DocLink id="kibListsPluginApi" text="lists"/> | [@elastic/security-detection-engine](https://github.com/orgs/elastic/teams/security-detection-engine) | - | 224 | 0 | 96 | 51 |
 | <DocLink id="kibLogExplorerPluginApi" text="logExplorer"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | This plugin provides a LogExplorer component using the Discover customization framework, offering several affordances specifically designed for log consumption. | 26 | 0 | 26 | 8 |
-| <DocLink id="kibLogsSharedPluginApi" text="logsShared"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | Exposes the shared components and APIs to access and visualize logs. | 287 | 11 | 272 | 28 |
+| <DocLink id="kibLogsSharedPluginApi" text="logsShared"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | Exposes the shared components and APIs to access and visualize logs. | 289 | 11 | 274 | 27 |
 | logstash | [@elastic/logstash](https://github.com/orgs/elastic/teams/logstash) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibManagementPluginApi" text="management"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 45 | 0 | 45 | 7 |
 | <DocLink id="kibMapsPluginApi" text="maps"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 260 | 0 | 259 | 29 |
-| <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 68 | 0 | 68 | 0 |
+| <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 60 | 0 | 60 | 0 |
 | <DocLink id="kibMetricsDataAccessPluginApi" text="metricsDataAccess"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | Exposes utilities for accessing metrics data | 104 | 8 | 104 | 4 |
 | <DocLink id="kibMlPluginApi" text="ml"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 150 | 3 | 64 | 33 |
 | <DocLink id="kibMonitoringPluginApi" text="monitoring"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 15 | 3 | 13 | 1 |
 | <DocLink id="kibMonitoringCollectionPluginApi" text="monitoringCollection"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 9 | 0 | 9 | 0 |
-| <DocLink id="kibNavigationPluginApi" text="navigation"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 34 | 0 | 34 | 2 |
+| <DocLink id="kibNavigationPluginApi" text="navigation"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 35 | 0 | 35 | 2 |
 | <DocLink id="kibNewsfeedPluginApi" text="newsfeed"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 17 | 0 | 17 | 0 |
 | <DocLink id="kibNoDataPagePluginApi" text="noDataPage"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibNotificationsPluginApi" text="notifications"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 2 | 1 |
@@ -148,7 +149,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibProfilingPluginApi" text="profiling"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 16 | 1 | 16 | 0 |
 | <DocLink id="kibProfilingDataAccessPluginApi" text="profilingDataAccess"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 22 | 0 | 22 | 7 |
 | <DocLink id="kibRemoteClustersPluginApi" text="remoteClusters"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 23 | 0 | 23 | 0 |
-| <DocLink id="kibReportingPluginApi" text="reporting"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Reporting Services enables applications to feature reports that the user can automate with Watcher and download later. | 42 | 0 | 22 | 5 |
+| <DocLink id="kibReportingPluginApi" text="reporting"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Reporting Services enables applications to feature reports that the user can automate with Watcher and download later. | 22 | 0 | 6 | 0 |
 | <DocLink id="kibRollupPluginApi" text="rollup"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 21 | 0 | 21 | 0 |
 | <DocLink id="kibRuleRegistryPluginApi" text="ruleRegistry"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 267 | 0 | 238 | 14 |
 | <DocLink id="kibRuntimeFieldsPluginApi" text="runtimeFields"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 24 | 0 | 19 | 2 |
@@ -159,10 +160,10 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibSavedObjectsTaggingOssPluginApi" text="savedObjectsTaggingOss"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 104 | 0 | 56 | 1 |
 | <DocLink id="kibSavedSearchPluginApi" text="savedSearch"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the definition and helper methods around saved searches, used by discover and visualizations. | 75 | 0 | 74 | 3 |
 | <DocLink id="kibScreenshotModePluginApi" text="screenshotMode"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 32 | 0 | 13 | 0 |
-| <DocLink id="kibScreenshottingPluginApi" text="screenshotting"/> | [@elastic/kibana-reporting-services](https://github.com/orgs/elastic/teams/kibana-reporting-services) | Kibana Screenshotting Plugin | 27 | 0 | 8 | 5 |
+| <DocLink id="kibScreenshottingPluginApi" text="screenshotting"/> | [@elastic/kibana-reporting-services](https://github.com/orgs/elastic/teams/kibana-reporting-services) | Kibana Screenshotting Plugin | 32 | 0 | 8 | 4 |
 | searchprofiler | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibSecurityPluginApi" text="security"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides authentication and authorization features, and exposes functionality to understand the capabilities of the currently authenticated user. | 270 | 0 | 87 | 3 |
-| <DocLink id="kibSecuritySolutionPluginApi" text="securitySolution"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | - | 174 | 0 | 106 | 35 |
+| <DocLink id="kibSecuritySolutionPluginApi" text="securitySolution"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | - | 175 | 0 | 106 | 35 |
 | <DocLink id="kibSecuritySolutionEssPluginApi" text="securitySolutionEss"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | ESS customizations for Security Solution. | 6 | 0 | 6 | 0 |
 | <DocLink id="kibSecuritySolutionServerlessPluginApi" text="securitySolutionServerless"/> | [@elastic/security-solution](https://github.com/orgs/elastic/teams/security-solution) | Serverless customizations for security. | 7 | 0 | 7 | 0 |
 | <DocLink id="kibServerlessPluginApi" text="serverless"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | The core Serverless plugin, providing APIs to Serverless Project plugins. | 19 | 0 | 18 | 0 |
@@ -175,7 +176,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibStackAlertsPluginApi" text="stackAlerts"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 23 | 0 | 23 | 3 |
 | <DocLink id="kibStackConnectorsPluginApi" text="stackConnectors"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 4 | 0 | 4 | 1 |
 | synthetics | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | This plugin visualizes data from Synthetics and Heartbeat, and integrates with other Observability solutions. | 0 | 0 | 0 | 0 |
-| <DocLink id="kibTaskManagerPluginApi" text="taskManager"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 96 | 0 | 53 | 6 |
+| <DocLink id="kibTaskManagerPluginApi" text="taskManager"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 105 | 0 | 62 | 5 |
 | <DocLink id="kibTelemetryPluginApi" text="telemetry"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 45 | 0 | 1 | 0 |
 | <DocLink id="kibTelemetryCollectionManagerPluginApi" text="telemetryCollectionManager"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 31 | 0 | 26 | 6 |
 | <DocLink id="kibTelemetryCollectionXpackPluginApi" text="telemetryCollectionXpack"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 1 | 0 | 1 | 0 |
@@ -185,7 +186,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibTimelinesPluginApi" text="timelines"/> | [@elastic/security-threat-hunting-investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | - | 240 | 1 | 196 | 17 |
 | <DocLink id="kibTransformPluginApi" text="transform"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics. | 4 | 0 | 4 | 1 |
 | translations | [@elastic/kibana-localization](https://github.com/orgs/elastic/teams/kibana-localization) | - | 0 | 0 | 0 | 0 |
-| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 581 | 1 | 555 | 55 |
+| <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 583 | 1 | 557 | 55 |
 | <DocLink id="kibUiActionsPluginApi" text="uiActions"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Adds UI Actions service to Kibana | 145 | 0 | 103 | 9 |
 | <DocLink id="kibUiActionsEnhancedPluginApi" text="uiActionsEnhanced"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Extends UI Actions plugin with more functionality | 212 | 0 | 145 | 10 |
 | <DocLink id="kibUnifiedDocViewerPluginApi" text="unifiedDocViewer"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains services reliant on the plugin lifecycle for the unified doc viewer component (see @kbn/unified-doc-viewer). | 13 | 0 | 10 | 3 |
@@ -226,6 +227,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnAlertsUiSharedPluginApi" text="@kbn/alerts-ui-shared"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 11 | 0 | 10 | 1 |
 | <DocLink id="kibKbnAnalyticsPluginApi" text="@kbn/analytics"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 73 | 0 | 73 | 2 |
 | <DocLink id="kibKbnAnalyticsClientPluginApi" text="@kbn/analytics-client"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 98 | 0 | 0 | 0 |
+| <DocLink id="kibKbnAnalyticsCollectionUtilsPluginApi" text="@kbn/analytics-collection-utils"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 1 | 0 | 0 | 0 |
 | <DocLink id="kibKbnAnalyticsShippersElasticV3BrowserPluginApi" text="@kbn/analytics-shippers-elastic-v3-browser"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 19 | 0 | 0 | 0 |
 | <DocLink id="kibKbnAnalyticsShippersElasticV3CommonPluginApi" text="@kbn/analytics-shippers-elastic-v3-common"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 23 | 0 | 0 | 0 |
 | <DocLink id="kibKbnAnalyticsShippersElasticV3ServerPluginApi" text="@kbn/analytics-shippers-elastic-v3-server"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 19 | 0 | 0 | 0 |
@@ -456,8 +458,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnFtrCommonFunctionalServicesPluginApi" text="@kbn/ftr-common-functional-services"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 29 | 0 | 29 | 1 |
 | <DocLink id="kibKbnGeneratePluginApi" text="@kbn/generate"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 1 | 0 | 0 | 0 |
 | <DocLink id="kibKbnGenerateConsoleDefinitionsPluginApi" text="@kbn/generate-console-definitions"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 1 | 0 | 1 | 0 |
-| <DocLink id="kibKbnGenerateCsvPluginApi" text="@kbn/generate-csv"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 10 | 0 | 10 | 0 |
-| <DocLink id="kibKbnGenerateCsvTypesPluginApi" text="@kbn/generate-csv-types"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 10 | 0 | 10 | 0 |
+| <DocLink id="kibKbnGenerateCsvPluginApi" text="@kbn/generate-csv"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 10 | 0 | 10 | 1 |
 | <DocLink id="kibKbnGuidedOnboardingPluginApi" text="@kbn/guided-onboarding"/> | [@elastic/platform-onboarding](https://github.com/orgs/elastic/teams/platform-onboarding) | - | 54 | 0 | 52 | 3 |
 | <DocLink id="kibKbnHandlebarsPluginApi" text="@kbn/handlebars"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 33 | 3 | 24 | 6 |
 | <DocLink id="kibKbnHapiMocksPluginApi" text="@kbn/hapi-mocks"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 3 | 0 | 3 | 0 |
@@ -469,7 +470,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnImportResolverPluginApi" text="@kbn/import-resolver"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 47 | 0 | 40 | 0 |
 | <DocLink id="kibKbnInfraForgePluginApi" text="@kbn/infra-forge"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibKbnInterpreterPluginApi" text="@kbn/interpreter"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 52 | 12 | 43 | 0 |
-| <DocLink id="kibKbnIoTsUtilsPluginApi" text="@kbn/io-ts-utils"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 52 | 0 | 52 | 4 |
+| <DocLink id="kibKbnIoTsUtilsPluginApi" text="@kbn/io-ts-utils"/> | [@elastic/obs-knowledge-team](https://github.com/orgs/elastic/teams/obs-knowledge-team) | - | 58 | 0 | 58 | 4 |
 | <DocLink id="kibKbnJestSerializersPluginApi" text="@kbn/jest-serializers"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 13 | 0 | 13 | 0 |
 | <DocLink id="kibKbnJourneysPluginApi" text="@kbn/journeys"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 85 | 0 | 77 | 6 |
 | <DocLink id="kibKbnJsonAstPluginApi" text="@kbn/json-ast"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 41 | 2 | 35 | 0 |
@@ -493,7 +494,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnManagementStorybookConfigPluginApi" text="@kbn/management-storybook-config"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnMapboxGlPluginApi" text="@kbn/mapbox-gl"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 592 | 1 | 1 | 0 |
 | <DocLink id="kibKbnMapsVectorTileUtilsPluginApi" text="@kbn/maps-vector-tile-utils"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 2 | 0 | 2 | 0 |
-| <DocLink id="kibKbnMlAggUtilsPluginApi" text="@kbn/ml-agg-utils"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 99 | 2 | 0 | 0 |
+| <DocLink id="kibKbnMlAggUtilsPluginApi" text="@kbn/ml-agg-utils"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 95 | 2 | 0 | 0 |
 | <DocLink id="kibKbnMlAnomalyUtilsPluginApi" text="@kbn/ml-anomaly-utils"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 206 | 3 | 1 | 0 |
 | <DocLink id="kibKbnMlCategoryValidatorPluginApi" text="@kbn/ml-category-validator"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 37 | 0 | 0 | 0 |
 | <DocLink id="kibKbnMlChi2testPluginApi" text="@kbn/ml-chi2test"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 12 | 0 | 0 | 0 |
@@ -518,12 +519,12 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnMlUrlStatePluginApi" text="@kbn/ml-url-state"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | - | 31 | 1 | 24 | 1 |
 | <DocLink id="kibKbnMonacoPluginApi" text="@kbn/monaco"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 78 | 0 | 76 | 3 |
 | <DocLink id="kibKbnObjectVersioningPluginApi" text="@kbn/object-versioning"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 55 | 1 | 50 | 0 |
-| <DocLink id="kibKbnObservabilityAlertDetailsPluginApi" text="@kbn/observability-alert-details"/> | [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) | - | 13 | 0 | 13 | 3 |
-| <DocLink id="kibKbnObservabilityAlertingTestDataPluginApi" text="@kbn/observability-alerting-test-data"/> | [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) | - | 99 | 1 | 99 | 0 |
+| <DocLink id="kibKbnObservabilityAlertDetailsPluginApi" text="@kbn/observability-alert-details"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 13 | 0 | 13 | 3 |
+| <DocLink id="kibKbnObservabilityAlertingTestDataPluginApi" text="@kbn/observability-alerting-test-data"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 99 | 1 | 99 | 0 |
 | <DocLink id="kibKbnOpenapiGeneratorPluginApi" text="@kbn/openapi-generator"/> | [@elastic/security-detection-rule-management](https://github.com/orgs/elastic/teams/security-detection-rule-management) | - | 7 | 0 | 7 | 0 |
 | <DocLink id="kibKbnOptimizerPluginApi" text="@kbn/optimizer"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 45 | 0 | 45 | 10 |
 | <DocLink id="kibKbnOptimizerWebpackHelpersPluginApi" text="@kbn/optimizer-webpack-helpers"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 51 | 5 | 34 | 0 |
-| <DocLink id="kibKbnOsqueryIoTsTypesPluginApi" text="@kbn/osquery-io-ts-types"/> | [@elastic/security-asset-management](https://github.com/orgs/elastic/teams/security-asset-management) | - | 62 | 0 | 62 | 0 |
+| <DocLink id="kibKbnOsqueryIoTsTypesPluginApi" text="@kbn/osquery-io-ts-types"/> | [@elastic/security-asset-management](https://github.com/orgs/elastic/teams/security-asset-management) | - | 66 | 0 | 66 | 0 |
 | <DocLink id="kibKbnPerformanceTestingDatasetExtractorPluginApi" text="@kbn/performance-testing-dataset-extractor"/> | [@elastic/kibana-performance-testing](https://github.com/orgs/elastic/teams/kibana-performance-testing) | - | 3 | 0 | 3 | 1 |
 | <DocLink id="kibKbnPluginGeneratorPluginApi" text="@kbn/plugin-generator"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 1 | 0 | 1 | 0 |
 | <DocLink id="kibKbnPluginHelpersPluginApi" text="@kbn/plugin-helpers"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 1 | 0 | 1 | 0 |
@@ -540,13 +541,22 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnRepoLinterPluginApi" text="@kbn/repo-linter"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 40 | 0 | 38 | 5 |
 | <DocLink id="kibKbnRepoPathPluginApi" text="@kbn/repo-path"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 13 | 0 | 9 | 0 |
 | <DocLink id="kibKbnRepoSourceClassifierPluginApi" text="@kbn/repo-source-classifier"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 6 | 0 | 6 | 1 |
-| <DocLink id="kibKbnReportingCommonPluginApi" text="@kbn/reporting-common"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 73 | 0 | 65 | 0 |
+| <DocLink id="kibKbnReportingCommonPluginApi" text="@kbn/reporting-common"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 80 | 0 | 72 | 7 |
+| <DocLink id="kibKbnReportingExportTypesCsvPluginApi" text="@kbn/reporting-export-types-csv"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 50 | 0 | 50 | 3 |
+| <DocLink id="kibKbnReportingExportTypesCsvCommonPluginApi" text="@kbn/reporting-export-types-csv-common"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 17 | 0 | 16 | 0 |
+| <DocLink id="kibKbnReportingExportTypesPdfPluginApi" text="@kbn/reporting-export-types-pdf"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 32 | 0 | 31 | 0 |
+| <DocLink id="kibKbnReportingExportTypesPdfCommonPluginApi" text="@kbn/reporting-export-types-pdf-common"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 14 | 0 | 11 | 0 |
+| <DocLink id="kibKbnReportingExportTypesPngPluginApi" text="@kbn/reporting-export-types-png"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 16 | 0 | 15 | 0 |
+| <DocLink id="kibKbnReportingExportTypesPngCommonPluginApi" text="@kbn/reporting-export-types-png-common"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 13 | 0 | 11 | 0 |
+| <DocLink id="kibKbnReportingMocksServerPluginApi" text="@kbn/reporting-mocks-server"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 2 | 0 |
+| <DocLink id="kibKbnReportingPublicPluginApi" text="@kbn/reporting-public"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 5 | 0 | 5 | 0 |
+| <DocLink id="kibKbnReportingServerPluginApi" text="@kbn/reporting-server"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 78 | 0 | 77 | 0 |
 | <DocLink id="kibKbnResizableLayoutPluginApi" text="@kbn/resizable-layout"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | A component for creating resizable layouts containing a fixed width panel and a flexible panel, with support for horizontal and vertical layouts. | 18 | 0 | 5 | 0 |
 | <DocLink id="kibKbnRisonPluginApi" text="@kbn/rison"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 13 | 2 | 8 | 0 |
 | <DocLink id="kibKbnRrulePluginApi" text="@kbn/rrule"/> | [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-ops) | - | 16 | 0 | 16 | 1 |
 | <DocLink id="kibKbnRuleDataUtilsPluginApi" text="@kbn/rule-data-utils"/> | [@elastic/security-detections-response](https://github.com/orgs/elastic/teams/security-detections-response) | - | 116 | 0 | 113 | 0 |
 | <DocLink id="kibKbnSavedObjectsSettingsPluginApi" text="@kbn/saved-objects-settings"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 2 | 0 |
-| <DocLink id="kibKbnSearchApiPanelsPluginApi" text="@kbn/search-api-panels"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | - | 68 | 0 | 68 | 0 |
+| <DocLink id="kibKbnSearchApiPanelsPluginApi" text="@kbn/search-api-panels"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | - | 69 | 0 | 69 | 0 |
 | <DocLink id="kibKbnSearchConnectorsPluginApi" text="@kbn/search-connectors"/> | [@elastic/enterprise-search-frontend](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | - | 2211 | 0 | 2211 | 0 |
 | <DocLink id="kibKbnSearchResponseWarningsPluginApi" text="@kbn/search-response-warnings"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 14 | 0 | 12 | 1 |
 | <DocLink id="kibKbnSecuritySolutionFeaturesPluginApi" text="@kbn/security-solution-features"/> | [@elastic/security-threat-hunting-explore](https://github.com/orgs/elastic/teams/security-threat-hunting-explore) | - | 14 | 0 | 14 | 6 |
@@ -582,7 +592,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSharedSvgPluginApi" text="@kbn/shared-svg"/> | [@elastic/obs-ux-infra_services-team](https://github.com/orgs/elastic/teams/obs-ux-infra_services-team) | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibKbnSharedUxAvatarSolutionPluginApi" text="@kbn/shared-ux-avatar-solution"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 3 | 0 | 2 | 2 |
 | <DocLink id="kibKbnSharedUxButtonExitFullScreenPluginApi" text="@kbn/shared-ux-button-exit-full-screen"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 8 | 0 | 2 | 1 |
-| <DocLink id="kibKbnSharedUxButtonToolbarPluginApi" text="@kbn/shared-ux-button-toolbar"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 28 | 0 | 10 | 0 |
+| <DocLink id="kibKbnSharedUxButtonToolbarPluginApi" text="@kbn/shared-ux-button-toolbar"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 26 | 0 | 8 | 0 |
 | <DocLink id="kibKbnSharedUxCardNoDataPluginApi" text="@kbn/shared-ux-card-no-data"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 10 | 0 | 4 | 0 |
 | <DocLink id="kibKbnSharedUxCardNoDataMocksPluginApi" text="@kbn/shared-ux-card-no-data-mocks"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 32 | 0 | 28 | 0 |
 | <DocLink id="kibKbnSharedUxChromeNavigationPluginApi" text="@kbn/shared-ux-chrome-navigation"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 60 | 0 | 49 | 5 |
@@ -618,7 +628,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSharedUxStorybookConfigPluginApi" text="@kbn/shared-ux-storybook-config"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnSharedUxStorybookMockPluginApi" text="@kbn/shared-ux-storybook-mock"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 15 | 0 | 4 | 0 |
 | <DocLink id="kibKbnSharedUxUtilityPluginApi" text="@kbn/shared-ux-utility"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 11 | 0 | 3 | 0 |
-| <DocLink id="kibKbnSloSchemaPluginApi" text="@kbn/slo-schema"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 131 | 0 | 128 | 0 |
+| <DocLink id="kibKbnSloSchemaPluginApi" text="@kbn/slo-schema"/> | [@elastic/obs-ux-management-team](https://github.com/orgs/elastic/teams/obs-ux-management-team) | - | 144 | 0 | 144 | 0 |
 | <DocLink id="kibKbnSomeDevLogPluginApi" text="@kbn/some-dev-log"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 20 | 0 | 12 | 0 |
 | <DocLink id="kibKbnStdPluginApi" text="@kbn/std"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 102 | 2 | 65 | 1 |
 | <DocLink id="kibKbnStdioDevHelpersPluginApi" text="@kbn/stdio-dev-helpers"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 4 | 0 | 2 | 0 |
@@ -638,13 +648,14 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnUnifiedDataTablePluginApi" text="@kbn/unified-data-table"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the unified data table which can be integrated into apps | 109 | 0 | 49 | 1 |
 | <DocLink id="kibKbnUnifiedDocViewerPluginApi" text="@kbn/unified-doc-viewer"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 10 | 0 | 7 | 7 |
 | <DocLink id="kibKbnUnifiedFieldListPluginApi" text="@kbn/unified-field-list"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the field list and field stats which can be integrated into apps | 285 | 0 | 261 | 9 |
+| <DocLink id="kibKbnUnsavedChangesBadgePluginApi" text="@kbn/unsaved-changes-badge"/> | [@elastic/kibana-data-discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 13 | 0 | 9 | 0 |
 | <DocLink id="kibKbnUrlStatePluginApi" text="@kbn/url-state"/> | [@elastic/security-threat-hunting-investigations](https://github.com/orgs/elastic/teams/security-threat-hunting-investigations) | - | 4 | 0 | 0 | 0 |
 | <DocLink id="kibKbnUseTrackedPromisePluginApi" text="@kbn/use-tracked-promise"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | - | 3 | 0 | 2 | 1 |
 | <DocLink id="kibKbnUserProfileComponentsPluginApi" text="@kbn/user-profile-components"/> | [@elastic/kibana-security](https://github.com/orgs/elastic/teams/kibana-security) | - | 80 | 1 | 21 | 2 |
 | <DocLink id="kibKbnUtilityTypesPluginApi" text="@kbn/utility-types"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 37 | 0 | 16 | 1 |
 | <DocLink id="kibKbnUtilityTypesJestPluginApi" text="@kbn/utility-types-jest"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 2 | 0 | 2 | 0 |
 | <DocLink id="kibKbnUtilsPluginApi" text="@kbn/utils"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 24 | 0 | 14 | 0 |
-| <DocLink id="kibKbnVisualizationUiComponentsPluginApi" text="@kbn/visualization-ui-components"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 156 | 0 | 152 | 3 |
+| <DocLink id="kibKbnVisualizationUiComponentsPluginApi" text="@kbn/visualization-ui-components"/> | [@elastic/kibana-visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 154 | 0 | 151 | 3 |
 | <DocLink id="kibKbnXstateUtilsPluginApi" text="@kbn/xstate-utils"/> | [@elastic/obs-ux-logs-team](https://github.com/orgs/elastic/teams/obs-ux-logs-team) | - | 12 | 0 | 12 | 0 |
 | <DocLink id="kibKbnYarnLockValidatorPluginApi" text="@kbn/yarn-lock-validator"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 6 | 0 | 2 | 0 |
 | <DocLink id="kibKbnZodHelpersPluginApi" text="@kbn/zod-helpers"/> | [@elastic/security-detection-rule-management](https://github.com/orgs/elastic/teams/security-detection-rule-management) | - | 18 | 0 | 9 | 0 |
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index f58a021c502b5f..ca1e4ee40d00dd 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index cd7539fc60ab38..1bda61f7d6011e 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/profiling_data_access.mdx b/api_docs/profiling_data_access.mdx
index 9e484291281bf2..81cc34b894c623 100644
--- a/api_docs/profiling_data_access.mdx
+++ b/api_docs/profiling_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profilingDataAccess
 title: "profilingDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profilingDataAccess plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profilingDataAccess']
 ---
 import profilingDataAccessObj from './profiling_data_access.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index 122eb47b5f1082..c150917716ebb6 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.devdocs.json b/api_docs/reporting.devdocs.json
index 9b536c3ca2f5e3..f0f02df91a6e99 100644
--- a/api_docs/reporting.devdocs.json
+++ b/api_docs/reporting.devdocs.json
@@ -27,17 +27,9 @@
               "\nA function that Reporting calls to get the sharing data from the application."
             ],
             "signature": [
-              "(forShareUrl?: boolean | undefined) => Omit<{ layout?: { id?: ",
-              {
-                "pluginId": "screenshotting",
-                "scope": "common",
-                "docId": "kibScreenshottingPluginApi",
-                "section": "def-common.LayoutType",
-                "text": "LayoutType"
-              },
-              " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-              "LayoutSelectorDictionary",
-              "> | undefined; zoom?: number | undefined; } | undefined; objectType: string; title: string; browserTimezone: string; version: string; }, \"version\" | \"browserTimezone\">"
+              "(forShareUrl?: boolean | undefined) => Omit<",
+              "BaseParams",
+              ", \"version\" | \"browserTimezone\">"
             ],
             "path": "x-pack/plugins/reporting/public/shared/get_shared_components.tsx",
             "deprecated": false,
@@ -340,363 +332,9 @@
   "common": {
     "classes": [],
     "functions": [],
-    "interfaces": [
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.BasePayload",
-        "type": "Interface",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "BasePayload",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.BasePayload",
-            "text": "BasePayload"
-          },
-          " extends { layout?: { id?: ",
-          {
-            "pluginId": "screenshotting",
-            "scope": "common",
-            "docId": "kibScreenshottingPluginApi",
-            "section": "def-common.LayoutType",
-            "text": "LayoutType"
-          },
-          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-          "LayoutSelectorDictionary",
-          "> | undefined; zoom?: number | undefined; } | undefined; objectType: string; title: string; browserTimezone: string; version: string; }"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/base.ts",
-        "deprecated": true,
-        "trackAdoption": false,
-        "references": [],
-        "children": [
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayload.headers",
-            "type": "string",
-            "tags": [],
-            "label": "headers",
-            "description": [],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayload.spaceId",
-            "type": "string",
-            "tags": [],
-            "label": "spaceId",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayload.isDeprecated",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "isDeprecated",
-            "description": [],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.BasePayloadV2",
-        "type": "Interface",
-        "tags": [],
-        "label": "BasePayloadV2",
-        "description": [
-          "\nReport job parameters, after they are processed in the request handler."
-        ],
-        "signature": [
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.BasePayloadV2",
-            "text": "BasePayloadV2"
-          },
-          " extends ",
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.BaseParamsV2",
-            "text": "BaseParamsV2"
-          }
-        ],
-        "path": "x-pack/plugins/reporting/common/types/base.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayloadV2.headers",
-            "type": "string",
-            "tags": [],
-            "label": "headers",
-            "description": [],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayloadV2.spaceId",
-            "type": "string",
-            "tags": [],
-            "label": "spaceId",
-            "description": [],
-            "signature": [
-              "string | undefined"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.BasePayloadV2.isDeprecated",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "isDeprecated",
-            "description": [],
-            "signature": [
-              "boolean | undefined"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/base.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.LocatorParams",
-        "type": "Interface",
-        "tags": [],
-        "label": "LocatorParams",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.LocatorParams",
-            "text": "LocatorParams"
-          },
-          "<P>"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/url.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "children": [
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.LocatorParams.id",
-            "type": "string",
-            "tags": [],
-            "label": "id",
-            "description": [],
-            "path": "x-pack/plugins/reporting/common/types/url.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.LocatorParams.version",
-            "type": "string",
-            "tags": [],
-            "label": "version",
-            "description": [
-              "\nKibana version used to create the params"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/url.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          },
-          {
-            "parentPluginId": "reporting",
-            "id": "def-common.LocatorParams.params",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "params",
-            "description": [
-              "\nData to recreate the user's state in the application"
-            ],
-            "signature": [
-              "P"
-            ],
-            "path": "x-pack/plugins/reporting/common/types/url.ts",
-            "deprecated": false,
-            "trackAdoption": false
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
+    "interfaces": [],
     "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.BaseParams",
-        "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "BaseParams",
-        "description": [],
-        "signature": [
-          "{ layout?: { id?: ",
-          {
-            "pluginId": "screenshotting",
-            "scope": "common",
-            "docId": "kibScreenshottingPluginApi",
-            "section": "def-common.LayoutType",
-            "text": "LayoutType"
-          },
-          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-          "LayoutSelectorDictionary",
-          "> | undefined; zoom?: number | undefined; } | undefined; objectType: string; title: string; browserTimezone: string; version: string; }"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/base.ts",
-        "deprecated": true,
-        "trackAdoption": false,
-        "references": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.BaseParamsV2",
-        "type": "Type",
-        "tags": [],
-        "label": "BaseParamsV2",
-        "description": [
-          "\nReport job parameters that an application must return from its\ngetSharingData function."
-        ],
-        "signature": [
-          "{ layout?: { id?: ",
-          {
-            "pluginId": "screenshotting",
-            "scope": "common",
-            "docId": "kibScreenshottingPluginApi",
-            "section": "def-common.LayoutType",
-            "text": "LayoutType"
-          },
-          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-          "LayoutSelectorDictionary",
-          "> | undefined; zoom?: number | undefined; } | undefined; objectType: string; title: string; browserTimezone: string; version: string; } & { locatorParams: ",
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.LocatorParams",
-            "text": "LocatorParams"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/utility-types",
-            "scope": "common",
-            "docId": "kibKbnUtilityTypesPluginApi",
-            "section": "def-common.SerializableRecord",
-            "text": "SerializableRecord"
-          },
-          ">[]; }"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/base.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.JobAppParamsPDF",
-        "type": "Type",
-        "tags": [
-          "deprecated"
-        ],
-        "label": "JobAppParamsPDF",
-        "description": [],
-        "signature": [
-          "{ isDeprecated?: boolean | undefined; title: string; layout: { id?: ",
-          {
-            "pluginId": "screenshotting",
-            "scope": "common",
-            "docId": "kibScreenshottingPluginApi",
-            "section": "def-common.LayoutType",
-            "text": "LayoutType"
-          },
-          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-          "LayoutSelectorDictionary",
-          "> | undefined; zoom?: number | undefined; }; objectType: string; relativeUrls: string[]; }"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts",
-        "deprecated": true,
-        "trackAdoption": false,
-        "references": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "reporting",
-        "id": "def-common.JobAppParamsPDFV2",
-        "type": "Type",
-        "tags": [],
-        "label": "JobAppParamsPDFV2",
-        "description": [],
-        "signature": [
-          "{ title: string; layout: { id?: ",
-          {
-            "pluginId": "screenshotting",
-            "scope": "common",
-            "docId": "kibScreenshottingPluginApi",
-            "section": "def-common.LayoutType",
-            "text": "LayoutType"
-          },
-          " | undefined; dimensions?: { width: number; height: number; } | undefined; selectors?: Partial<",
-          "LayoutSelectorDictionary",
-          "> | undefined; zoom?: number | undefined; }; locatorParams: ",
-          {
-            "pluginId": "reporting",
-            "scope": "common",
-            "docId": "kibReportingPluginApi",
-            "section": "def-common.LocatorParams",
-            "text": "LocatorParams"
-          },
-          "<",
-          {
-            "pluginId": "@kbn/utility-types",
-            "scope": "common",
-            "docId": "kibKbnUtilityTypesPluginApi",
-            "section": "def-common.SerializableRecord",
-            "text": "SerializableRecord"
-          },
-          ">[]; objectType: string; }"
-        ],
-        "path": "x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      }
-    ],
+    "misc": [],
     "objects": []
   }
 }
\ No newline at end of file
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index 7218c2d384f9a6..1a61297dc8ca19 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 42 | 0 | 22 | 5 |
+| 22 | 0 | 6 | 0 |
 
 ## Client
 
@@ -36,11 +36,3 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 ### Start
 <DocDefinitionList data={[reportingObj.server.start]}/>
 
-## Common
-
-### Interfaces
-<DocDefinitionList data={reportingObj.common.interfaces}/>
-
-### Consts, variables and types
-<DocDefinitionList data={reportingObj.common.misc}/>
-
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index 80f6f81edc01a2..72ff879307790b 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json
index 906b1e98dd57f8..6a8f4d39d68573 100644
--- a/api_docs/rule_registry.devdocs.json
+++ b/api_docs/rule_registry.devdocs.json
@@ -107,7 +107,7 @@
             "label": "get",
             "description": [],
             "signature": [
-              "({ id, index }: GetAlertParams) => Promise<OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined>"
+              "({ id, index }: GetAlertParams) => Promise<OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> | undefined>"
             ],
             "path": "x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts",
             "deprecated": false,
@@ -403,7 +403,7 @@
               "SortOptions",
               "[] | undefined; track_total_hits?: number | boolean | undefined; _source?: string[] | undefined; }) => Promise<",
               "SearchResponse",
-              "<OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>, Record<string, ",
+              "<OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>, Record<string, ",
               "AggregationsAggregate",
               ">>>"
             ],
@@ -2285,7 +2285,7 @@
               "\nID of the Kibana feature associated with the index.\nUsed by alerts-as-data RBAC.\n\nNote from @dhurley14\nThe purpose of the `feature` param is to force the user to update\nthe data structure which contains the mapping of consumers to alerts\nas data indices. The idea is it is typed such that it forces the\nuser to go to the code and modify it. At least until a better system\nis put in place or we move the alerts as data client out of rule registry.\n"
             ],
             "signature": [
-              "\"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
+              "\"ml\" | \"uptime\" | \"siem\" | \"observability\" | \"apm\" | \"logs\" | \"infrastructure\" | \"slo\""
             ],
             "path": "x-pack/plugins/rule_registry/server/rule_data_plugin_service/index_options.ts",
             "deprecated": false,
@@ -2701,7 +2701,7 @@
             "signature": [
               "<TSearchRequest extends ",
               "SearchRequest",
-              ", TAlertDoc = Partial<OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>>>>(request: TSearchRequest) => Promise<",
+              ", TAlertDoc = Partial<OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>>>>(request: TSearchRequest) => Promise<",
               {
                 "pluginId": "@kbn/es-types",
                 "scope": "common",
@@ -3338,7 +3338,7 @@
             "label": "getAlertByAlertUuid",
             "description": [],
             "signature": [
-              "(alertUuid: string) => Promise<Partial<OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>>> | null> | null"
+              "(alertUuid: string) => Promise<Partial<OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>> & OutputOf<SetOptional<{ readonly \"kibana.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; }; readonly \"kibana.alert.context\": { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.evaluation.values\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; readonly required: false; readonly array: true; }; readonly \"kibana.alert.group\": { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.group.field\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.group.value\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>>> | null> | null"
             ],
             "path": "x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts",
             "deprecated": false,
@@ -4752,7 +4752,7 @@
         "label": "parseTechnicalFields",
         "description": [],
         "signature": [
-          "(input: unknown, partial?: boolean) => OutputOf<SetOptional<{ readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>"
+          "(input: unknown, partial?: boolean) => OutputOf<SetOptional<{ readonly \"ecs.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.risk_score\": { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.author\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.created_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.description\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.enabled\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.from\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.interval\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.license\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.note\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.references\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.rule_name_override\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.to\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.type\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_at\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.updated_by\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.version\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.severity\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.docs_count\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.suppression.terms.field\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.suppression.terms.value\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.system_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_user\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"@timestamp\": { readonly type: \"date\"; readonly required: true; readonly array: false; }; readonly \"event.action\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.rule.rule_type_id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.consumer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.execution.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.instance.id\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.category\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.name\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.producer\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.revision\": { readonly type: \"long\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.rule.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.status\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.alert.uuid\": { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly \"kibana.space_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: true; }; readonly \"event.kind\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.action_group\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.case_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.duration.us\": { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.end\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping\": { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.flapping_history\": { readonly type: \"boolean\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.last_detected\": { readonly type: \"date\"; readonly required: false; readonly array: false; }; readonly \"kibana.alert.maintenance_window_ids\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.reason\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.rule.parameters\": { readonly array: false; readonly type: \"flattened\"; readonly ignore_above: 4096; readonly required: false; }; readonly \"kibana.alert.rule.tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.alert.start\": { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.time_range\": { readonly type: \"date_range\"; readonly format: \"epoch_millis||strict_date_optional_time\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.url\": { readonly type: \"keyword\"; readonly array: false; readonly index: false; readonly required: false; readonly ignore_above: 2048; }; readonly \"kibana.alert.workflow_status\": { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly \"kibana.alert.workflow_tags\": { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly \"kibana.version\": { readonly type: \"version\"; readonly array: false; readonly required: false; }; }>>"
         ],
         "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
         "deprecated": false,
@@ -5128,7 +5128,7 @@
         "label": "ParsedTechnicalFields",
         "description": [],
         "signature": [
-          "{ readonly \"@timestamp\": string; readonly \"kibana.alert.rule.rule_type_id\": string; readonly \"kibana.alert.rule.consumer\": string; readonly \"kibana.alert.instance.id\": string; readonly \"kibana.alert.rule.category\": string; readonly \"kibana.alert.rule.name\": string; readonly \"kibana.alert.rule.producer\": string; readonly \"kibana.alert.rule.revision\": number; readonly \"kibana.alert.rule.uuid\": string; readonly \"kibana.alert.status\": string; readonly \"kibana.alert.uuid\": string; readonly \"kibana.space_ids\": string[]; readonly \"event.action\"?: string | undefined; readonly tags?: string[] | undefined; readonly \"kibana.alert.rule.execution.uuid\"?: string | undefined; readonly \"event.kind\"?: string | undefined; readonly \"kibana.alert.action_group\"?: string | undefined; readonly \"kibana.alert.case_ids\"?: string[] | undefined; readonly \"kibana.alert.duration.us\"?: number | undefined; readonly \"kibana.alert.end\"?: string | undefined; readonly \"kibana.alert.flapping\"?: boolean | undefined; readonly \"kibana.alert.flapping_history\"?: boolean[] | undefined; readonly \"kibana.alert.last_detected\"?: string | undefined; readonly \"kibana.alert.maintenance_window_ids\"?: string[] | undefined; readonly \"kibana.alert.reason\"?: string | undefined; readonly \"kibana.alert.rule.parameters\"?: { [key: string]: unknown; } | undefined; readonly \"kibana.alert.rule.tags\"?: string[] | undefined; readonly \"kibana.alert.start\"?: string | undefined; readonly \"kibana.alert.time_range\"?: unknown; readonly \"kibana.alert.url\"?: string | undefined; readonly \"kibana.alert.workflow_status\"?: string | undefined; readonly \"kibana.alert.workflow_tags\"?: string[] | undefined; readonly \"kibana.version\"?: string | undefined; readonly \"kibana.alert.risk_score\"?: number | undefined; readonly \"kibana.alert.rule.author\"?: string | undefined; readonly \"kibana.alert.rule.created_at\"?: string | undefined; readonly \"kibana.alert.rule.created_by\"?: string | undefined; readonly \"kibana.alert.rule.description\"?: string | undefined; readonly \"kibana.alert.rule.enabled\"?: string | undefined; readonly \"kibana.alert.rule.from\"?: string | undefined; readonly \"kibana.alert.rule.interval\"?: string | undefined; readonly \"kibana.alert.rule.license\"?: string | undefined; readonly \"kibana.alert.rule.note\"?: string | undefined; readonly \"kibana.alert.rule.references\"?: string[] | undefined; readonly \"kibana.alert.rule.rule_id\"?: string | undefined; readonly \"kibana.alert.rule.rule_name_override\"?: string | undefined; readonly \"kibana.alert.rule.to\"?: string | undefined; readonly \"kibana.alert.rule.type\"?: string | undefined; readonly \"kibana.alert.rule.updated_at\"?: string | undefined; readonly \"kibana.alert.rule.updated_by\"?: string | undefined; readonly \"kibana.alert.rule.version\"?: string | undefined; readonly \"kibana.alert.severity\"?: string | undefined; readonly \"kibana.alert.suppression.docs_count\"?: number | undefined; readonly \"kibana.alert.suppression.end\"?: string | undefined; readonly \"kibana.alert.suppression.terms.field\"?: string[] | undefined; readonly \"kibana.alert.suppression.start\"?: string | undefined; readonly \"kibana.alert.suppression.terms.value\"?: string[] | undefined; readonly \"kibana.alert.system_status\"?: string | undefined; readonly \"kibana.alert.workflow_reason\"?: string | undefined; readonly \"kibana.alert.workflow_user\"?: string | undefined; readonly \"ecs.version\"?: string | undefined; }"
+          "{ readonly \"@timestamp\": string; readonly \"kibana.alert.rule.rule_type_id\": string; readonly \"kibana.alert.rule.consumer\": string; readonly \"kibana.alert.instance.id\": string; readonly \"kibana.alert.rule.category\": string; readonly \"kibana.alert.rule.name\": string; readonly \"kibana.alert.rule.producer\": string; readonly \"kibana.alert.rule.revision\": number; readonly \"kibana.alert.rule.uuid\": string; readonly \"kibana.alert.status\": string; readonly \"kibana.alert.uuid\": string; readonly \"kibana.space_ids\": string[]; readonly \"event.action\"?: string | undefined; readonly tags?: string[] | undefined; readonly \"kibana.alert.rule.execution.uuid\"?: string | undefined; readonly \"event.kind\"?: string | undefined; readonly \"kibana.alert.action_group\"?: string | undefined; readonly \"kibana.alert.case_ids\"?: string[] | undefined; readonly \"kibana.alert.duration.us\"?: number | undefined; readonly \"kibana.alert.end\"?: string | undefined; readonly \"kibana.alert.flapping\"?: boolean | undefined; readonly \"kibana.alert.flapping_history\"?: boolean[] | undefined; readonly \"kibana.alert.last_detected\"?: string | undefined; readonly \"kibana.alert.maintenance_window_ids\"?: string[] | undefined; readonly \"kibana.alert.reason\"?: string | undefined; readonly \"kibana.alert.rule.parameters\"?: { [key: string]: unknown; } | undefined; readonly \"kibana.alert.rule.tags\"?: string[] | undefined; readonly \"kibana.alert.start\"?: string | undefined; readonly \"kibana.alert.time_range\"?: unknown; readonly \"kibana.alert.url\"?: string | undefined; readonly \"kibana.alert.workflow_status\"?: string | undefined; readonly \"kibana.alert.workflow_tags\"?: string[] | undefined; readonly \"kibana.version\"?: string | undefined; readonly \"ecs.version\"?: string | undefined; readonly \"kibana.alert.risk_score\"?: number | undefined; readonly \"kibana.alert.rule.author\"?: string | undefined; readonly \"kibana.alert.rule.created_at\"?: string | undefined; readonly \"kibana.alert.rule.created_by\"?: string | undefined; readonly \"kibana.alert.rule.description\"?: string | undefined; readonly \"kibana.alert.rule.enabled\"?: string | undefined; readonly \"kibana.alert.rule.from\"?: string | undefined; readonly \"kibana.alert.rule.interval\"?: string | undefined; readonly \"kibana.alert.rule.license\"?: string | undefined; readonly \"kibana.alert.rule.note\"?: string | undefined; readonly \"kibana.alert.rule.references\"?: string[] | undefined; readonly \"kibana.alert.rule.rule_id\"?: string | undefined; readonly \"kibana.alert.rule.rule_name_override\"?: string | undefined; readonly \"kibana.alert.rule.to\"?: string | undefined; readonly \"kibana.alert.rule.type\"?: string | undefined; readonly \"kibana.alert.rule.updated_at\"?: string | undefined; readonly \"kibana.alert.rule.updated_by\"?: string | undefined; readonly \"kibana.alert.rule.version\"?: string | undefined; readonly \"kibana.alert.severity\"?: string | undefined; readonly \"kibana.alert.suppression.docs_count\"?: number | undefined; readonly \"kibana.alert.suppression.end\"?: string | undefined; readonly \"kibana.alert.suppression.start\"?: string | undefined; readonly \"kibana.alert.suppression.terms.field\"?: string[] | undefined; readonly \"kibana.alert.suppression.terms.value\"?: string[] | undefined; readonly \"kibana.alert.system_status\"?: string | undefined; readonly \"kibana.alert.workflow_reason\"?: string | undefined; readonly \"kibana.alert.workflow_user\"?: string | undefined; }"
         ],
         "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
         "deprecated": false,
@@ -5150,7 +5150,15 @@
             "section": "def-common.IEsSearchRequest",
             "text": "IEsSearchRequest"
           },
-          " & { featureIds: ",
+          "<",
+          {
+            "pluginId": "data",
+            "scope": "common",
+            "docId": "kibDataSearchPluginApi",
+            "section": "def-common.ISearchRequestParams",
+            "text": "ISearchRequestParams"
+          },
+          "> & { featureIds: ",
           {
             "pluginId": "@kbn/rule-data-utils",
             "scope": "common",
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 2484623c379eaf..418f7ce050c393 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index 73f40c7ef02bbf..cc8bb29feeff2c 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index 787d563cf833ff..cca924baeeb7d9 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index fe075a2d14aefc..2f098e900ea654 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.devdocs.json b/api_docs/saved_objects_management.devdocs.json
index e8949e085611fb..0c087c56c37e49 100644
--- a/api_docs/saved_objects_management.devdocs.json
+++ b/api_docs/saved_objects_management.devdocs.json
@@ -294,7 +294,7 @@
             "label": "euiColumn",
             "description": [],
             "signature": [
-              "{ prefix?: string | undefined; scope?: string | undefined; id?: string | undefined; defaultValue?: string | number | readonly string[] | undefined; name: React.ReactNode; security?: string | undefined; children?: React.ReactNode; description?: string | undefined; onChange?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; defaultChecked?: boolean | undefined; suppressContentEditableWarning?: boolean | undefined; suppressHydrationWarning?: boolean | undefined; accessKey?: string | undefined; className?: string | undefined; contentEditable?: \"inherit\" | Booleanish | undefined; contextMenu?: string | undefined; dir?: string | undefined; draggable?: Booleanish | undefined; hidden?: boolean | undefined; lang?: string | undefined; placeholder?: string | undefined; slot?: string | undefined; spellCheck?: Booleanish | undefined; style?: React.CSSProperties | undefined; tabIndex?: number | undefined; title?: string | undefined; translate?: \"no\" | \"yes\" | undefined; radioGroup?: string | undefined; role?: React.AriaRole | undefined; about?: string | undefined; datatype?: string | undefined; inlist?: any; property?: string | undefined; resource?: string | undefined; typeof?: string | undefined; vocab?: string | undefined; autoCapitalize?: string | undefined; autoCorrect?: string | undefined; autoSave?: string | undefined; color?: string | undefined; itemProp?: string | undefined; itemScope?: boolean | undefined; itemType?: string | undefined; itemID?: string | undefined; itemRef?: string | undefined; results?: number | undefined; unselectable?: \"on\" | \"off\" | undefined; inputMode?: \"search\" | \"none\" | \"text\" | \"url\" | \"email\" | \"tel\" | \"numeric\" | \"decimal\" | undefined; is?: string | undefined; 'aria-activedescendant'?: string | undefined; 'aria-atomic'?: Booleanish | undefined; 'aria-autocomplete'?: \"none\" | \"list\" | \"both\" | \"inline\" | undefined; 'aria-busy'?: Booleanish | undefined; 'aria-checked'?: boolean | \"true\" | \"false\" | \"mixed\" | undefined; 'aria-colcount'?: number | undefined; 'aria-colindex'?: number | undefined; 'aria-colspan'?: number | undefined; 'aria-controls'?: string | undefined; 'aria-current'?: boolean | \"page\" | \"date\" | \"true\" | \"false\" | \"location\" | \"time\" | \"step\" | undefined; 'aria-describedby'?: string | undefined; 'aria-details'?: string | undefined; 'aria-disabled'?: Booleanish | undefined; 'aria-dropeffect'?: \"execute\" | \"link\" | \"none\" | \"copy\" | \"move\" | \"popup\" | undefined; 'aria-errormessage'?: string | undefined; 'aria-expanded'?: Booleanish | undefined; 'aria-flowto'?: string | undefined; 'aria-grabbed'?: Booleanish | undefined; 'aria-haspopup'?: boolean | \"true\" | \"false\" | \"grid\" | \"menu\" | \"dialog\" | \"listbox\" | \"tree\" | undefined; 'aria-hidden'?: Booleanish | undefined; 'aria-invalid'?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\" | undefined; 'aria-keyshortcuts'?: string | undefined; 'aria-label'?: string | undefined; 'aria-labelledby'?: string | undefined; 'aria-level'?: number | undefined; 'aria-live'?: \"off\" | \"assertive\" | \"polite\" | undefined; 'aria-modal'?: Booleanish | undefined; 'aria-multiline'?: Booleanish | undefined; 'aria-multiselectable'?: Booleanish | undefined; 'aria-orientation'?: \"horizontal\" | \"vertical\" | undefined; 'aria-owns'?: string | undefined; 'aria-placeholder'?: string | undefined; 'aria-posinset'?: number | undefined; 'aria-pressed'?: boolean | \"true\" | \"false\" | \"mixed\" | undefined; 'aria-readonly'?: Booleanish | undefined; 'aria-relevant'?: \"text\" | \"all\" | \"additions\" | \"additions removals\" | \"additions text\" | \"removals\" | \"removals additions\" | \"removals text\" | \"text additions\" | \"text removals\" | undefined; 'aria-required'?: Booleanish | undefined; 'aria-roledescription'?: string | undefined; 'aria-rowcount'?: number | undefined; 'aria-rowindex'?: number | undefined; 'aria-rowspan'?: number | undefined; 'aria-selected'?: Booleanish | undefined; 'aria-setsize'?: number | undefined; 'aria-sort'?: \"none\" | \"other\" | \"ascending\" | \"descending\" | undefined; 'aria-valuemax'?: number | undefined; 'aria-valuemin'?: number | undefined; 'aria-valuenow'?: number | undefined; 'aria-valuetext'?: string | undefined; dangerouslySetInnerHTML?: { __html: string; } | undefined; onCopy?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCopyCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCut?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCutCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onPaste?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onPasteCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCompositionEnd?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionEndCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionStart?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionStartCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionUpdate?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionUpdateCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onFocus?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onFocusCapture?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onBlur?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onBlurCapture?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onChangeCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onBeforeInput?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onBeforeInputCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInput?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInputCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onReset?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onResetCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onSubmit?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onSubmitCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInvalid?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInvalidCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onLoad?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onError?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onErrorCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onKeyDown?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyDownCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyPress?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyPressCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyUp?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyUpCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onAbort?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onAbortCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlay?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayThrough?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayThroughCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onDurationChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onDurationChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEmptied?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEmptiedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEncrypted?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEncryptedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEnded?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEndedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedData?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedDataCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedMetadata?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedMetadataCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadStart?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadStartCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPause?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPauseCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlay?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlayCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlaying?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlayingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onProgress?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onProgressCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onRateChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onRateChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeeked?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeekedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeeking?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeekingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onStalled?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onStalledCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSuspend?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSuspendCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTimeUpdate?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTimeUpdateCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onVolumeChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onVolumeChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onWaiting?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onWaitingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onAuxClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onAuxClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onContextMenu?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onContextMenuCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDoubleClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDoubleClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDrag?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnd?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEndCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnter?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnterCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragExit?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragExitCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragLeave?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragLeaveCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragOver?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragOverCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragStart?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragStartCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDrop?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDropCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onMouseDown?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseDownCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseEnter?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseLeave?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseMove?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseMoveCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOut?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOutCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOver?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOverCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseUp?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseUpCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onSelect?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSelectCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTouchCancel?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchCancelCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchEnd?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchEndCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchMove?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchMoveCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchStart?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchStartCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onPointerDown?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerDownCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerMove?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerMoveCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerUp?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerUpCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerCancel?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerCancelCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerEnter?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerEnterCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerLeave?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerLeaveCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOver?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOverCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOut?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOutCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onGotPointerCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onGotPointerCaptureCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onLostPointerCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onLostPointerCaptureCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onScroll?: React.UIEventHandler<HTMLTableDataCellElement> | undefined; onScrollCapture?: React.UIEventHandler<HTMLTableDataCellElement> | undefined; onWheel?: React.WheelEventHandler<HTMLTableDataCellElement> | undefined; onWheelCapture?: React.WheelEventHandler<HTMLTableDataCellElement> | undefined; onAnimationStart?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationStartCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationEnd?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationEndCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationIteration?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationIterationCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onTransitionEnd?: React.TransitionEventHandler<HTMLTableDataCellElement> | undefined; onTransitionEndCapture?: React.TransitionEventHandler<HTMLTableDataCellElement> | undefined; 'data-test-subj'?: string | undefined; css?: ",
+              "{ prefix?: string | undefined; scope?: string | undefined; id?: string | undefined; defaultValue?: string | number | readonly string[] | undefined; name: React.ReactNode; security?: string | undefined; children?: React.ReactNode; description?: string | undefined; onChange?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; defaultChecked?: boolean | undefined; suppressContentEditableWarning?: boolean | undefined; suppressHydrationWarning?: boolean | undefined; accessKey?: string | undefined; className?: string | undefined; contentEditable?: \"inherit\" | Booleanish | undefined; contextMenu?: string | undefined; dir?: string | undefined; draggable?: Booleanish | undefined; hidden?: boolean | undefined; lang?: string | undefined; placeholder?: string | undefined; slot?: string | undefined; spellCheck?: Booleanish | undefined; style?: React.CSSProperties | undefined; tabIndex?: number | undefined; title?: string | undefined; translate?: \"no\" | \"yes\" | undefined; radioGroup?: string | undefined; role?: React.AriaRole | undefined; about?: string | undefined; datatype?: string | undefined; inlist?: any; property?: string | undefined; resource?: string | undefined; typeof?: string | undefined; vocab?: string | undefined; autoCapitalize?: string | undefined; autoCorrect?: string | undefined; autoSave?: string | undefined; color?: string | undefined; itemProp?: string | undefined; itemScope?: boolean | undefined; itemType?: string | undefined; itemID?: string | undefined; itemRef?: string | undefined; results?: number | undefined; unselectable?: \"on\" | \"off\" | undefined; inputMode?: \"search\" | \"none\" | \"text\" | \"url\" | \"email\" | \"tel\" | \"numeric\" | \"decimal\" | undefined; is?: string | undefined; 'aria-activedescendant'?: string | undefined; 'aria-atomic'?: Booleanish | undefined; 'aria-autocomplete'?: \"none\" | \"list\" | \"both\" | \"inline\" | undefined; 'aria-busy'?: Booleanish | undefined; 'aria-checked'?: boolean | \"true\" | \"false\" | \"mixed\" | undefined; 'aria-colcount'?: number | undefined; 'aria-colindex'?: number | undefined; 'aria-colspan'?: number | undefined; 'aria-controls'?: string | undefined; 'aria-current'?: boolean | \"page\" | \"date\" | \"location\" | \"true\" | \"false\" | \"time\" | \"step\" | undefined; 'aria-describedby'?: string | undefined; 'aria-details'?: string | undefined; 'aria-disabled'?: Booleanish | undefined; 'aria-dropeffect'?: \"execute\" | \"link\" | \"none\" | \"copy\" | \"move\" | \"popup\" | undefined; 'aria-errormessage'?: string | undefined; 'aria-expanded'?: Booleanish | undefined; 'aria-flowto'?: string | undefined; 'aria-grabbed'?: Booleanish | undefined; 'aria-haspopup'?: boolean | \"true\" | \"false\" | \"grid\" | \"menu\" | \"dialog\" | \"listbox\" | \"tree\" | undefined; 'aria-hidden'?: Booleanish | undefined; 'aria-invalid'?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\" | undefined; 'aria-keyshortcuts'?: string | undefined; 'aria-label'?: string | undefined; 'aria-labelledby'?: string | undefined; 'aria-level'?: number | undefined; 'aria-live'?: \"off\" | \"assertive\" | \"polite\" | undefined; 'aria-modal'?: Booleanish | undefined; 'aria-multiline'?: Booleanish | undefined; 'aria-multiselectable'?: Booleanish | undefined; 'aria-orientation'?: \"horizontal\" | \"vertical\" | undefined; 'aria-owns'?: string | undefined; 'aria-placeholder'?: string | undefined; 'aria-posinset'?: number | undefined; 'aria-pressed'?: boolean | \"true\" | \"false\" | \"mixed\" | undefined; 'aria-readonly'?: Booleanish | undefined; 'aria-relevant'?: \"text\" | \"all\" | \"additions\" | \"additions removals\" | \"additions text\" | \"removals\" | \"removals additions\" | \"removals text\" | \"text additions\" | \"text removals\" | undefined; 'aria-required'?: Booleanish | undefined; 'aria-roledescription'?: string | undefined; 'aria-rowcount'?: number | undefined; 'aria-rowindex'?: number | undefined; 'aria-rowspan'?: number | undefined; 'aria-selected'?: Booleanish | undefined; 'aria-setsize'?: number | undefined; 'aria-sort'?: \"none\" | \"other\" | \"ascending\" | \"descending\" | undefined; 'aria-valuemax'?: number | undefined; 'aria-valuemin'?: number | undefined; 'aria-valuenow'?: number | undefined; 'aria-valuetext'?: string | undefined; dangerouslySetInnerHTML?: { __html: string; } | undefined; onCopy?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCopyCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCut?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCutCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onPaste?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onPasteCapture?: React.ClipboardEventHandler<HTMLTableDataCellElement> | undefined; onCompositionEnd?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionEndCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionStart?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionStartCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionUpdate?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onCompositionUpdateCapture?: React.CompositionEventHandler<HTMLTableDataCellElement> | undefined; onFocus?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onFocusCapture?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onBlur?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onBlurCapture?: React.FocusEventHandler<HTMLTableDataCellElement> | undefined; onChangeCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onBeforeInput?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onBeforeInputCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInput?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInputCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onReset?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onResetCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onSubmit?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onSubmitCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInvalid?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onInvalidCapture?: React.FormEventHandler<HTMLTableDataCellElement> | undefined; onLoad?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onError?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onErrorCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onKeyDown?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyDownCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyPress?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyPressCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyUp?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onKeyUpCapture?: React.KeyboardEventHandler<HTMLTableDataCellElement> | undefined; onAbort?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onAbortCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlay?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayThrough?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onCanPlayThroughCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onDurationChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onDurationChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEmptied?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEmptiedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEncrypted?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEncryptedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEnded?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onEndedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedData?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedDataCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedMetadata?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadedMetadataCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadStart?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onLoadStartCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPause?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPauseCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlay?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlayCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlaying?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onPlayingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onProgress?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onProgressCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onRateChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onRateChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeeked?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeekedCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeeking?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSeekingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onStalled?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onStalledCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSuspend?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSuspendCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTimeUpdate?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTimeUpdateCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onVolumeChange?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onVolumeChangeCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onWaiting?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onWaitingCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onAuxClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onAuxClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onContextMenu?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onContextMenuCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDoubleClick?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDoubleClickCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onDrag?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnd?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEndCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnter?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragEnterCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragExit?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragExitCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragLeave?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragLeaveCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragOver?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragOverCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragStart?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDragStartCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDrop?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onDropCapture?: React.DragEventHandler<HTMLTableDataCellElement> | undefined; onMouseDown?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseDownCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseEnter?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseLeave?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseMove?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseMoveCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOut?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOutCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOver?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseOverCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseUp?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onMouseUpCapture?: React.MouseEventHandler<HTMLTableDataCellElement> | undefined; onSelect?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onSelectCapture?: React.ReactEventHandler<HTMLTableDataCellElement> | undefined; onTouchCancel?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchCancelCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchEnd?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchEndCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchMove?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchMoveCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchStart?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onTouchStartCapture?: React.TouchEventHandler<HTMLTableDataCellElement> | undefined; onPointerDown?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerDownCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerMove?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerMoveCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerUp?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerUpCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerCancel?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerCancelCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerEnter?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerEnterCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerLeave?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerLeaveCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOver?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOverCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOut?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onPointerOutCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onGotPointerCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onGotPointerCaptureCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onLostPointerCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onLostPointerCaptureCapture?: React.PointerEventHandler<HTMLTableDataCellElement> | undefined; onScroll?: React.UIEventHandler<HTMLTableDataCellElement> | undefined; onScrollCapture?: React.UIEventHandler<HTMLTableDataCellElement> | undefined; onWheel?: React.WheelEventHandler<HTMLTableDataCellElement> | undefined; onWheelCapture?: React.WheelEventHandler<HTMLTableDataCellElement> | undefined; onAnimationStart?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationStartCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationEnd?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationEndCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationIteration?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onAnimationIterationCapture?: React.AnimationEventHandler<HTMLTableDataCellElement> | undefined; onTransitionEnd?: React.TransitionEventHandler<HTMLTableDataCellElement> | undefined; onTransitionEndCapture?: React.TransitionEventHandler<HTMLTableDataCellElement> | undefined; 'data-test-subj'?: string | undefined; css?: ",
               "Interpolation",
               "<",
               "Theme",
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index f9535fb5701374..565f6dfe7ef38b 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index b176edd0697b31..0ff75ff009637c 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index dfed121fe9d037..9639090cb1656e 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index 498512acef6343..4981df336cae1e 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index 04d8a5f1f47be4..8b9513867ef469 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.devdocs.json b/api_docs/screenshotting.devdocs.json
index 64c08e6ab7e514..a28a526b04998f 100644
--- a/api_docs/screenshotting.devdocs.json
+++ b/api_docs/screenshotting.devdocs.json
@@ -488,7 +488,88 @@
   "common": {
     "classes": [],
     "functions": [],
-    "interfaces": [],
+    "interfaces": [
+      {
+        "parentPluginId": "screenshotting",
+        "id": "def-common.PerformanceMetrics",
+        "type": "Interface",
+        "tags": [],
+        "label": "PerformanceMetrics",
+        "description": [
+          "\nCollected performance metrics during a screenshotting session."
+        ],
+        "path": "x-pack/plugins/screenshotting/common/types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "screenshotting",
+            "id": "def-common.PerformanceMetrics.cpu",
+            "type": "number",
+            "tags": [],
+            "label": "cpu",
+            "description": [
+              "\nThe percentage of CPU time spent by the browser divided by number or cores."
+            ],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/screenshotting/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "screenshotting",
+            "id": "def-common.PerformanceMetrics.cpuInPercentage",
+            "type": "number",
+            "tags": [],
+            "label": "cpuInPercentage",
+            "description": [
+              "\nThe percentage of CPU in percent untis."
+            ],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/screenshotting/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "screenshotting",
+            "id": "def-common.PerformanceMetrics.memory",
+            "type": "number",
+            "tags": [],
+            "label": "memory",
+            "description": [
+              "\nThe total amount of memory used by the browser."
+            ],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/screenshotting/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "screenshotting",
+            "id": "def-common.PerformanceMetrics.memoryInMegabytes",
+            "type": "number",
+            "tags": [],
+            "label": "memoryInMegabytes",
+            "description": [
+              "\nThe total amount of memory used by the browser in megabytes."
+            ],
+            "signature": [
+              "number | undefined"
+            ],
+            "path": "x-pack/plugins/screenshotting/common/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
     "enums": [],
     "misc": [
       {
@@ -538,7 +619,7 @@
           "\nSupported layout types."
         ],
         "signature": [
-          "\"canvas\" | \"preserve_layout\" | \"print\""
+          "\"canvas\" | \"print\" | \"preserve_layout\""
         ],
         "path": "x-pack/plugins/screenshotting/common/layout.ts",
         "deprecated": false,
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 2f152b467d568d..a70c69c91deec4 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-reporting-services](https://github.com/orgs/elastic/tea
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 27 | 0 | 8 | 5 |
+| 32 | 0 | 8 | 4 |
 
 ## Client
 
@@ -41,6 +41,9 @@ Contact [@elastic/kibana-reporting-services](https://github.com/orgs/elastic/tea
 
 ## Common
 
+### Interfaces
+<DocDefinitionList data={screenshottingObj.common.interfaces}/>
+
 ### Consts, variables and types
 <DocDefinitionList data={screenshottingObj.common.misc}/>
 
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index bc227e0d57c92d..febe88375ef3aa 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
diff --git a/api_docs/security_solution.devdocs.json b/api_docs/security_solution.devdocs.json
index ce6fc3937f3ecf..391640559497ce 100644
--- a/api_docs/security_solution.devdocs.json
+++ b/api_docs/security_solution.devdocs.json
@@ -77,6 +77,19 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "securitySolution",
+            "id": "def-public.Plugin.buildFlavor",
+            "type": "string",
+            "tags": [],
+            "label": "buildFlavor",
+            "description": [
+              "\nWhether the environment is 'serverless' or 'traditional'"
+            ],
+            "path": "x-pack/plugins/security_solution/public/plugin.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "securitySolution",
             "id": "def-public.Plugin.prebuiltRulesPackageVersion",
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 56233e694a44a6..bc3ffdf3809114 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/security-solution](https://github.com/orgs/elastic/teams/secur
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 174 | 0 | 106 | 35 |
+| 175 | 0 | 106 | 35 |
 
 ## Client
 
diff --git a/api_docs/security_solution_ess.mdx b/api_docs/security_solution_ess.mdx
index d27a0e8a6a917e..b58dafce91a153 100644
--- a/api_docs/security_solution_ess.mdx
+++ b/api_docs/security_solution_ess.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionEss
 title: "securitySolutionEss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionEss plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionEss']
 ---
 import securitySolutionEssObj from './security_solution_ess.devdocs.json';
diff --git a/api_docs/security_solution_serverless.mdx b/api_docs/security_solution_serverless.mdx
index 74f1db94af42b3..cf9ec5b91aabad 100644
--- a/api_docs/security_solution_serverless.mdx
+++ b/api_docs/security_solution_serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionServerless
 title: "securitySolutionServerless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionServerless plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionServerless']
 ---
 import securitySolutionServerlessObj from './security_solution_serverless.devdocs.json';
diff --git a/api_docs/serverless.mdx b/api_docs/serverless.mdx
index 3da87901fd7166..fe1cd09d3cf8db 100644
--- a/api_docs/serverless.mdx
+++ b/api_docs/serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverless
 title: "serverless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverless plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverless']
 ---
 import serverlessObj from './serverless.devdocs.json';
diff --git a/api_docs/serverless_observability.mdx b/api_docs/serverless_observability.mdx
index 77380a3af0bb0b..0ae7995397c181 100644
--- a/api_docs/serverless_observability.mdx
+++ b/api_docs/serverless_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessObservability
 title: "serverlessObservability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessObservability plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessObservability']
 ---
 import serverlessObservabilityObj from './serverless_observability.devdocs.json';
diff --git a/api_docs/serverless_search.mdx b/api_docs/serverless_search.mdx
index c31e05f44e48ac..fe91d628cb1a05 100644
--- a/api_docs/serverless_search.mdx
+++ b/api_docs/serverless_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessSearch
 title: "serverlessSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessSearch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessSearch']
 ---
 import serverlessSearchObj from './serverless_search.devdocs.json';
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index 124a0266a746dd..ac01cb77645715 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index e8f6e5bcc84b7b..49683b402acb9e 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 659e64e03c94cd..324c3f8ade86eb 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index 65f8b144fd5bdf..948e23e6a61bcd 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index afb734134ec302..7207b47ea96d51 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index 72008768874e15..80b732da8644aa 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.devdocs.json b/api_docs/task_manager.devdocs.json
index 620d48af005c2f..2bc531bde52953 100644
--- a/api_docs/task_manager.devdocs.json
+++ b/api_docs/task_manager.devdocs.json
@@ -345,7 +345,13 @@
         "description": [],
         "signature": [
           "(error: Error) => ",
-          "DecoratedError"
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.DecoratedError",
+            "text": "DecoratedError"
+          }
         ],
         "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
         "deprecated": false,
@@ -370,6 +376,75 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "taskManager",
+        "id": "def-server.createTaskRunError",
+        "type": "Function",
+        "tags": [],
+        "label": "createTaskRunError",
+        "description": [],
+        "signature": [
+          "(error: Error, errorSource: ",
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.TaskErrorSource",
+            "text": "TaskErrorSource"
+          },
+          ") => ",
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.DecoratedError",
+            "text": "DecoratedError"
+          }
+        ],
+        "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.createTaskRunError.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "error",
+            "description": [],
+            "signature": [
+              "Error"
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.createTaskRunError.$2",
+            "type": "Enum",
+            "tags": [],
+            "label": "errorSource",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "taskManager",
+                "scope": "server",
+                "docId": "kibTaskManagerPluginApi",
+                "section": "def-server.TaskErrorSource",
+                "text": "TaskErrorSource"
+              }
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "taskManager",
         "id": "def-server.isEphemeralTaskRejectedDueToCapacityError",
@@ -415,7 +490,13 @@
         "description": [],
         "signature": [
           "(error: Error | ",
-          "DecoratedError",
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.DecoratedError",
+            "text": "DecoratedError"
+          },
           ") => boolean"
         ],
         "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
@@ -431,7 +512,13 @@
             "description": [],
             "signature": [
               "Error | ",
-              "DecoratedError"
+              {
+                "pluginId": "taskManager",
+                "scope": "server",
+                "docId": "kibTaskManagerPluginApi",
+                "section": "def-server.DecoratedError",
+                "text": "DecoratedError"
+              }
             ],
             "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
             "deprecated": false,
@@ -451,7 +538,13 @@
         "description": [],
         "signature": [
           "(error: Error | ",
-          "DecoratedError",
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.DecoratedError",
+            "text": "DecoratedError"
+          },
           ") => boolean"
         ],
         "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
@@ -467,7 +560,13 @@
             "description": [],
             "signature": [
               "Error | ",
-              "DecoratedError"
+              {
+                "pluginId": "taskManager",
+                "scope": "server",
+                "docId": "kibTaskManagerPluginApi",
+                "section": "def-server.DecoratedError",
+                "text": "DecoratedError"
+              }
             ],
             "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
             "deprecated": false,
@@ -534,7 +633,15 @@
         "label": "throwUnrecoverableError",
         "description": [],
         "signature": [
-          "(error: Error) => void"
+          "(error: Error, errorSource: ",
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.TaskErrorSource",
+            "text": "TaskErrorSource"
+          },
+          ") => void"
         ],
         "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
         "deprecated": false,
@@ -554,6 +661,27 @@
             "deprecated": false,
             "trackAdoption": false,
             "isRequired": true
+          },
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.throwUnrecoverableError.$2",
+            "type": "Enum",
+            "tags": [],
+            "label": "errorSource",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "taskManager",
+                "scope": "server",
+                "docId": "kibTaskManagerPluginApi",
+                "section": "def-server.TaskErrorSource",
+                "text": "TaskErrorSource"
+              }
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "isRequired": true
           }
         ],
         "returnComment": [],
@@ -834,6 +962,79 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "taskManager",
+        "id": "def-server.DecoratedError",
+        "type": "Interface",
+        "tags": [],
+        "label": "DecoratedError",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "taskManager",
+            "scope": "server",
+            "docId": "kibTaskManagerPluginApi",
+            "section": "def-server.DecoratedError",
+            "text": "DecoratedError"
+          },
+          " extends Error"
+        ],
+        "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.DecoratedError.code",
+            "type": "string",
+            "tags": [],
+            "label": "[code]",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.DecoratedError.retry",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "[retry]",
+            "description": [],
+            "signature": [
+              "boolean | Date | undefined"
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "taskManager",
+            "id": "def-server.DecoratedError.source",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "[source]",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "taskManager",
+                "scope": "server",
+                "docId": "kibTaskManagerPluginApi",
+                "section": "def-server.TaskErrorSource",
+                "text": "TaskErrorSource"
+              },
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "taskManager",
         "id": "def-server.IntervalSchedule",
@@ -1429,6 +1630,18 @@
       }
     ],
     "enums": [
+      {
+        "parentPluginId": "taskManager",
+        "id": "def-server.TaskErrorSource",
+        "type": "Enum",
+        "tags": [],
+        "label": "TaskErrorSource",
+        "description": [],
+        "path": "x-pack/plugins/task_manager/server/task_running/errors.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "taskManager",
         "id": "def-server.TaskStatus",
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index 57e274d294d3c3..602903ef9f6c3b 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-o
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 96 | 0 | 53 | 6 |
+| 105 | 0 | 62 | 5 |
 
 ## Server
 
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index 80b7e4ae53110c..55899b0789d28c 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index 1fcb29570c40bf..48423b3cd5113c 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index cd97d832161f5e..91c2294ff16628 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index 7a5a7677b71c44..e4514a6fffd5e7 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/text_based_languages.mdx b/api_docs/text_based_languages.mdx
index 34df0015bac47f..80ea2fd4442fd2 100644
--- a/api_docs/text_based_languages.mdx
+++ b/api_docs/text_based_languages.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/textBasedLanguages
 title: "textBasedLanguages"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the textBasedLanguages plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'textBasedLanguages']
 ---
 import textBasedLanguagesObj from './text_based_languages.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index 98999fd7710b6f..4d11d75097c83c 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index 819609450dcd6e..7708843c1ad3da 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index 89c3394ff92283..1f9ef01d6f136f 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.devdocs.json b/api_docs/triggers_actions_ui.devdocs.json
index ca061e520518de..a21b1f53aa7047 100644
--- a/api_docs/triggers_actions_ui.devdocs.json
+++ b/api_docs/triggers_actions_ui.devdocs.json
@@ -55,7 +55,7 @@
             "label": "experimentalFeatures",
             "description": [],
             "signature": [
-              "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; }"
+              "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; readonly isMustacheAutocompleteOn: boolean; readonly showMustacheAutocompleteSwitch: boolean; }"
             ],
             "path": "x-pack/plugins/triggers_actions_ui/public/plugin.ts",
             "deprecated": false,
@@ -1570,7 +1570,7 @@
         "label": "TextAreaWithMessageVariables",
         "description": [],
         "signature": [
-          "({ messageVariables, paramsProperty, index, inputTargetValue, isDisabled, editAction, label, errors, helpText, }: React.PropsWithChildren<Props>) => JSX.Element"
+          "(props: Props) => React.ReactElement<any, any> | null"
         ],
         "path": "x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx",
         "deprecated": false,
@@ -1579,12 +1579,12 @@
           {
             "parentPluginId": "triggersActionsUi",
             "id": "def-public.TextAreaWithMessageVariables.$1",
-            "type": "CompoundType",
+            "type": "Object",
             "tags": [],
-            "label": "{\n  messageVariables,\n  paramsProperty,\n  index,\n  inputTargetValue,\n  isDisabled = false,\n  editAction,\n  label,\n  errors,\n  helpText,\n}",
+            "label": "props",
             "description": [],
             "signature": [
-              "React.PropsWithChildren<Props>"
+              "Props"
             ],
             "path": "x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx",
             "deprecated": false,
@@ -2275,6 +2275,20 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "triggersActionsUi",
+            "id": "def-public.ActionParamsProps.ruleTypeId",
+            "type": "string",
+            "tags": [],
+            "label": "ruleTypeId",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "triggersActionsUi",
             "id": "def-public.ActionParamsProps.messageVariables",
@@ -2979,7 +2993,7 @@
             "description": [],
             "signature": [
               "BasicFields",
-              " & { \"@timestamp\"?: string[] | undefined; \"event.action\"?: string[] | undefined; tags?: string[] | undefined; kibana?: string[] | undefined; \"kibana.alert.rule.rule_type_id\"?: string[] | undefined; \"kibana.alert.rule.consumer\"?: string[] | undefined; \"kibana.alert.rule.execution.uuid\"?: string[] | undefined; \"kibana.alert.instance.id\"?: string[] | undefined; \"kibana.alert.rule.category\"?: string[] | undefined; \"kibana.alert.rule.name\"?: string[] | undefined; \"kibana.alert.rule.producer\"?: string[] | undefined; \"kibana.alert.rule.uuid\"?: string[] | undefined; \"kibana.alert.status\"?: string[] | undefined; \"kibana.alert.uuid\"?: string[] | undefined; \"kibana.space_ids\"?: string[] | undefined; \"event.kind\"?: string[] | undefined; \"kibana.alert.action_group\"?: string[] | undefined; \"kibana.alert.case_ids\"?: string[] | undefined; \"kibana.alert.duration.us\"?: string[] | undefined; \"kibana.alert.end\"?: string[] | undefined; \"kibana.alert.flapping\"?: string[] | undefined; \"kibana.alert.maintenance_window_ids\"?: string[] | undefined; \"kibana.alert.reason\"?: string[] | undefined; \"kibana.alert.rule.parameters\"?: string[] | undefined; \"kibana.alert.rule.tags\"?: string[] | undefined; \"kibana.alert.start\"?: string[] | undefined; \"kibana.alert.time_range\"?: string[] | undefined; \"kibana.alert.workflow_status\"?: string[] | undefined; \"kibana.alert.workflow_tags\"?: string[] | undefined; \"kibana.version\"?: string[] | undefined; \"kibana.alert\"?: string[] | undefined; \"kibana.alert.rule\"?: string[] | undefined; \"kibana.alert.risk_score\"?: string[] | undefined; \"kibana.alert.rule.author\"?: string[] | undefined; \"kibana.alert.rule.created_at\"?: string[] | undefined; \"kibana.alert.rule.created_by\"?: string[] | undefined; \"kibana.alert.rule.description\"?: string[] | undefined; \"kibana.alert.rule.enabled\"?: string[] | undefined; \"kibana.alert.rule.from\"?: string[] | undefined; \"kibana.alert.rule.interval\"?: string[] | undefined; \"kibana.alert.rule.license\"?: string[] | undefined; \"kibana.alert.rule.note\"?: string[] | undefined; \"kibana.alert.rule.references\"?: string[] | undefined; \"kibana.alert.rule.rule_id\"?: string[] | undefined; \"kibana.alert.rule.rule_name_override\"?: string[] | undefined; \"kibana.alert.rule.to\"?: string[] | undefined; \"kibana.alert.rule.type\"?: string[] | undefined; \"kibana.alert.rule.updated_at\"?: string[] | undefined; \"kibana.alert.rule.updated_by\"?: string[] | undefined; \"kibana.alert.rule.version\"?: string[] | undefined; \"kibana.alert.severity\"?: string[] | undefined; \"kibana.alert.suppression.docs_count\"?: string[] | undefined; \"kibana.alert.suppression.end\"?: string[] | undefined; \"kibana.alert.suppression.terms\"?: string[] | undefined; \"kibana.alert.suppression.terms.field\"?: string[] | undefined; \"kibana.alert.suppression.start\"?: string[] | undefined; \"kibana.alert.suppression.terms.value\"?: string[] | undefined; \"kibana.alert.system_status\"?: string[] | undefined; \"kibana.alert.workflow_reason\"?: string[] | undefined; \"kibana.alert.workflow_user\"?: string[] | undefined; \"ecs.version\"?: string[] | undefined; \"kibana.alert.evaluation.threshold\"?: string[] | undefined; \"kibana.alert.evaluation.value\"?: string[] | undefined; \"kibana.alert.context\"?: string[] | undefined; \"kibana.alert.evaluation.values\"?: string[] | undefined; \"kibana.alert.group\"?: string[] | undefined; \"kibana.alert.group.field\"?: string[] | undefined; \"kibana.alert.group.value\"?: string[] | undefined; \"event.module\"?: string[] | undefined; \"kibana.alert.building_block_type\"?: string[] | undefined; \"kibana.alert.rule.exceptions_list\"?: string[] | undefined; \"kibana.alert.rule.namespace\"?: string[] | undefined; \"kibana.alert.rule.threat.framework\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.id\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.name\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.reference\"?: string[] | undefined; } & { [x: string]: unknown[]; }"
+              " & { \"@timestamp\"?: string[] | undefined; \"event.action\"?: string[] | undefined; tags?: string[] | undefined; kibana?: string[] | undefined; \"kibana.alert.rule.rule_type_id\"?: string[] | undefined; \"kibana.alert.rule.consumer\"?: string[] | undefined; \"kibana.alert.rule.execution.uuid\"?: string[] | undefined; \"kibana.alert.instance.id\"?: string[] | undefined; \"kibana.alert.rule.category\"?: string[] | undefined; \"kibana.alert.rule.name\"?: string[] | undefined; \"kibana.alert.rule.producer\"?: string[] | undefined; \"kibana.alert.rule.uuid\"?: string[] | undefined; \"kibana.alert.status\"?: string[] | undefined; \"kibana.alert.uuid\"?: string[] | undefined; \"kibana.space_ids\"?: string[] | undefined; \"event.kind\"?: string[] | undefined; \"kibana.alert.action_group\"?: string[] | undefined; \"kibana.alert.case_ids\"?: string[] | undefined; \"kibana.alert.duration.us\"?: string[] | undefined; \"kibana.alert.end\"?: string[] | undefined; \"kibana.alert.flapping\"?: string[] | undefined; \"kibana.alert.maintenance_window_ids\"?: string[] | undefined; \"kibana.alert.reason\"?: string[] | undefined; \"kibana.alert.rule.parameters\"?: string[] | undefined; \"kibana.alert.rule.tags\"?: string[] | undefined; \"kibana.alert.start\"?: string[] | undefined; \"kibana.alert.time_range\"?: string[] | undefined; \"kibana.alert.workflow_status\"?: string[] | undefined; \"kibana.alert.workflow_tags\"?: string[] | undefined; \"kibana.version\"?: string[] | undefined; \"kibana.alert.context\"?: string[] | undefined; \"kibana.alert.evaluation.threshold\"?: string[] | undefined; \"kibana.alert.evaluation.value\"?: string[] | undefined; \"kibana.alert.evaluation.values\"?: string[] | undefined; \"kibana.alert.group\"?: string[] | undefined; \"ecs.version\"?: string[] | undefined; \"kibana.alert.risk_score\"?: string[] | undefined; \"kibana.alert.rule.author\"?: string[] | undefined; \"kibana.alert.rule.created_at\"?: string[] | undefined; \"kibana.alert.rule.created_by\"?: string[] | undefined; \"kibana.alert.rule.description\"?: string[] | undefined; \"kibana.alert.rule.enabled\"?: string[] | undefined; \"kibana.alert.rule.from\"?: string[] | undefined; \"kibana.alert.rule.interval\"?: string[] | undefined; \"kibana.alert.rule.license\"?: string[] | undefined; \"kibana.alert.rule.note\"?: string[] | undefined; \"kibana.alert.rule.references\"?: string[] | undefined; \"kibana.alert.rule.rule_id\"?: string[] | undefined; \"kibana.alert.rule.rule_name_override\"?: string[] | undefined; \"kibana.alert.rule.to\"?: string[] | undefined; \"kibana.alert.rule.type\"?: string[] | undefined; \"kibana.alert.rule.updated_at\"?: string[] | undefined; \"kibana.alert.rule.updated_by\"?: string[] | undefined; \"kibana.alert.rule.version\"?: string[] | undefined; \"kibana.alert.severity\"?: string[] | undefined; \"kibana.alert.suppression.docs_count\"?: string[] | undefined; \"kibana.alert.suppression.end\"?: string[] | undefined; \"kibana.alert.suppression.start\"?: string[] | undefined; \"kibana.alert.suppression.terms.field\"?: string[] | undefined; \"kibana.alert.suppression.terms.value\"?: string[] | undefined; \"kibana.alert.system_status\"?: string[] | undefined; \"kibana.alert.workflow_reason\"?: string[] | undefined; \"kibana.alert.workflow_user\"?: string[] | undefined; \"event.module\"?: string[] | undefined; \"kibana.alert.rule.threat.framework\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.id\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.name\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.reference\"?: string[] | undefined; \"kibana.alert.building_block_type\"?: string[] | undefined; \"kibana.alert\"?: string[] | undefined; \"kibana.alert.rule\"?: string[] | undefined; \"kibana.alert.suppression.terms\"?: string[] | undefined; \"kibana.alert.group.field\"?: string[] | undefined; \"kibana.alert.group.value\"?: string[] | undefined; \"kibana.alert.rule.exceptions_list\"?: string[] | undefined; \"kibana.alert.rule.namespace\"?: string[] | undefined; } & { [x: string]: unknown[]; }"
             ],
             "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
             "deprecated": false,
@@ -4075,6 +4089,20 @@
             "path": "x-pack/plugins/alerting/common/rule.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "triggersActionsUi",
+            "id": "def-public.RuleAction.useAlertDataForTemplate",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "useAlertDataForTemplate",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/common/rule.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -6140,7 +6168,7 @@
           "EuiDataGridToolBarVisibilityOptions",
           " | undefined; shouldHighlightRow?: ((alert: ",
           "EcsFieldsResponse",
-          ") => boolean) | undefined; featureIds?: ",
+          ") => boolean) | undefined; dynamicRowHeight?: boolean | undefined; featureIds?: ",
           {
             "pluginId": "@kbn/rule-data-utils",
             "scope": "common",
@@ -9226,10 +9254,10 @@
         ],
         "label": "parseExperimentalConfigValue",
         "description": [
-          "\nParses the string value used in `xpack.trigger_actions_ui.enableExperimental` kibana configuration,\nwhich should be a string of values delimited by a comma (`,`)\n"
+          "\nParses the string value used in `xpack.trigger_actions_ui.enableExperimental` kibana configuration,\nwhich should be a string of values delimited by a comma (`,`):\nxpack.trigger_actions_ui.enableExperimental: ['ruleStatusFilter', 'ruleTagFilter']\n"
         ],
         "signature": [
-          "(configValue: string[]) => Readonly<{ rulesListDatagrid: boolean; internalAlertsTable: boolean; ruleTagFilter: boolean; ruleStatusFilter: boolean; rulesDetailLogs: boolean; ruleUseExecutionStatus: boolean; ruleKqlBar: boolean; }>"
+          "(configValue: string[]) => Readonly<{ rulesListDatagrid: boolean; internalAlertsTable: boolean; ruleTagFilter: boolean; ruleStatusFilter: boolean; rulesDetailLogs: boolean; ruleUseExecutionStatus: boolean; ruleKqlBar: boolean; isMustacheAutocompleteOn: boolean; showMustacheAutocompleteSwitch: boolean; }>"
         ],
         "path": "x-pack/plugins/triggers_actions_ui/common/experimental_features.ts",
         "deprecated": false,
@@ -9829,7 +9857,7 @@
         "label": "ExperimentalFeatures",
         "description": [],
         "signature": [
-          "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; }"
+          "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; readonly isMustacheAutocompleteOn: boolean; readonly showMustacheAutocompleteSwitch: boolean; }"
         ],
         "path": "x-pack/plugins/triggers_actions_ui/common/experimental_features.ts",
         "deprecated": false,
@@ -9893,7 +9921,7 @@
           "\nA list of allowed values that can be used in `xpack.trigger_actions_ui.enableExperimental`.\nThis object is then used to validate and parse the value entered."
         ],
         "signature": [
-          "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; }"
+          "{ readonly rulesListDatagrid: boolean; readonly internalAlertsTable: boolean; readonly ruleTagFilter: boolean; readonly ruleStatusFilter: boolean; readonly rulesDetailLogs: boolean; readonly ruleUseExecutionStatus: boolean; readonly ruleKqlBar: boolean; readonly isMustacheAutocompleteOn: boolean; readonly showMustacheAutocompleteSwitch: boolean; }"
         ],
         "path": "x-pack/plugins/triggers_actions_ui/common/experimental_features.ts",
         "deprecated": false,
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index 8c73bb0d5aa73a..8076002044f80f 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/response-ops](https://github.com/orgs/elastic/teams/response-o
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 581 | 1 | 555 | 55 |
+| 583 | 1 | 557 | 55 |
 
 ## Client
 
diff --git a/api_docs/ui_actions.devdocs.json b/api_docs/ui_actions.devdocs.json
index 8aa60c3c65f779..fc3e6efa4a21ac 100644
--- a/api_docs/ui_actions.devdocs.json
+++ b/api_docs/ui_actions.devdocs.json
@@ -2218,7 +2218,7 @@
                 "section": "def-common.FieldAttrs",
                 "text": "FieldAttrs"
               },
-              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }"
+              " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; allowHidden?: boolean | undefined; }"
             ],
             "path": "src/plugins/ui_actions/public/types.ts",
             "deprecated": false,
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index 09ea8571e5e37f..1c8f3f5e834459 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index ab66378e46af63..bc7c3d55f0c609 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_doc_viewer.mdx b/api_docs/unified_doc_viewer.mdx
index 97b7dd9ecef177..dff22e1edd0b68 100644
--- a/api_docs/unified_doc_viewer.mdx
+++ b/api_docs/unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedDocViewer
 title: "unifiedDocViewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedDocViewer plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedDocViewer']
 ---
 import unifiedDocViewerObj from './unified_doc_viewer.devdocs.json';
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index e387084a28c5a3..1b8cde06831323 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index a5485bf130a5d5..dd540663bb6094 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index ce1b8e55bbcab7..996c7f5528dcce 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/uptime.mdx b/api_docs/uptime.mdx
index a2218269f4ce5f..814bcd995e63ac 100644
--- a/api_docs/uptime.mdx
+++ b/api_docs/uptime.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uptime
 title: "uptime"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uptime plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uptime']
 ---
 import uptimeObj from './uptime.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index b1a9193a7fae20..9f93b59207c102 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index 17cb54fde2442e..fb864ad0379869 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index adc6a59bc27d49..8098cf149e57ec 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index 5d83a164601ebd..40877abcb63481 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index 0c10deb217431c..0d4725984ca1ef 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index c532426fb79165..7857b49c7ecdc5 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index a8635835c673af..c1307ba118b0bc 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index 65cc4d4adacb96..37333abc730d5e 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index 4855114b873fe7..cb39b15983e163 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index d32b566d45383e..882aaf0a79f71a 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index 6ccc3abe170cf9..d1fa982b691c8e 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index 00f2ea78e7d663..7084cbc94b13e4 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index 7df847499812f7..44036f2755796f 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index 3d9c01a701c3ae..ce10e1dd34ed87 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2023-11-10
+date: 2023-11-16
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';
diff --git a/config/serverless.yml b/config/serverless.yml
index a6aba80736f2da..3731caddd58326 100644
--- a/config/serverless.yml
+++ b/config/serverless.yml
@@ -127,7 +127,7 @@ xpack.alerting.rules.run.actions.max: 3000
 xpack.alerting.rules.run.timeout: 1m
 xpack.alerting.rules.run.ruleTypeOverrides:
   - id: siem.indicatorRule
-    timeout: 1m
+    timeout: 10m
 xpack.alerting.rules.minimumScheduleInterval.enforce: true
 xpack.alerting.rules.maxScheduledPerMinute: 400
 xpack.actions.run.maxAttempts: 10
diff --git a/dev_docs/key_concepts/anatomy_of_a_plugin.mdx b/dev_docs/key_concepts/anatomy_of_a_plugin.mdx
index c71897fc34fcb7..6b90fa0b0c9388 100644
--- a/dev_docs/key_concepts/anatomy_of_a_plugin.mdx
+++ b/dev_docs/key_concepts/anatomy_of_a_plugin.mdx
@@ -122,7 +122,7 @@ If you are developing in TypeScript (which we recommend), you will need to add a
 core capabilities as an argument. It should return an instance of its plugin class for Kibana to load.
 
 ```ts
-import type { PluginInitializerContext } from '@kbn/core/server';
+import type { PluginInitializerContext } from '@kbn/core/public';
 import { DemoPlugin } from './plugin';
 
 export function plugin(initializerContext: PluginInitializerContext) {
@@ -177,7 +177,16 @@ export class DemoPlugin implements Plugin {
 
 ### server/index.ts
 
-`server/index.ts` is the entry-point into the server-side code of this plugin. It is identical in almost every way to the client-side entry-point:
+`server/index.ts` is the entry-point into the server-side code of this plugin.
+
+```ts
+import type { PluginInitializerContext } from '@kbn/core/server';
+
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { DemoPlugin } = await import('./plugin');
+  return new DemoPlugin(initializerContext);
+}
+```
 
 ### server/plugin.ts
 
diff --git a/dev_docs/key_concepts/navigation.mdx b/dev_docs/key_concepts/navigation.mdx
index e383f21187d41f..def5e224d05ccf 100644
--- a/dev_docs/key_concepts/navigation.mdx
+++ b/dev_docs/key_concepts/navigation.mdx
@@ -3,7 +3,7 @@ id: kibDevKeyConceptsNavigation
 slug: /kibana-dev-docs/routing-and-navigation
 title: Routing, Navigation and URL
 description: Learn best practices about navigation inside Kibana
-date: 2021-10-05
+date: 2023-11-07
 tags: ['kibana', 'dev', 'architecture', 'contributor']
 ---
 
@@ -116,11 +116,11 @@ const MySPALink = () =>
 ```
 
 As it would be too much boilerplate to do this for each link in your app, there is a handy wrapper that helps with it:
-[RedirectAppLinks](https://github.com/elastic/kibana/blob/main/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx#L49).
+[RedirectAppLinks](https://github.com/elastic/kibana/blob/main/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.tsx).
 
 ```jsx
 const MyApp = () =>
-<RedirectAppLinks application={core.application}>
+<RedirectAppLinks coreStart={{application: core.application}}>
   {/*...*/}
   {/* navigations using this link will happen in SPA friendly way */}
   <a href={urlToADashboard}>Go to Dashboard</a>
diff --git a/dev_docs/tutorials/ci.mdx b/dev_docs/tutorials/ci.mdx
index a332d7e616e6c2..2234143c32664b 100644
--- a/dev_docs/tutorials/ci.mdx
+++ b/dev_docs/tutorials/ci.mdx
@@ -3,7 +3,7 @@ id: kibDevTutorialCI
 slug: /kibana-dev-docs/tutorials/ci
 title: CI
 description: CI
-date: 2022-02-03
+date: 2023-11-08
 tags: ['kibana', 'onboarding', 'dev', 'ci']
 ---
 
@@ -29,28 +29,76 @@ Build documentation from the root `docs` folder.
 
 ### Labels
 
-Labels can be added to a pull request to run conditional pipelines.
+Labels can be added to a pull request to run conditional pipelines.  Build artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+
+#### `ci:all-cypress-suites`
+
+Some Cypress test suites are only run when code changes are made in certain files, typically files with overlapping test coverage.  Adding this label will cause all Cypress tests to run.
+
+#### `ci:build-all-platforms`
+
+Build Windows, macOS, and Linux archives.
+
+#### `ci:build-canvas-shareable-runtime`
+
+Build the Canvas shareable runtime and include it in the distribution.
+
+#### `ci:build-cdn-assets`
+
+Build an archive that can be used to serve Kibana's static assets.
+
+#### `ci:build-cloud-image`
+
+Build cloud Docker images that can be used for testing deployments on Elastic Cloud.
+
+#### `ci:build-os-packages`
+
+Build Docker images, and Debian and RPM packages.
+
+#### `ci:build-serverless-image`
+
+Build serverless Docker images that can be used for testing deployments on Elastic Cloud.
+
+#### `ci:build-storybooks`
+
+Build and upload storybooks.
+
+#### `ci:build-webpack-bundle-analyzer`
+
+Build and upload a bundle report generated by `webpack-bundle-analyzer`.
 
 #### `ci:cloud-deploy`
 
-Create or update a deployment on Elastic Cloud.
+Create or update a deployment on Elastic Cloud production.
+
+#### `ci:cloud-persist-deployment`
+
+Prevents an existing deployment from being shutdown due to inactivity.
 
 #### `ci:cloud-redeploy`
 
 Create a new deployment on Elastic Cloud.  Previous deployments linked to a pull request will be shutdown and data will not be preserved.
 
-#### `ci:build-all-platforms`
+#### `ci:collect-apm`
 
-Build Windows, macOS, and Linux archives.  Artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+Collect APM metrics, available for viewing on the Kibana CI APM cluster.
 
-#### `ci:build-os-packages`
+#### `ci:no-auto-commit`
 
-Build Docker images, and Debian and RPM packages.  Artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+Skip auto-committing changed files.
 
-#### `ci:build-cloud-image`
+#### `ci:project-deploy-elasticsearch`
 
-Build Docker images that can be used for testing deployments on Elastic Cloud in the CFT region (gcp-us-west2).  Artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+Create or update a serverless Elasticsearch project on Elastic Cloud QA.
 
-#### `ci:all-cypress-suites`
+#### `ci:project-deploy-observability`
+
+Create or update a serverless Observability project on Elastic Cloud QA.
+
+#### `ci:project-deploy-security`
+
+Create or update a serverless Security project on Elastic Cloud QA.
+
+#### `ci:project-persist-deployment`
 
-By default, Cypress test suites are only run when code changes are made in certain files, typically files with overlapping test coverage.  Adding this label will cause all Cypress tests to run.
+Prevents an existing deployment from being shutdown due to inactivity.
diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc
index c10d674fb4812d..1b7d6e6b88321c 100644
--- a/docs/CHANGELOG.asciidoc
+++ b/docs/CHANGELOG.asciidoc
@@ -10,6 +10,7 @@
 
 Review important information about the {kib} 8.x releases.
 
+* <<release-notes-8.11.1>>
 * <<release-notes-8.11.0>>
 * <<release-notes-8.10.4>>
 * <<release-notes-8.10.3>>
@@ -53,6 +54,49 @@ Review important information about the {kib} 8.x releases.
 * <<release-notes-8.0.0-alpha1>>
 
 --
+
+[[release-notes-8.11.1]]
+== {kib} 8.11.1
+
+For information about the {kib} 8.11.1 release, review the following information.
+
+[float]
+[[security-update-v8.11.1]]
+=== Security updates
+
+* An issue was discovered by Elastic whereby sensitive information is recorded
+in {kib} logs in the event of an error. The error message recorded in the log
+may contain account credentials for the `kibana_system` user, API Keys, and
+credentials of {kib} end users.
++
+--
+The issue impacts {kib} {kib} versions on or after 8.0.0 and before 8.11.1. The
+issue is resolved in {kib} 8.11.1.
+
+**Nov 15, 2023 Update:** After additional investigation, it has been determined
+that {kib} 7.x versions are not affected by this issue. We previously reported
+this issue impacted {kib} versions before 7.17.15.
+
+For more information, see our related
+https://discuss.elastic.co/t/8-11-1-7-17-15-security-update-esa-2023-25/347149[security
+announcement].
+--
+
+[float]
+[[fixes-v8.11.1]]
+=== Bug Fixes
+
+Fleet::
+* Append space ID to security solution tag ({kibana-pull}170789[#170789]).
+* Modify bulk unenroll to include inactive agents ({kibana-pull}170249[#170249]).
+Lens & Visualizations::
+* Fixes error handling for ES|QL nested error messages ({kibana-pull}170005[#170005]).
+Machine Learning::
+* Disable anomaly detection job creation from ES|QL lens visualizations ({kibana-pull}170711[#170711]).
+Presentation::
+* Fixes vector tile layer with joins stuck in loading state when not visible ({kibana-pull}170984[#170984]).
+* Fixes expand layer control is not clickable when layers are loading ({kibana-pull}170912[#170912]).
+
 [[release-notes-8.11.0]]
 == {kib} 8.11.0
 
@@ -776,10 +820,10 @@ For information about the {kib} 8.9.0 release, review the following information.
 [%collapsible]
 ====
 *Details* +
-Changes to Lens visualizations do not appear in the saved object. 
+Changes to Lens visualizations do not appear in the saved object.
 
 *Impact* +
-When you remove fields from Lens visualizations, then save your changes, the removed fields continue to appear in the Lens visualization saved objects. 
+When you remove fields from Lens visualizations, then save your changes, the removed fields continue to appear in the Lens visualization saved objects.
 For example, when you remove runtime fields from a Lens visualization and {kib}, then inspect the Lens visualization saved object, the runtime fields continue to appear and an error message appears.
 
 *Workaround* +
diff --git a/docs/api/actions-and-connectors/execute.asciidoc b/docs/api/actions-and-connectors/execute.asciidoc
index 1f241202b4adca..aa04a0d6ef9b6d 100644
--- a/docs/api/actions-and-connectors/execute.asciidoc
+++ b/docs/api/actions-and-connectors/execute.asciidoc
@@ -60,6 +60,32 @@ refer to <<action-types>>.
 [%collapsible%open]
 ====
 
+.Email connectors
+[%collapsible%open]
+=====
+`bcc`::
+(Optional, array of strings) A list of "blind carbon copy" email addresses.
+Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
+
+`cc`::
+(Optional, array of strings) A list of "carbon copy" email addresses.
+Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
+
+`message`::
+(Required, string) The email message text. Markdown format is supported.
+
+`subject`::
+(Required, string) The subject line of the email.
+
+`to`::
+(Required^*^, array of strings)
+A list of email addresses.
+Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
+There must be at least one recipient in `to`, `cc`, or `bcc`.
+
+For more information, refer to <<email-action-type>>.
+=====
+
 .Index connectors
 [%collapsible%open]
 =====
diff --git a/docs/developer/architecture/core/configuration-service.asciidoc b/docs/developer/architecture/core/configuration-service.asciidoc
index ed03be73296cb8..86c4d5050b0b94 100644
--- a/docs/developer/architecture/core/configuration-service.asciidoc
+++ b/docs/developer/architecture/core/configuration-service.asciidoc
@@ -35,7 +35,7 @@ export type MyPluginConfigType = TypeOf<typeof config.schema>;
 
 * Read config value exposed via `PluginInitializerContext`:
 
-*my_plugin/server/index.ts*
+*my_plugin/server/plugin.ts*
 [source,typescript]
 ----
 import type { PluginInitializerContext } from '@kbn/core/server';
diff --git a/docs/developer/architecture/kibana-platform-plugin-api.asciidoc b/docs/developer/architecture/kibana-platform-plugin-api.asciidoc
index 85fc05d0f9fd86..4c23aead9d5664 100644
--- a/docs/developer/architecture/kibana-platform-plugin-api.asciidoc
+++ b/docs/developer/architecture/kibana-platform-plugin-api.asciidoc
@@ -100,9 +100,9 @@ entry-point:
 [source,typescript]
 ----
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { MyPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { MyPlugin } = await import('./plugin');
   return new MyPlugin(initializerContext);
 }
 ----
diff --git a/docs/developer/best-practices/navigation.asciidoc b/docs/developer/best-practices/navigation.asciidoc
index 20c52b40978c44..6d6ebb38e558bf 100644
--- a/docs/developer/best-practices/navigation.asciidoc
+++ b/docs/developer/best-practices/navigation.asciidoc
@@ -120,12 +120,12 @@ const MySPALink = () =>
 ----
 
 As it would be too much boilerplate to do this for each {kib} link in your app, there is a handy wrapper that helps with it: 
-{kib-repo}tree/{branch}/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx#L49[RedirectAppLinks].
+{kib-repo}tree/{branch}/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.tsx[RedirectAppLinks].
 
 [source,typescript jsx]
 ----
 const MyApp = () => 
-  <RedirectAppLinks application={core.application}>
+  <RedirectAppLinks coreStart={{application: core.application}}>
     {/*...*/}
     {/* navigations using this link will happen in SPA friendly way */}
       <a href={urlToADashboard}>Go to Dashboard</a>
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 868ef59f479666..df3f4c8ec855df 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -519,6 +519,10 @@ Plugin server-side only. Plugin has three main functions:
 |Adds drilldown capabilities to dashboard.  Owned by the Kibana App team.
 
 
+|{kib-repo}blob/{branch}/x-pack/plugins/dataset_quality/README.md[datasetQuality]
+|In order to make ongoing maintenance of log collection easy we want to introduce the concept of dataset quality, where users can easily get an overview on the datasets they have with information such as integration, size, last activity, among others.
+
+
 |{kib-repo}blob/{branch}/x-pack/plugins/data_visualizer/README.md[dataVisualizer]
 |The data_visualizer plugin enables you to explore the fields in your data.
 
diff --git a/docs/osquery/exported-fields-reference.asciidoc b/docs/osquery/exported-fields-reference.asciidoc
index fc16ec3e0d9d03..b3127f2ad48cfa 100644
--- a/docs/osquery/exported-fields-reference.asciidoc
+++ b/docs/osquery/exported-fields-reference.asciidoc
@@ -96,6 +96,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _wifi_networks.added_at_ - Time this network was added as a unix_time
 
+*additional_properties* - keyword, text.text
+
+* _windows_search.additional_properties_ - Comma separated list of columns to include in properties JSON
+
 *address* - keyword, text.text
 
 * _arp_cache.address_ - IPv4 address target
@@ -141,6 +145,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _alf.allow_signed_enabled_ - 1 If allow signed mode is enabled else 0
 
+*ambient_brightness_enabled* - keyword, text.text
+
+* _connected_displays.ambient_brightness_enabled_ - The ambient brightness setting associated with the display. This will be 1 if enabled and is 0 if disabled or not supported.
+
 *ami_id* - keyword, text.text
 
 * _ec2_instance_metadata.ami_id_ - AMI ID used to launch this EC2 instance
@@ -583,6 +591,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *bundle_version* - keyword, text.text
 
 * _apps.bundle_version_ - Info properties CFBundleVersion label
+* _safari_extensions.bundle_version_ - The version of the build that identifies an iteration of the bundle
 
 *busy_state* - keyword, number.long
 
@@ -777,11 +786,16 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _ntdomains.client_site_name_ - The name of the site where the domain controller is configured.
 
+*cloud_id* - keyword, text.text
+
+* _ycloud_instance_metadata.cloud_id_ - Cloud identifier for the VM
+
 *cmdline* - keyword, text.text
 
 * _bpf_process_events.cmdline_ - Command line arguments
 * _docker_container_processes.cmdline_ - Complete argv
 * _es_process_events.cmdline_ - Command line arguments (argv)
+* _process_etw_events.cmdline_ - Command Line
 * _process_events.cmdline_ - Command line arguments (argv)
 * _processes.cmdline_ - Complete argv
 
@@ -973,6 +987,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _interface_details.connection_status_ - State of the network adapter connection to the network.
 
+*connection_type* - keyword, text.text
+
+* _connected_displays.connection_type_ - The connection type associated with the display.
+
 *consistency_scan_date* - keyword, number.long
 
 * _time_machine_destinations.consistency_scan_date_ - Consistency scan date
@@ -1024,6 +1042,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *copyright* - keyword, text.text
 
 * _apps.copyright_ - Info properties NSHumanReadableCopyright label
+* _safari_extensions.copyright_ - A human-readable copyright notice for the bundle
 
 *core* - keyword, number.long
 
@@ -1088,6 +1107,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _docker_info.cpu_shares_ - 1 if CPU share weighting support is enabled. 0 otherwise
 
+*cpu_sockets* - keyword, number.long
+
+* _system_info.cpu_sockets_ - Number of processor sockets in the system
+
 *cpu_spec_ctrl_supported* - keyword, number.long
 
 * _kva_speculative_info.cpu_spec_ctrl_supported_ - SPEC_CTRL MSR supported by CPU Microcode.
@@ -1236,10 +1259,19 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _platform_info.date_ - Self-reported platform code update date
 * _windows_update_history.date_ - Date and the time an update was applied
 
+*date_created* - keyword, number.long
+
+* _windows_search.date_created_ - The unix timestamp of when the item was created.
+
+*date_modified* - keyword, number.long
+
+* _windows_search.date_modified_ - The unix timestamp of when the item was last modified
+
 *datetime* - keyword, text.text
 
 * _crashes.datetime_ - Date/Time at which the crash occurred
 * _powershell_events.datetime_ - System time at which the Powershell script event occurred
+* _process_etw_events.datetime_ - Event timestamp in DATETIME format
 * _syslog_events.datetime_ - Time known to syslog
 * _time.datetime_ - Current date and time (ISO format) in UTC
 * _windows_crashes.datetime_ - Timestamp (log format) of the crash
@@ -1306,6 +1338,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _drivers.description_ - Driver description
 * _firefox_addons.description_ - Addon-supplied description string
 * _interface_details.description_ - Short description of the object a one-line string.
+* _kernel_keys.description_ - The key description.
 * _keychain_acls.description_ - The description included with the ACL entry
 * _keychain_items.description_ - Optional item description
 * _logical_drives.description_ - The canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'.
@@ -1481,11 +1514,19 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _docker_container_stats.disk_write_ - Total disk write bytes
 
+*display_id* - keyword, text.text
+
+* _connected_displays.display_id_ - The display ID.
+
 *display_name* - keyword, text.text
 
 * _apps.display_name_ - Info properties CFBundleDisplayName label
 * _services.display_name_ - Service Display name
 
+*display_type* - keyword, text.text
+
+* _connected_displays.display_type_ - The type of display.
+
 *dns_domain* - keyword, text.text
 
 * _interface_details.dns_domain_ - Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'.
@@ -1607,6 +1648,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _file_events.eid_ - Event ID
 * _hardware_events.eid_ - Event ID
 * _ntfs_journal_events.eid_ - Event ID
+* _process_etw_events.eid_ - Event ID
 * _process_events.eid_ - Event ID
 * _process_file_events.eid_ - Event ID
 * _selinux_events.eid_ - Event ID
@@ -1837,6 +1879,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _bpf_process_events.exit_code_ - Exit code of the system call
 * _bpf_socket_events.exit_code_ - Exit code of the system call
 * _es_process_events.exit_code_ - Exit code of a process in case of an exit event
+* _process_etw_events.exit_code_ - Exit Code - Present only on ProcessStop events
 
 *expand* - keyword, number.long
 
@@ -1854,6 +1897,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _curl_certificate.extended_key_usage_ - Extended usage of key in certificate
 
+*extension_type* - keyword, text.text
+
+* _safari_extensions.extension_type_ - Extension Type: WebOrAppExtension or LegacyExtension
+
 *extensions* - keyword, text.text
 
 * _osquery_info.extensions_ - osquery extensions status
@@ -1865,6 +1912,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *extra* - keyword, text.text
 
 * _asl.extra_ - Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.
+* _os_version.extra_ - Optional extra release specification
 * _platform_info.extra_ - Platform-specific additional information
 
 *facility* - keyword, text.text
@@ -2018,8 +2066,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _device_partitions.flags_ - 
 * _dns_cache.flags_ - DNS record flags
 * _interface_details.flags_ - Flags (netdevice) for the device
+* _kernel_keys.flags_ - A set of flags describing the state of the key.
 * _mounts.flags_ - Mounted device flags
 * _pipes.flags_ - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes
+* _process_etw_events.flags_ - Process Flags
 * _routes.flags_ - Flags to describe route
 
 *folder_id* - keyword, text.text
@@ -2107,6 +2157,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _file.gid_ - Owning group ID
 * _file_events.gid_ - Owning group ID
 * _groups.gid_ - Unsigned int64 group ID
+* _kernel_keys.gid_ - The group ID of the key.
 * _package_bom.gid_ - Expected group of file or directory
 * _process_events.gid_ - Group ID at process start
 * _process_file_events.gid_ - The gid of the process performing the action
@@ -2240,6 +2291,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _sudoers.header_ - Symbol for given rule
 
+*header_pid* - keyword, number.long
+
+* _process_etw_events.header_pid_ - Process ID of the process reporting the event
+
 *header_size* - keyword, number.long
 
 * _smbios_tables.header_size_ - Header size in bytes
@@ -3081,6 +3136,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _magic.magic_db_files_ - Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc
 
+*main* - keyword, number.long
+
+* _connected_displays.main_ - If the display is the main display.
+
 *maintainer* - keyword, text.text
 
 * _apt_sources.maintainer_ - Repository maintainer
@@ -3098,6 +3157,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _lxd_networks.managed_ - 1 if network created by LXD, 0 otherwise
 
+*mandatory_label* - keyword, text.text
+
+* _process_etw_events.mandatory_label_ - Primary token mandatory label sid - Present only on ProcessStart events
+
 *manifest_hash* - keyword, text.text
 
 * _chrome_extensions.manifest_hash_ - The SHA256 hash of the manifest.json file
@@ -3114,6 +3177,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _battery.manufacture_date_ - The date the battery was manufactured UNIX Epoch
 
+*manufactured_week* - keyword, number.long
+
+* _connected_displays.manufactured_week_ - The manufacture week of the display. This field is 0 if not supported
+
+*manufactured_year* - keyword, number.long
+
+* _connected_displays.manufactured_year_ - The manufacture year of the display. This field is 0 if not supported
+
 *manufacturer* - keyword, text.text
 
 * _battery.manufacturer_ - The battery manufacturer's name
@@ -3170,6 +3241,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _pipes.max_instances_ - The maximum number of instances creatable for this pipe
 
+*max_results* - keyword, number.long
+
+* _windows_search.max_results_ - Maximum number of results returned by windows api, set to -1 for unlimited
+
 *max_rows* - keyword, number.long
 
 * _unified_log.max_rows_ - the max number of rows returned (defaults to 100)
@@ -3258,6 +3333,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _memory_info.memory_available_ - The amount of physical RAM, in bytes, available for starting new applications, without swapping
 
+*memory_cached* - keyword, number.long
+
+* _docker_container_stats.memory_cached_ - Memory cached
+
 *memory_device_handle* - keyword, text.text
 
 * _memory_device_mapped_addresses.memory_device_handle_ - Handle of the memory device structure associated with this structure
@@ -3400,6 +3479,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _battery.minutes_until_empty_ - The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated
 
+*mirror* - keyword, number.long
+
+* _connected_displays.mirror_ - If the display is mirrored or not. This field is 1 if mirrored and 0 if not mirrored.
+
 *mirrorlist* - keyword, text.text
 
 * _yum_sources.mirrorlist_ - Mirrorlist URL
@@ -3515,6 +3598,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _browser_plugins.name_ - Plugin display name
 * _chocolatey_packages.name_ - Package display name
 * _chrome_extensions.name_ - Extension display name
+* _connected_displays.name_ - The name of the display.
 * _cups_destinations.name_ - Name of the printer
 * _deb_packages.name_ - Package name
 * _disk_encryption.name_ - Disk name
@@ -3580,6 +3664,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _temperature_sensors.name_ - Name of temperature source
 * _windows_firewall_rules.name_ - Friendly name of the rule
 * _windows_optional_features.name_ - Name of the feature
+* _windows_search.name_ - The name of the item
 * _windows_security_products.name_ - Name of product
 * _wmi_bios_info.name_ - Name of the Bios setting
 * _wmi_cli_event_consumers.name_ - Unique name of a consumer.
@@ -3702,6 +3787,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _cpu_info.number_of_cores_ - The number of cores of the CPU.
 
+*number_of_efficiency_cores* - keyword, number.long
+
+* _cpu_info.number_of_efficiency_cores_ - The number of efficiency cores of the CPU. Only available on Apple Silicon
+
+*number_of_performance_cores* - keyword, number.long
+
+* _cpu_info.number_of_performance_cores_ - The number of performance cores of the CPU. Only available on Apple Silicon
+
 *object_name* - keyword, text.text
 
 * _winbaseobj.object_name_ - Object Name
@@ -3751,6 +3844,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _processes.on_disk_ - The process path exists yes=1, no=0, unknown=-1
 
+*online* - keyword, number.long
+
+* _connected_displays.online_ - The online status of the display. This field is 1 if the display is online and 0 if it is offline.
+
 *online_cpus* - keyword, number.long
 
 * _docker_container_stats.online_cpus_ - Online CPUs
@@ -3880,6 +3977,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _tpm_info.owned_ - TPM is owned
 
+*owner* - keyword, text.text
+
+* _windows_search.owner_ - The owner of the item
+
 *owner_gid* - keyword, number.long
 
 * _process_events.owner_gid_ - File owner group ID
@@ -3948,6 +4049,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _process_events.parent_ - Process parent's PID, or -1 if cannot be determined.
 * _processes.parent_ - Process parent's PID
 
+*parent_process_sequence_number* - keyword, number.long
+
+* _process_etw_events.parent_process_sequence_number_ - Parent Process Sequence Number - Present only on ProcessStart events
+
 *parent_ref_number* - keyword, text.text
 
 * _ntfs_journal_events.parent_ref_number_ - The ordinal that associates a journal record with a filename's parent directory
@@ -4071,6 +4176,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _package_receipts.path_ - Path of receipt plist
 * _plist.path_ - (required) read preferences from a plist
 * _prefetch.path_ - Prefetch file path.
+* _process_etw_events.path_ - Path of executed binary
 * _process_events.path_ - Path of executed file
 * _process_file_events.path_ - The path associated with the event
 * _process_memory_map.path_ - Path to mapped file or mapped type
@@ -4098,6 +4204,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _user_ssh_keys.path_ - Path to key file
 * _userassist.path_ - Application file path.
 * _windows_crashes.path_ - Path of the executable file for the crashed process
+* _windows_search.path_ - The full path of the item.
 * _yara.path_ - The path scanned
 
 *pci_class* - keyword, text.text
@@ -4172,6 +4279,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *permissions* - keyword, text.text
 
 * _chrome_extensions.permissions_ - The permissions required by the extension
+* _kernel_keys.permissions_ - The key permissions, expressed as four hexadecimalbytes containing, from left to right, thepossessor, user, group, and other permissions.
 * _process_memory_map.permissions_ - r=read, w=write, x=execute, p=private (cow)
 * _shared_memory.permissions_ - Memory segment permissions
 * _suid_bin.permissions_ - Binary permissions
@@ -4227,6 +4335,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _osquery_info.pid_ - Process (or thread/handle) ID
 * _pipes.pid_ - Process ID of the process to which the pipe belongs
 * _process_envs.pid_ - Process (or thread) ID
+* _process_etw_events.pid_ - Process ID
 * _process_events.pid_ - Process (or thread) ID
 * _process_file_events.pid_ - Process ID
 * _process_memory_map.pid_ - Process (or thread) ID
@@ -4268,12 +4377,21 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _suid_bin.pid_with_namespace_ - Pids that contain a namespace
 * _user_ssh_keys.pid_with_namespace_ - Pids that contain a namespace
 * _users.pid_with_namespace_ - Pids that contain a namespace
+* _yara.pid_with_namespace_ - Pids that contain a namespace
 * _yum_sources.pid_with_namespace_ - Pids that contain a namespace
 
 *pids* - keyword, number.long
 
 * _docker_container_stats.pids_ - Number of processes
 
+*pixels* - keyword, text.text
+
+* _connected_displays.pixels_ - The number of pixels of the display.
+
+*pk_hash* - keyword, text.text
+
+* _keychain_items.pk_hash_ - Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2)
+
 *placement_group_id* - keyword, text.text
 
 * _azure_instance_metadata.placement_group_id_ - Placement group for the VM scale set
@@ -4359,6 +4477,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *ppid* - keyword, number.long
 
+* _process_etw_events.ppid_ - Parent Process ID
 * _process_file_events.ppid_ - Parent process ID
 
 *pre_cpu_kernelmode_usage* - keyword, number.long
@@ -4381,6 +4500,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _docker_container_stats.pre_system_cpu_usage_ - Last read CPU system usage
 
+*predicate* - keyword, text.text
+
+* _unified_log.predicate_ - predicate to search (see `log help predicates`), note that this is merged into the predicate created from the column constraints
+
 *prefix* - keyword, text.text
 
 * _homebrew_packages.prefix_ - Homebrew install prefix
@@ -4420,6 +4543,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _event_taps.process_being_tapped_ - The process ID of the target application
 
+*process_sequence_number* - keyword, number.long
+
+* _process_etw_events.process_sequence_number_ - Process Sequence Number - Present only on ProcessStart events
+
 *process_type* - keyword, text.text
 
 * _launchd.process_type_ - Key describes the intended purpose of the job
@@ -4444,6 +4571,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _cpu_info.processor_type_ - The processor type, such as Central, Math, or Video.
 
+*product_id* - keyword, text.text
+
+* _connected_displays.product_id_ - The product ID of the display.
+
 *product_name* - keyword, text.text
 
 * _tpm_info.product_name_ - Product name of the TPM
@@ -4487,6 +4618,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _docker_container_mounts.propagation_ - Mount propagation
 
+*properties* - keyword, text.text
+
+* _windows_search.properties_ - Additional property values JSON
+
 *protected* - keyword, number.long
 
 * _app_schemes.protected_ - 1 if this handler is protected (reserved) by macOS, else 0
@@ -4554,6 +4689,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _mdfind.query_ - The query that was run to find the file
 * _osquery_schedule.query_ - The exact query to run
+* _windows_search.query_ - Windows search query
 * _wmi_event_filters.query_ - Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.
 
 *query_language* - keyword, text.text
@@ -4761,6 +4897,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _docker_container_processes.resident_size_ - Bytes of private memory used by process
 * _processes.resident_size_ - Bytes of private memory used by process
 
+*resolution* - keyword, text.text
+
+* _connected_displays.resolution_ - The resolution of the display.
+
 *resource_group_name* - keyword, text.text
 
 * _azure_instance_metadata.resource_group_name_ - Resource group for the VM
@@ -4829,6 +4969,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _time_machine_destinations.root_volume_uuid_ - Root UUID of backup volume
 
+*rotation* - keyword, text.text
+
+* _connected_displays.rotation_ - The orientation of the display.
+
 *round_trip_time* - keyword, number.long
 
 * _curl.round_trip_time_ - Time taken to complete the request
@@ -4933,6 +5077,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _secureboot.secure_boot_ - Whether secure boot is enabled
 
+*secure_mode* - keyword, number.long
+
+* _secureboot.secure_mode_ - Secure mode for Intel-based macOS: 0 disabled, 1 full security, 2 medium security
+
 *secure_process* - keyword, number.long
 
 * _processes.secure_process_ - Process is secure (IUM) yes=1, no=0
@@ -4992,7 +5140,9 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _authenticode.serial_number_ - The certificate serial number
 * _battery.serial_number_ - The battery's unique serial number
+* _connected_displays.serial_number_ - The serial number of the display. (may not be unique)
 * _curl_certificate.serial_number_ - Certificate serial number
+* _kernel_keys.serial_number_ - The serial key of the key.
 * _memory_devices.serial_number_ - Serial number of memory device
 
 *serial_port_enabled* - keyword, text.text
@@ -5049,6 +5199,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 *session_id* - keyword, number.long
 
 * _logon_sessions.session_id_ - The Terminal Services session identifier.
+* _process_etw_events.session_id_ - Session ID
 * _winbaseobj.session_id_ - Terminal Services Session Id
 
 *session_owner* - keyword, text.text
@@ -5206,6 +5357,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _shared_memory.size_ - Size in bytes
 * _smbios_tables.size_ - Table entry size in bytes
 * _smc_keys.size_ - Reported size of data in bytes
+* _windows_search.size_ - The item size in bytes.
 
 *size_bytes* - keyword, number.long
 
@@ -5243,6 +5395,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _cpu_time.softirq_ - Time spent servicing softirqs
 
+*sort* - keyword, text.text
+
+* _windows_search.sort_ - Sort for windows api
+
 *source* - keyword, text.text
 
 * _apt_sources.source_ - Source file
@@ -5693,6 +5849,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _ntfs_journal_events.time_ - Time of file event
 * _package_install_history.time_ - Label date as UNIX timestamp
 * _powershell_events.time_ - Timestamp the event was received by the osquery event publisher
+* _process_etw_events.time_ - Event timestamp in Unix format
 * _process_events.time_ - Time of execution in UNIX time
 * _process_file_events.time_ - Time of execution in UNIX time
 * _seccomp_events.time_ - Time of execution in UNIX time
@@ -5714,10 +5871,15 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _windows_eventlog.time_range_ - System time to selectively filter the events
 
+*time_windows* - keyword, number.long
+
+* _process_etw_events.time_windows_ - Event timestamp in Windows format
+
 *timeout* - keyword, text.text
 
 * _authorizations.timeout_ - Label top-level key
 * _curl_certificate.timeout_ - Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)
+* _kernel_keys.timeout_ - The amount of time until the key will expire,expressed in human-readable form. The string perm heremeans that the key is permanent (no timeout).  Thestring expd means that the key has already expired.
 
 *timestamp* - keyword, text.text
 
@@ -5738,6 +5900,14 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _cups_jobs.title_ - Title of the printed job
 * _windows_update_history.title_ - Title of an update
 
+*token_elevation_status* - keyword, number.long
+
+* _process_etw_events.token_elevation_status_ - Primary token elevation status - Present only on ProcessStart events
+
+*token_elevation_type* - keyword, text.text
+
+* _process_etw_events.token_elevation_type_ - Primary token elevation type - Present only on ProcessStart events
+
 *total_seconds* - keyword, number.long
 
 * _uptime.total_seconds_ - Total uptime seconds
@@ -5803,6 +5973,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _hardware_events.type_ - Type of hardware and hardware event
 * _interface_addresses.type_ - Type of address. One of dhcp, manual, auto, other, unknown
 * _interface_details.type_ - Interface type (includes virtual)
+* _kernel_keys.type_ - The key type.
 * _keychain_items.type_ - Keychain item type (class)
 * _last.type_ - Entry type, according to ut_type types (utmp.h)
 * _logged_in_users.type_ - Login type
@@ -5815,6 +5986,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _osquery_events.type_ - Either publisher or subscriber
 * _osquery_extensions.type_ - SDK extension type: core, extension, or module
 * _osquery_flags.type_ - Flag type
+* _process_etw_events.type_ - Event Type (ProcessStart, ProcessStop)
 * _process_open_pipes.type_ - Pipe Type: named vs unnamed/anonymous
 * _registry.type_ - Type of the registry value, or 'subkey' if item is a subkey
 * _routes.type_ - Type of route
@@ -5828,6 +6000,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _user_events.type_ - The file description for the process socket
 * _users.type_ - Whether the account is roaming (domain), local, or a system profile
 * _windows_crashes.type_ - Type of crash log
+* _windows_search.type_ - The item type
 * _windows_security_products.type_ - Type of security product
 * _xprotect_meta.type_ - Either plugin or extension
 
@@ -5855,6 +6028,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _file.uid_ - Owning user ID
 * _file_events.uid_ - Owning user ID
 * _firefox_addons.uid_ - The local user that owns the addon
+* _kernel_keys.uid_ - The user ID of the key owner.
 * _known_hosts.uid_ - The local user that owns the known_hosts file
 * _launchd_overrides.uid_ - User ID applied to the override, 0 applies to all
 * _package_bom.uid_ - Expected user of file or directory
@@ -5891,6 +6065,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 * _ibridge_info.unique_chip_id_ - Unique id of the iBridge controller
 
+*unit_file_state* - keyword, text.text
+
+* _systemd_units.unit_file_state_ - Whether the unit file is enabled, e.g. `enabled`, `masked`, `disabled`, etc
+
 *unix_time* - keyword, number.long
 
 * _time.unix_time_ - Current UNIX time in UTC
@@ -5964,6 +6142,10 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _curl.url_ - The url for the request
 * _lxd_cluster_members.url_ - URL of the node
 
+*usage* - keyword, number.long
+
+* _kernel_keys.usage_ - the number of threads and open file references thatrefer to this key.
+
 *usb_address* - keyword, number.long
 
 * _usb_devices.usb_address_ - USB Device used address
@@ -6030,6 +6212,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 * _launchd.username_ - Run this daemon or agent as this username
 * _managed_policies.username_ - Policy applies only this user
 * _preferences.username_ - (optional) read preferences for a specific user
+* _process_etw_events.username_ - User rights - primary token username
 * _rpm_package_files.username_ - File default username from info DB
 * _shadow.username_ - Username
 * _startup_items.username_ - The user associated with the startup item
@@ -6119,6 +6302,7 @@ For more information about osquery tables, see the https://osquery.io/schema[osq
 
 *vendor_id* - keyword, text.text
 
+* _connected_displays.vendor_id_ - The vendor ID of the display.
 * _hardware_events.vendor_id_ - Hex encoded Hardware vendor identifier
 * _pci_devices.vendor_id_ - Hex encoded PCI Device vendor identifier
 * _usb_devices.vendor_id_ - Hex encoded USB Device vendor identifier
diff --git a/docs/user/dashboard/images/dashboard_links_panel.png b/docs/user/dashboard/images/dashboard_links_panel.png
new file mode 100644
index 00000000000000..f6334f4df29f48
Binary files /dev/null and b/docs/user/dashboard/images/dashboard_links_panel.png differ
diff --git a/docs/user/dashboard/make-dashboards-interactive.asciidoc b/docs/user/dashboard/make-dashboards-interactive.asciidoc
index 7df824b39af17c..e9833d3a542d54 100644
--- a/docs/user/dashboard/make-dashboards-interactive.asciidoc
+++ b/docs/user/dashboard/make-dashboards-interactive.asciidoc
@@ -218,6 +218,9 @@ preview::["This functionality is in technical preview, and may be changed or rem
 
 You can use *Links* panels to create links to other dashboards or external websites. When creating links to other dashboards, you have the option to carry the time range and query and filters to apply to the linked dashboard. Links to external websites follow the <<external-URL-policy,`externalUrl.policy`>> settings. *Links* panels support vertical and horizontal layouts and may be saved to the *Library* for use on other dashboards.
 
+[role="screenshot"]
+image::images/dashboard_links_panel.png[A screenshot displaying the new links panel]
+
 * <<add-links-panel, Add a links panel>>
 * <<add-links-panel-from-library, Add a links panel from the library>>
 * <<edit-links-panel, Edit links panels>>
diff --git a/examples/bfetch_explorer/server/index.ts b/examples/bfetch_explorer/server/index.ts
index 4dd6223251dc32..6f80829362d6b9 100644
--- a/examples/bfetch_explorer/server/index.ts
+++ b/examples/bfetch_explorer/server/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { BfetchExplorerPlugin } from './plugin';
-
-export const plugin = () => new BfetchExplorerPlugin();
+export const plugin = async () => {
+  const { BfetchExplorerPlugin } = await import('./plugin');
+  return new BfetchExplorerPlugin();
+};
diff --git a/examples/content_management_examples/server/index.ts b/examples/content_management_examples/server/index.ts
index d75af7bacf2242..069a36852fca74 100644
--- a/examples/content_management_examples/server/index.ts
+++ b/examples/content_management_examples/server/index.ts
@@ -7,8 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ContentManagementExamplesPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ContentManagementExamplesPlugin } = await import('./plugin');
   return new ContentManagementExamplesPlugin(initializerContext);
 }
diff --git a/examples/discover_customization_examples/public/plugin.tsx b/examples/discover_customization_examples/public/plugin.tsx
index ca356612d0f8a8..5eefb4932cc43e 100644
--- a/examples/discover_customization_examples/public/plugin.tsx
+++ b/examples/discover_customization_examples/public/plugin.tsx
@@ -163,6 +163,17 @@ export class DiscoverCustomizationExamplesPlugin implements Plugin {
               order: 300,
             },
           ],
+          getBadges: () => {
+            return [
+              {
+                data: {
+                  badgeText: 'Example badge',
+                  color: 'warning',
+                },
+                order: 10,
+              },
+            ];
+          },
         });
 
         customizations.set({
diff --git a/examples/embeddable_examples/server/index.ts b/examples/embeddable_examples/server/index.ts
index 0139633a71d69e..cb0e20e34042e2 100644
--- a/examples/embeddable_examples/server/index.ts
+++ b/examples/embeddable_examples/server/index.ts
@@ -8,6 +8,7 @@
 
 import { PluginInitializer } from '@kbn/core/server';
 
-import { EmbeddableExamplesPlugin } from './plugin';
-
-export const plugin: PluginInitializer<void, void> = () => new EmbeddableExamplesPlugin();
+export const plugin: PluginInitializer<void, void> = async () => {
+  const { EmbeddableExamplesPlugin } = await import('./plugin');
+  return new EmbeddableExamplesPlugin();
+};
diff --git a/examples/feature_control_examples/server/index.ts b/examples/feature_control_examples/server/index.ts
index 0db874ff2047e7..20cf4e280ca458 100644
--- a/examples/feature_control_examples/server/index.ts
+++ b/examples/feature_control_examples/server/index.ts
@@ -6,6 +6,8 @@
  * Side Public License, v 1.
  */
 import { PluginInitializer } from '@kbn/core/server';
-import { FeatureControlsPluginExample } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () => new FeatureControlsPluginExample();
+export const plugin: PluginInitializer<void, void> = async () => {
+  const { FeatureControlsPluginExample } = await import('./plugin');
+  return new FeatureControlsPluginExample();
+};
diff --git a/examples/field_formats_example/server/index.ts b/examples/field_formats_example/server/index.ts
index cd8ee4c30b63ae..63537dc1393feb 100644
--- a/examples/field_formats_example/server/index.ts
+++ b/examples/field_formats_example/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { FieldFormatsExamplePlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { FieldFormatsExamplePlugin } = await import('./plugin');
   return new FieldFormatsExamplePlugin();
 }
diff --git a/examples/files_example/server/index.ts b/examples/files_example/server/index.ts
index d7edefbe1876df..0ca8a663aa7f5c 100644
--- a/examples/files_example/server/index.ts
+++ b/examples/files_example/server/index.ts
@@ -7,11 +7,11 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { FilesExamplePlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { FilesExamplePlugin } = await import('./plugin');
   return new FilesExamplePlugin(initializerContext);
 }
diff --git a/examples/guided_onboarding_example/server/index.ts b/examples/guided_onboarding_example/server/index.ts
index dbcdfe70c67eed..a70d488d292363 100644
--- a/examples/guided_onboarding_example/server/index.ts
+++ b/examples/guided_onboarding_example/server/index.ts
@@ -7,6 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { GuidedOnboardingExamplePlugin } from './plugin';
 
-export const plugin = (ctx: PluginInitializerContext) => new GuidedOnboardingExamplePlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { GuidedOnboardingExamplePlugin } = await import('./plugin');
+  return new GuidedOnboardingExamplePlugin(ctx);
+};
diff --git a/examples/preboot_example/server/index.ts b/examples/preboot_example/server/index.ts
index cc231e0c873ede..b5442168f99ab2 100644
--- a/examples/preboot_example/server/index.ts
+++ b/examples/preboot_example/server/index.ts
@@ -10,11 +10,13 @@ import type { TypeOf } from '@kbn/config-schema';
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { ConfigSchema } from './config';
-import { PrebootExamplePlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
   schema: ConfigSchema,
   exposeToBrowser: { token: true },
 };
 
-export const plugin = (context: PluginInitializerContext) => new PrebootExamplePlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { PrebootExamplePlugin } = await import('./plugin');
+  return new PrebootExamplePlugin(context);
+};
diff --git a/examples/response_stream/server/index.ts b/examples/response_stream/server/index.ts
index 2d1bb6229fce4f..9f6fd17f56ae1d 100644
--- a/examples/response_stream/server/index.ts
+++ b/examples/response_stream/server/index.ts
@@ -8,8 +8,7 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { ResponseStreamPlugin } from './plugin';
-
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ResponseStreamPlugin } = await import('./plugin');
   return new ResponseStreamPlugin(initializerContext);
 }
diff --git a/examples/routing_example/server/index.ts b/examples/routing_example/server/index.ts
index 1fc65c6da13143..fd5a8f2680c0d3 100644
--- a/examples/routing_example/server/index.ts
+++ b/examples/routing_example/server/index.ts
@@ -8,6 +8,7 @@
 
 import { PluginInitializer } from '@kbn/core/server';
 
-import { RoutingExamplePlugin } from './plugin';
-
-export const plugin: PluginInitializer<{}, {}> = () => new RoutingExamplePlugin();
+export const plugin: PluginInitializer<{}, {}> = async () => {
+  const { RoutingExamplePlugin } = await import('./plugin');
+  return new RoutingExamplePlugin();
+};
diff --git a/examples/screenshot_mode_example/server/index.ts b/examples/screenshot_mode_example/server/index.ts
index 3237dbabff9374..e383939cf7281f 100644
--- a/examples/screenshot_mode_example/server/index.ts
+++ b/examples/screenshot_mode_example/server/index.ts
@@ -7,6 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ScreenshotModeExamplePlugin } from './plugin';
 
-export const plugin = (ctx: PluginInitializerContext) => new ScreenshotModeExamplePlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { ScreenshotModeExamplePlugin } = await import('./plugin');
+  return new ScreenshotModeExamplePlugin(ctx);
+};
diff --git a/examples/search_examples/public/application.tsx b/examples/search_examples/public/application.tsx
index d87c0843ed172e..c6c0eb053526a2 100644
--- a/examples/search_examples/public/application.tsx
+++ b/examples/search_examples/public/application.tsx
@@ -12,7 +12,7 @@ import { Redirect } from 'react-router-dom';
 import { Router, Routes, Route } from '@kbn/shared-ux-router';
 import { I18nProvider } from '@kbn/i18n-react';
 import { AppMountParameters, CoreStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { AppPluginStartDependencies } from './types';
 import { SearchExamplePage, ExampleLink } from './common/example_page';
 import { SearchExamplesApp } from './search/app';
@@ -45,7 +45,11 @@ export const renderApp = (
 ) => {
   ReactDOM.render(
     <I18nProvider>
-      <RedirectAppLinks application={application}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
         <SearchExamplePage exampleLinks={LINKS} basePath={http.basePath}>
           <Router history={history}>
             <Routes>
diff --git a/examples/search_examples/server/index.ts b/examples/search_examples/server/index.ts
index 1b1f69bcb32aa7..211bdb658b590b 100644
--- a/examples/search_examples/server/index.ts
+++ b/examples/search_examples/server/index.ts
@@ -7,9 +7,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SearchExamplesPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { SearchExamplesPlugin } = await import('./plugin');
   return new SearchExamplesPlugin(initializerContext);
 }
 
diff --git a/examples/search_examples/tsconfig.json b/examples/search_examples/tsconfig.json
index ad775e0ac219c5..e4d18b3443263f 100644
--- a/examples/search_examples/tsconfig.json
+++ b/examples/search_examples/tsconfig.json
@@ -33,5 +33,6 @@
     "@kbn/config-schema",
     "@kbn/shared-ux-router",
     "@kbn/search-response-warnings",
+    "@kbn/shared-ux-link-redirect-app",
   ]
 }
diff --git a/examples/user_profile_examples/server/index.ts b/examples/user_profile_examples/server/index.ts
index 7b5e8eb32a645e..6929bd5c6bb0eb 100755
--- a/examples/user_profile_examples/server/index.ts
+++ b/examples/user_profile_examples/server/index.ts
@@ -5,6 +5,8 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-import { UserProfilesPlugin } from './plugin';
 
-export const plugin = () => new UserProfilesPlugin();
+export const plugin = async () => {
+  const { UserProfilesPlugin } = await import('./plugin');
+  return new UserProfilesPlugin();
+};
diff --git a/examples/v8_profiler_examples/server/index.ts b/examples/v8_profiler_examples/server/index.ts
index d06809f7411b51..f917a93ebd5f18 100644
--- a/examples/v8_profiler_examples/server/index.ts
+++ b/examples/v8_profiler_examples/server/index.ts
@@ -7,8 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { V8ProfilerExamplesPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { V8ProfilerExamplesPlugin } = await import('./plugin');
   return new V8ProfilerExamplesPlugin(initializerContext);
 }
diff --git a/package.json b/package.json
index ea5085d12af6d2..a95e1b1e81e9cc 100644
--- a/package.json
+++ b/package.json
@@ -147,6 +147,7 @@
     "@kbn/alerts-ui-shared": "link:packages/kbn-alerts-ui-shared",
     "@kbn/analytics": "link:packages/kbn-analytics",
     "@kbn/analytics-client": "link:packages/analytics/client",
+    "@kbn/analytics-collection-utils": "link:packages/analytics/utils/analytics_collection_utils",
     "@kbn/analytics-ftr-helpers-plugin": "link:test/analytics/plugins/analytics_ftr_helpers",
     "@kbn/analytics-plugin-a-plugin": "link:test/analytics/plugins/analytics_plugin_a",
     "@kbn/analytics-shippers-elastic-v3-browser": "link:packages/analytics/shippers/elastic_v3/browser",
@@ -364,6 +365,7 @@
     "@kbn/data-view-management-plugin": "link:src/plugins/data_view_management",
     "@kbn/data-views-plugin": "link:src/plugins/data_views",
     "@kbn/data-visualizer-plugin": "link:x-pack/plugins/data_visualizer",
+    "@kbn/dataset-quality-plugin": "link:x-pack/plugins/dataset_quality",
     "@kbn/datemath": "link:packages/kbn-datemath",
     "@kbn/deeplinks-analytics": "link:packages/deeplinks/analytics",
     "@kbn/deeplinks-devtools": "link:packages/deeplinks/devtools",
@@ -448,7 +450,6 @@
     "@kbn/gen-ai-streaming-response-example-plugin": "link:x-pack/examples/gen_ai_streaming_response_example",
     "@kbn/generate-console-definitions": "link:packages/kbn-generate-console-definitions",
     "@kbn/generate-csv": "link:packages/kbn-generate-csv",
-    "@kbn/generate-csv-types": "link:packages/kbn-generate-csv-types",
     "@kbn/global-search-bar-plugin": "link:x-pack/plugins/global_search_bar",
     "@kbn/global-search-plugin": "link:x-pack/plugins/global_search",
     "@kbn/global-search-providers-plugin": "link:x-pack/plugins/global_search_providers",
@@ -595,7 +596,16 @@
     "@kbn/repo-packages": "link:packages/kbn-repo-packages",
     "@kbn/reporting-common": "link:packages/kbn-reporting/common",
     "@kbn/reporting-example-plugin": "link:x-pack/examples/reporting_example",
+    "@kbn/reporting-export-types-csv": "link:packages/kbn-reporting/export_types/csv",
+    "@kbn/reporting-export-types-csv-common": "link:packages/kbn-reporting/export_types/csv_common",
+    "@kbn/reporting-export-types-pdf": "link:packages/kbn-reporting/export_types/pdf",
+    "@kbn/reporting-export-types-pdf-common": "link:packages/kbn-reporting/export_types/pdf_common",
+    "@kbn/reporting-export-types-png": "link:packages/kbn-reporting/export_types/png",
+    "@kbn/reporting-export-types-png-common": "link:packages/kbn-reporting/export_types/png_common",
+    "@kbn/reporting-mocks-server": "link:packages/kbn-reporting/mocks_server",
     "@kbn/reporting-plugin": "link:x-pack/plugins/reporting",
+    "@kbn/reporting-public": "link:packages/kbn-reporting/public",
+    "@kbn/reporting-server": "link:packages/kbn-reporting/server",
     "@kbn/resizable-layout": "link:packages/kbn-resizable-layout",
     "@kbn/resizable-layout-examples-plugin": "link:examples/resizable_layout_examples",
     "@kbn/resolver-test-plugin": "link:x-pack/test/plugin_functional/plugins/resolver_test",
@@ -779,6 +789,7 @@
     "@kbn/unified-field-list-examples-plugin": "link:examples/unified_field_list_examples",
     "@kbn/unified-histogram-plugin": "link:src/plugins/unified_histogram",
     "@kbn/unified-search-plugin": "link:src/plugins/unified_search",
+    "@kbn/unsaved-changes-badge": "link:packages/kbn-unsaved-changes-badge",
     "@kbn/upgrade-assistant-plugin": "link:x-pack/plugins/upgrade_assistant",
     "@kbn/uptime-plugin": "link:x-pack/plugins/uptime",
     "@kbn/url-drilldown-plugin": "link:x-pack/plugins/drilldowns/url_drilldown",
@@ -1442,7 +1453,7 @@
     "apidoc-markdown": "^7.2.4",
     "argsplit": "^1.0.5",
     "autoprefixer": "^10.4.7",
-    "axe-core": "^4.6.1",
+    "axe-core": "^4.8.2",
     "babel-jest": "^29.6.1",
     "babel-loader": "^8.2.5",
     "babel-plugin-add-module-exports": "^1.0.4",
diff --git a/packages/analytics/utils/analytics_collection_utils/README.md b/packages/analytics/utils/analytics_collection_utils/README.md
new file mode 100644
index 00000000000000..fd01a04f534b75
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/README.md
@@ -0,0 +1,3 @@
+# @kbn/analytics-collection-utils
+
+Empty package generated by @kbn/generate
diff --git a/src/plugins/kibana_react/public/app_links/index.ts b/packages/analytics/utils/analytics_collection_utils/index.ts
similarity index 71%
rename from src/plugins/kibana_react/public/app_links/index.ts
rename to packages/analytics/utils/analytics_collection_utils/index.ts
index 3bfd7baca0c024..4ead4333b67cca 100644
--- a/src/plugins/kibana_react/public/app_links/index.ts
+++ b/packages/analytics/utils/analytics_collection_utils/index.ts
@@ -5,5 +5,5 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-/** @deprecated Use `RedirectAppLinks` from `@kbn/shared-ux-link-redirect-app` */
-export { RedirectAppLinks } from './redirect_app_link';
+
+export { isSyntheticsMonitor } from './src';
diff --git a/packages/analytics/utils/analytics_collection_utils/jest.config.js b/packages/analytics/utils/analytics_collection_utils/jest.config.js
new file mode 100644
index 00000000000000..93724717599fa8
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/analytics/utils/analytics_collection_utils'],
+};
diff --git a/packages/analytics/utils/analytics_collection_utils/kibana.jsonc b/packages/analytics/utils/analytics_collection_utils/kibana.jsonc
new file mode 100644
index 00000000000000..f909070bbe36f6
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/analytics-collection-utils",
+  "owner": "@elastic/kibana-core"
+}
diff --git a/packages/analytics/utils/analytics_collection_utils/package.json b/packages/analytics/utils/analytics_collection_utils/package.json
new file mode 100644
index 00000000000000..eb10b67ce94dd6
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/analytics-collection-utils",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/packages/analytics/utils/analytics_collection_utils/src/index.ts b/packages/analytics/utils/analytics_collection_utils/src/index.ts
new file mode 100644
index 00000000000000..48d4cd08c568d3
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/src/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { isSyntheticsMonitor } from './is_synthetics_monitor';
diff --git a/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.test.ts b/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.test.ts
new file mode 100644
index 00000000000000..02da2a7e416067
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.test.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { isSyntheticsMonitor } from './is_synthetics_monitor';
+
+describe('isSyntheticsMonitor', () => {
+  test('returns false for any user agent', () => {
+    expect(isSyntheticsMonitor()).toBe(false);
+  });
+
+  test('returns true for when the user agent contains "Elastic/Synthetics"', () => {
+    jest
+      .spyOn(window.navigator, 'userAgent', 'get')
+      .mockReturnValue(window.navigator.userAgent + 'Elastic/Synthetics');
+    expect(isSyntheticsMonitor()).toBe(true);
+  });
+});
diff --git a/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.ts b/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.ts
new file mode 100644
index 00000000000000..093a984f32d5da
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/src/is_synthetics_monitor.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/**
+ * Returns whether the current navigation is performed by a Synthetics monitor
+ * (and hence, telemetry should not be collected).
+ */
+export function isSyntheticsMonitor(): boolean {
+  return window.navigator.userAgent.includes('Elastic/Synthetics');
+}
diff --git a/packages/analytics/utils/analytics_collection_utils/tsconfig.json b/packages/analytics/utils/analytics_collection_utils/tsconfig.json
new file mode 100644
index 00000000000000..b05325b824a672
--- /dev/null
+++ b/packages/analytics/utils/analytics_collection_utils/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": []
+}
diff --git a/packages/core/application/core-application-browser-internal/src/application_service.tsx b/packages/core/application/core-application-browser-internal/src/application_service.tsx
index d54b71b91f119f..8e5f2643929e7a 100644
--- a/packages/core/application/core-application-browser-internal/src/application_service.tsx
+++ b/packages/core/application/core-application-browser-internal/src/application_service.tsx
@@ -13,7 +13,7 @@ import { createBrowserHistory, History } from 'history';
 
 import type { PluginOpaqueId } from '@kbn/core-base-common';
 import type { ThemeServiceStart } from '@kbn/core-theme-browser';
-import type { HttpSetup, HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpSetup, InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { Capabilities } from '@kbn/core-capabilities-common';
 import type { MountPoint } from '@kbn/core-mount-utils-browser';
 import type { OverlayStart } from '@kbn/core-overlays-browser';
@@ -46,7 +46,7 @@ import {
 import { registerAnalyticsContextProvider } from './register_analytics_context_provider';
 
 export interface SetupDeps {
-  http: HttpSetup;
+  http: InternalHttpSetup;
   analytics: AnalyticsServiceSetup;
   history?: History<any>;
   /** Used to redirect to external urls */
@@ -54,7 +54,7 @@ export interface SetupDeps {
 }
 
 export interface StartDeps {
-  http: HttpStart;
+  http: InternalHttpStart;
   analytics: AnalyticsServiceStart;
   theme: ThemeServiceStart;
   overlays: OverlayStart;
diff --git a/packages/core/application/core-application-browser-internal/src/utils/parse_app_url.test.ts b/packages/core/application/core-application-browser-internal/src/utils/parse_app_url.test.ts
index 7bc5752a72b133..0126acd36e4536 100644
--- a/packages/core/application/core-application-browser-internal/src/utils/parse_app_url.test.ts
+++ b/packages/core/application/core-application-browser-internal/src/utils/parse_app_url.test.ts
@@ -30,7 +30,7 @@ describe('parseAppUrl', () => {
 
   beforeEach(() => {
     apps = new Map();
-    basePath = new BasePath('/base-path');
+    basePath = new BasePath({ basePath: '/base-path' });
 
     createApp({
       id: 'foo',
diff --git a/packages/core/apps/core-apps-browser-internal/src/core_app.ts b/packages/core/apps/core-apps-browser-internal/src/core_app.ts
index e8a61de40bea2e..c6a8583a149306 100644
--- a/packages/core/apps/core-apps-browser-internal/src/core_app.ts
+++ b/packages/core/apps/core-apps-browser-internal/src/core_app.ts
@@ -10,7 +10,7 @@ import type { UnregisterCallback } from 'history';
 import type { CoreContext } from '@kbn/core-base-browser-internal';
 import type { InternalInjectedMetadataSetup } from '@kbn/core-injected-metadata-browser-internal';
 import type { DocLinksStart } from '@kbn/core-doc-links-browser';
-import type { HttpSetup, HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpSetup, InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { IUiSettingsClient } from '@kbn/core-ui-settings-browser';
 import type { NotificationsSetup, NotificationsStart } from '@kbn/core-notifications-browser';
 import { AppNavLinkStatus, type AppMountParameters } from '@kbn/core-application-browser';
@@ -27,7 +27,7 @@ import { renderApp as renderStatusApp } from './status';
 
 export interface CoreAppsServiceSetupDeps {
   application: InternalApplicationSetup;
-  http: HttpSetup;
+  http: InternalHttpSetup;
   injectedMetadata: InternalInjectedMetadataSetup;
   notifications: NotificationsSetup;
 }
@@ -35,7 +35,7 @@ export interface CoreAppsServiceSetupDeps {
 export interface CoreAppsServiceStartDeps {
   application: InternalApplicationStart;
   docLinks: DocLinksStart;
-  http: HttpStart;
+  http: InternalHttpStart;
   notifications: NotificationsStart;
   uiSettings: IUiSettingsClient;
 }
diff --git a/packages/core/apps/core-apps-browser-internal/src/errors/error_application.test.ts b/packages/core/apps/core-apps-browser-internal/src/errors/error_application.test.ts
index 5ca92bc3904f41..65f7a437631b14 100644
--- a/packages/core/apps/core-apps-browser-internal/src/errors/error_application.test.ts
+++ b/packages/core/apps/core-apps-browser-internal/src/errors/error_application.test.ts
@@ -22,7 +22,7 @@ describe('renderApp', () => {
   let unmount: () => void;
 
   beforeEach(() => {
-    basePath = new BasePath();
+    basePath = new BasePath({ basePath: '' });
     element = document.createElement('div');
     history = createMemoryHistory();
     unmount = renderApp(
diff --git a/packages/core/apps/core-apps-browser-internal/src/errors/public_base_url.tsx b/packages/core/apps/core-apps-browser-internal/src/errors/public_base_url.tsx
index 0d2e678963d8b7..f125d032398021 100644
--- a/packages/core/apps/core-apps-browser-internal/src/errors/public_base_url.tsx
+++ b/packages/core/apps/core-apps-browser-internal/src/errors/public_base_url.tsx
@@ -12,7 +12,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 
 import type { DocLinksStart } from '@kbn/core-doc-links-browser';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { NotificationsStart } from '@kbn/core-notifications-browser';
 import { mountReactNode } from '@kbn/core-mount-utils-browser-internal';
 
@@ -21,7 +21,7 @@ export const MISSING_CONFIG_STORAGE_KEY = `core.warnings.publicBaseUrlMissingDis
 
 interface Deps {
   docLinks: DocLinksStart;
-  http: HttpStart;
+  http: InternalHttpStart;
   notifications: NotificationsStart;
   // Exposed for easier testing
   storage?: Storage;
diff --git a/packages/core/apps/core-apps-browser-internal/src/errors/url_overflow.test.ts b/packages/core/apps/core-apps-browser-internal/src/errors/url_overflow.test.ts
index bdf8bdf0abc6a9..dae718c75afceb 100644
--- a/packages/core/apps/core-apps-browser-internal/src/errors/url_overflow.test.ts
+++ b/packages/core/apps/core-apps-browser-internal/src/errors/url_overflow.test.ts
@@ -27,7 +27,7 @@ describe('url overflow detection', () => {
   let unlisten: any;
 
   beforeEach(() => {
-    basePath = new BasePath('/test-123');
+    basePath = new BasePath({ basePath: '/test-123' });
     history = createMemoryHistory();
     toasts = notificationServiceMock.createStartContract().toasts;
     uiSettings = uiSettingsServiceMock.createStartContract();
diff --git a/packages/core/apps/core-apps-browser-internal/src/status/lib/load_status.ts b/packages/core/apps/core-apps-browser-internal/src/status/lib/load_status.ts
index 6672786c72a10a..7338db04716c0a 100644
--- a/packages/core/apps/core-apps-browser-internal/src/status/lib/load_status.ts
+++ b/packages/core/apps/core-apps-browser-internal/src/status/lib/load_status.ts
@@ -189,7 +189,7 @@ export async function loadStatus({
   http,
   notifications,
 }: {
-  http: HttpSetup;
+  http: Pick<HttpSetup, 'get'>;
   notifications: NotificationsSetup;
 }) {
   let response: StatusResponse;
diff --git a/packages/core/apps/core-apps-browser-internal/src/status/render_app.tsx b/packages/core/apps/core-apps-browser-internal/src/status/render_app.tsx
index 4578ff0f347d67..a2af773a239ad2 100644
--- a/packages/core/apps/core-apps-browser-internal/src/status/render_app.tsx
+++ b/packages/core/apps/core-apps-browser-internal/src/status/render_app.tsx
@@ -10,13 +10,13 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import { I18nProvider } from '@kbn/i18n-react';
 import { CoreThemeProvider } from '@kbn/core-theme-browser-internal';
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 import type { NotificationsSetup } from '@kbn/core-notifications-browser';
 import type { AppMountParameters } from '@kbn/core-application-browser';
 import { StatusApp } from './status_app';
 
 interface Deps {
-  http: HttpSetup;
+  http: InternalHttpSetup;
   notifications: NotificationsSetup;
 }
 
diff --git a/packages/core/apps/core-apps-browser-internal/src/status/status_app.tsx b/packages/core/apps/core-apps-browser-internal/src/status/status_app.tsx
index 43e388ad170a88..88ae96bd335965 100644
--- a/packages/core/apps/core-apps-browser-internal/src/status/status_app.tsx
+++ b/packages/core/apps/core-apps-browser-internal/src/status/status_app.tsx
@@ -10,13 +10,13 @@ import React, { Component } from 'react';
 import { EuiLoadingSpinner, EuiText, EuiPage, EuiPageBody, EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 import type { NotificationsSetup } from '@kbn/core-notifications-browser';
 import { loadStatus, type ProcessedServerResponse } from './lib';
 import { MetricTiles, ServerStatus, StatusSection, VersionHeader } from './components';
 
 interface StatusAppProps {
-  http: HttpSetup;
+  http: InternalHttpSetup;
   notifications: NotificationsSetup;
 }
 
diff --git a/packages/core/capabilities/core-capabilities-browser-internal/src/capabilities_service.tsx b/packages/core/capabilities/core-capabilities-browser-internal/src/capabilities_service.tsx
index 746911117e5abc..0751225af53111 100644
--- a/packages/core/capabilities/core-capabilities-browser-internal/src/capabilities_service.tsx
+++ b/packages/core/capabilities/core-capabilities-browser-internal/src/capabilities_service.tsx
@@ -8,12 +8,12 @@
 
 import type { RecursiveReadonly } from '@kbn/utility-types';
 import { deepFreeze } from '@kbn/std';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { Capabilities } from '@kbn/core-capabilities-common';
 
 interface StartDeps {
   appIds: string[];
-  http: HttpStart;
+  http: InternalHttpStart;
 }
 
 /** @internal */
diff --git a/packages/core/capabilities/core-capabilities-browser-internal/tsconfig.json b/packages/core/capabilities/core-capabilities-browser-internal/tsconfig.json
index 258f96a51d15b9..ca9379c024865f 100644
--- a/packages/core/capabilities/core-capabilities-browser-internal/tsconfig.json
+++ b/packages/core/capabilities/core-capabilities-browser-internal/tsconfig.json
@@ -14,9 +14,9 @@
   "kbn_references": [
     "@kbn/utility-types",
     "@kbn/std",
-    "@kbn/core-http-browser",
     "@kbn/core-http-browser-mocks",
-    "@kbn/core-capabilities-common"
+    "@kbn/core-capabilities-common",
+    "@kbn/core-http-browser-internal"
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx b/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
index eaa30238cde895..e7f1ecbd29acc5 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
@@ -16,7 +16,7 @@ import useObservable from 'react-use/lib/useObservable';
 import type { InternalInjectedMetadataStart } from '@kbn/core-injected-metadata-browser-internal';
 import type { AnalyticsServiceSetup } from '@kbn/core-analytics-browser';
 import { type DocLinksStart } from '@kbn/core-doc-links-browser';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import { mountReactNode } from '@kbn/core-mount-utils-browser-internal';
 import type { NotificationsStart } from '@kbn/core-notifications-browser';
 import type { InternalApplicationStart } from '@kbn/core-application-browser-internal';
@@ -63,7 +63,7 @@ export interface SetupDeps {
 export interface StartDeps {
   application: InternalApplicationStart;
   docLinks: DocLinksStart;
-  http: HttpStart;
+  http: InternalHttpStart;
   injectedMetadata: InternalInjectedMetadataStart;
   notifications: NotificationsStart;
   customBranding: CustomBrandingStart;
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/nav_links/nav_links_service.ts b/packages/core/chrome/core-chrome-browser-internal/src/nav_links/nav_links_service.ts
index e55e8cd0307a9e..08466a1f35fb05 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/nav_links/nav_links_service.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/nav_links/nav_links_service.ts
@@ -9,7 +9,8 @@
 import { sortBy } from 'lodash';
 import { BehaviorSubject, ReplaySubject } from 'rxjs';
 import { map, takeUntil } from 'rxjs/operators';
-import type { HttpStart, IBasePath } from '@kbn/core-http-browser';
+import type { IBasePath } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { PublicAppDeepLinkInfo, PublicAppInfo } from '@kbn/core-application-browser';
 import type { InternalApplicationStart } from '@kbn/core-application-browser-internal';
 import type { ChromeNavLinks } from '@kbn/core-chrome-browser';
@@ -18,7 +19,7 @@ import { toNavLink } from './to_nav_link';
 
 interface StartDeps {
   application: InternalApplicationStart;
-  http: HttpStart;
+  http: InternalHttpStart;
 }
 
 export class NavLinksService {
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
index 38766a026cdccf..7a8f5b89db6533 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/project_navigation/project_navigation_service.ts
@@ -16,7 +16,7 @@ import {
   ChromeSetProjectBreadcrumbsParams,
   ChromeProjectNavigationNode,
 } from '@kbn/core-chrome-browser';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import {
   BehaviorSubject,
   Observable,
@@ -37,7 +37,7 @@ import { buildBreadcrumbs } from './breadcrumbs';
 interface StartDeps {
   application: InternalApplicationStart;
   navLinks: ChromeNavLinks;
-  http: HttpStart;
+  http: InternalHttpStart;
   chromeBreadcrumbs$: Observable<ChromeBreadcrumb[]>;
 }
 
@@ -59,7 +59,7 @@ export class ProjectNavigationService {
   }>({ breadcrumbs: [], params: { absolute: false } });
   private readonly stop$ = new ReplaySubject<void>(1);
   private application?: InternalApplicationStart;
-  private http?: HttpStart;
+  private http?: InternalHttpStart;
   private unlistenHistory?: () => void;
 
   public start({ application, navLinks, http, chromeBreadcrumbs$ }: StartDeps) {
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/recently_accessed/recently_accessed_service.ts b/packages/core/chrome/core-chrome-browser-internal/src/recently_accessed/recently_accessed_service.ts
index 414f0c796d1bd1..ec9a04ab5551ca 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/recently_accessed/recently_accessed_service.ts
+++ b/packages/core/chrome/core-chrome-browser-internal/src/recently_accessed/recently_accessed_service.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type {
   ChromeRecentlyAccessed,
   ChromeRecentlyAccessedHistoryItem,
@@ -15,7 +15,7 @@ import { PersistedLog } from './persisted_log';
 import { createLogKey } from './create_log_key';
 
 interface StartDeps {
-  http: HttpSetup;
+  http: InternalHttpStart;
 }
 
 /** @internal */
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/header/__snapshots__/collapsible_nav.test.tsx.snap b/packages/core/chrome/core-chrome-browser-internal/src/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
index c5c82c88c8521e..416ce39bbf9baf 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/header/__snapshots__/collapsible_nav.test.tsx.snap
@@ -733,6 +733,7 @@ exports[`CollapsibleNav renders the default nav 1`] = `
   }
   basePath={
     BasePath {
+      "assetsHrefBase": "/test",
       "basePath": "/test",
       "get": [Function],
       "prepend": [Function],
@@ -918,6 +919,7 @@ exports[`CollapsibleNav renders the default nav 2`] = `
   }
   basePath={
     BasePath {
+      "assetsHrefBase": "/test",
       "basePath": "/test",
       "get": [Function],
       "prepend": [Function],
diff --git a/packages/core/chrome/core-chrome-browser-internal/tsconfig.json b/packages/core/chrome/core-chrome-browser-internal/tsconfig.json
index 020324c1f67bc4..ed460a1965667d 100644
--- a/packages/core/chrome/core-chrome-browser-internal/tsconfig.json
+++ b/packages/core/chrome/core-chrome-browser-internal/tsconfig.json
@@ -43,6 +43,7 @@
     "@kbn/core-analytics-browser",
     "@kbn/shared-ux-router",
     "@kbn/shared-ux-link-redirect-app",
+    "@kbn/core-http-browser-internal",
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/deprecations/core-deprecations-browser-internal/src/deprecations_service.ts b/packages/core/deprecations/core-deprecations-browser-internal/src/deprecations_service.ts
index edaf5f7f27be04..6dd78c8525f5d2 100644
--- a/packages/core/deprecations/core-deprecations-browser-internal/src/deprecations_service.ts
+++ b/packages/core/deprecations/core-deprecations-browser-internal/src/deprecations_service.ts
@@ -8,13 +8,13 @@
 
 import type { CoreService } from '@kbn/core-base-browser-internal';
 import type { DeprecationsServiceStart } from '@kbn/core-deprecations-browser';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import { DeprecationsClient } from './deprecations_client';
 
 export class DeprecationsService implements CoreService<void, DeprecationsServiceStart> {
   public setup(): void {}
 
-  public start({ http }: { http: HttpStart }): DeprecationsServiceStart {
+  public start({ http }: { http: InternalHttpStart }): DeprecationsServiceStart {
     const deprecationsClient = new DeprecationsClient({ http });
 
     return {
diff --git a/packages/core/deprecations/core-deprecations-browser-internal/tsconfig.json b/packages/core/deprecations/core-deprecations-browser-internal/tsconfig.json
index 8c7dde1c84e07b..38fda3fdccf443 100644
--- a/packages/core/deprecations/core-deprecations-browser-internal/tsconfig.json
+++ b/packages/core/deprecations/core-deprecations-browser-internal/tsconfig.json
@@ -16,7 +16,8 @@
     "@kbn/core-http-browser",
     "@kbn/core-http-browser-mocks",
     "@kbn/core-deprecations-common",
-    "@kbn/core-deprecations-browser"
+    "@kbn/core-deprecations-browser",
+    "@kbn/core-http-browser-internal"
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/patch_client.ts b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/patch_client.ts
index 75ea5db91b2e34..a7bdf3788d2c86 100644
--- a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/patch_client.ts
+++ b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/patch_client.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { inspect } from 'util';
 import { errors } from '@elastic/elasticsearch';
 
 export const patchElasticsearchClient = () => {
@@ -17,4 +18,10 @@ export const patchElasticsearchClient = () => {
       message: this.message,
     };
   };
+
+  // @ts-expect-error
+  baseErrorPrototype[inspect.custom] = function () {
+    // @ts-expect-error
+    return this.toJSON();
+  };
 };
diff --git a/packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts b/packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts
index a11365feef7391..3d1f6e539936f3 100644
--- a/packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts
+++ b/packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts
@@ -15,7 +15,7 @@ export interface ClusterInfo {
   cluster_name: string;
   cluster_uuid: string;
   cluster_version: string;
-  cluster_build_flavor: string;
+  cluster_build_flavor?: string;
 }
 
 /**
diff --git a/packages/core/elasticsearch/core-elasticsearch-server-internal/src/register_analytics_context_provider.ts b/packages/core/elasticsearch/core-elasticsearch-server-internal/src/register_analytics_context_provider.ts
index be909f5ba21e55..35845519d1e166 100644
--- a/packages/core/elasticsearch/core-elasticsearch-server-internal/src/register_analytics_context_provider.ts
+++ b/packages/core/elasticsearch/core-elasticsearch-server-internal/src/register_analytics_context_provider.ts
@@ -27,7 +27,10 @@ export function registerAnalyticsContextProvider(
       cluster_name: { type: 'keyword', _meta: { description: 'The Cluster Name' } },
       cluster_uuid: { type: 'keyword', _meta: { description: 'The Cluster UUID' } },
       cluster_version: { type: 'keyword', _meta: { description: 'The Cluster version' } },
-      cluster_build_flavor: { type: 'keyword', _meta: { description: 'The Cluster build flavor' } },
+      cluster_build_flavor: {
+        type: 'keyword',
+        _meta: { description: 'The Cluster build flavor', optional: true },
+      },
     },
   });
 }
diff --git a/packages/core/environment/core-environment-server-internal/src/environment_service.test.ts b/packages/core/environment/core-environment-server-internal/src/environment_service.test.ts
index d13f78609ed8d7..42063306652f6f 100644
--- a/packages/core/environment/core-environment-server-internal/src/environment_service.test.ts
+++ b/packages/core/environment/core-environment-server-internal/src/environment_service.test.ts
@@ -120,16 +120,6 @@ describe('UuidService', () => {
     });
 
     describe('process warnings', () => {
-      it('logs warnings coming from the process', async () => {
-        await service.preboot({ analytics });
-
-        const warning = new Error('something went wrong');
-        process.emit('warning', warning);
-
-        expect(logger.get('process').warn).toHaveBeenCalledTimes(1);
-        expect(logger.get('process').warn).toHaveBeenCalledWith(warning);
-      });
-
       it('does not log deprecation warnings', async () => {
         await service.preboot({ analytics });
 
diff --git a/packages/core/environment/core-environment-server-internal/src/environment_service.ts b/packages/core/environment/core-environment-server-internal/src/environment_service.ts
index cb09b1b587e744..26e328e2aad71c 100644
--- a/packages/core/environment/core-environment-server-internal/src/environment_service.ts
+++ b/packages/core/environment/core-environment-server-internal/src/environment_service.ts
@@ -46,13 +46,11 @@ export type InternalEnvironmentServiceSetup = InternalEnvironmentServicePreboot;
 /** @internal */
 export class EnvironmentService {
   private readonly log: Logger;
-  private readonly processLogger: Logger;
   private readonly configService: IConfigService;
   private uuid: string = '';
 
   constructor(core: CoreContext) {
     this.log = core.logger.get('environment');
-    this.processLogger = core.logger.get('process');
     this.configService = core.configService;
   }
 
@@ -71,14 +69,6 @@ export class EnvironmentService {
       this.log.warn(`Detected an unhandled Promise rejection: ${message}`);
     });
 
-    process.on('warning', (warning) => {
-      // deprecation warnings do no reflect a current problem for the user and should be filtered out.
-      if (warning.name === 'DeprecationWarning') {
-        return;
-      }
-      this.processLogger.warn(warning);
-    });
-
     await createDataFolder({ pathConfig, logger: this.log });
     await writePidFile({ pidConfig, logger: this.log });
 
diff --git a/packages/core/http/core-http-browser-internal/index.ts b/packages/core/http/core-http-browser-internal/index.ts
index 3baa45b8bcdf1c..0b747b6261eb92 100644
--- a/packages/core/http/core-http-browser-internal/index.ts
+++ b/packages/core/http/core-http-browser-internal/index.ts
@@ -8,3 +8,4 @@
 
 export { BasePath } from './src/base_path';
 export { HttpService } from './src/http_service';
+export type { InternalHttpSetup, InternalHttpStart } from './src/types';
diff --git a/packages/core/http/core-http-browser-internal/src/anonymous_paths_service.test.ts b/packages/core/http/core-http-browser-internal/src/anonymous_paths_service.test.ts
index dff9c4719fef48..181641700d4d65 100644
--- a/packages/core/http/core-http-browser-internal/src/anonymous_paths_service.test.ts
+++ b/packages/core/http/core-http-browser-internal/src/anonymous_paths_service.test.ts
@@ -12,13 +12,13 @@ import { BasePath } from './base_path';
 describe('#setup()', () => {
   describe('#register', () => {
     it(`allows paths that don't start with /`, () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('bar');
     });
 
     it(`allows paths that end with '/'`, () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar/');
     });
@@ -26,70 +26,70 @@ describe('#setup()', () => {
 
   describe('#isAnonymous', () => {
     it('returns true for registered paths', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/foo/bar')).toBe(true);
     });
 
     it('returns true for paths registered with a trailing slash, but call "isAnonymous" with no trailing slash', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar/');
       expect(anonymousPaths.isAnonymous('/foo/bar')).toBe(true);
     });
 
     it('returns true for paths registered without a trailing slash, but call "isAnonymous" with a trailing slash', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/foo/bar/')).toBe(true);
     });
 
     it('returns true for paths registered without a starting slash', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('bar');
       expect(anonymousPaths.isAnonymous('/foo/bar')).toBe(true);
     });
 
     it('returns true for paths registered with a starting slash', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/foo/bar')).toBe(true);
     });
 
     it('when there is no basePath and calling "isAnonymous" without a starting slash, returns true for paths registered with a starting slash', () => {
-      const basePath = new BasePath('/');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('bar')).toBe(true);
     });
 
     it('when there is no basePath and calling "isAnonymous" with a starting slash, returns true for paths registered with a starting slash', () => {
-      const basePath = new BasePath('/');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/bar')).toBe(true);
     });
 
     it('returns true for paths whose capitalization is different', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/BAR');
       expect(anonymousPaths.isAnonymous('/foo/bar')).toBe(true);
     });
 
     it('returns false for other paths', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/foo/foo')).toBe(false);
     });
 
     it('returns false for sub-paths of registered paths', () => {
-      const basePath = new BasePath('/foo');
+      const basePath = new BasePath({ basePath: '/foo' });
       const anonymousPaths = new AnonymousPathsService().setup({ basePath });
       anonymousPaths.register('/bar');
       expect(anonymousPaths.isAnonymous('/foo/bar/baz')).toBe(false);
diff --git a/packages/core/http/core-http-browser-internal/src/base_path.test.ts b/packages/core/http/core-http-browser-internal/src/base_path.test.ts
index cfca537c0f5b42..ebf70c48d79c33 100644
--- a/packages/core/http/core-http-browser-internal/src/base_path.test.ts
+++ b/packages/core/http/core-http-browser-internal/src/base_path.test.ts
@@ -10,35 +10,31 @@ import { BasePath } from './base_path';
 
 describe('BasePath', () => {
   describe('#get()', () => {
-    it('returns an empty string if no basePath not provided', () => {
-      expect(new BasePath().get()).toBe('');
-    });
-
     it('returns basePath value if provided', () => {
-      expect(new BasePath('/foo').get()).toBe('/foo');
+      expect(new BasePath({ basePath: '/foo' }).get()).toBe('/foo');
     });
 
     describe('#prepend()', () => {
       it('adds the base path to the path if it is relative and starts with a slash', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.prepend('/a/b')).toBe('/foo/bar/a/b');
       });
 
       it('leaves the query string and hash of path unchanged', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.prepend('/a/b?x=y#c/d/e')).toBe('/foo/bar/a/b?x=y#c/d/e');
       });
 
       it('returns the path unchanged if it does not start with a slash', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.prepend('a/b')).toBe('a/b');
       });
 
       it('returns the path unchanged it it has a hostname', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.prepend('http://localhost:5601/a/b')).toBe('http://localhost:5601/a/b');
       });
@@ -46,19 +42,19 @@ describe('BasePath', () => {
 
     describe('#remove()', () => {
       it('removes the basePath if relative path starts with it', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.remove('/foo/bar/a/b')).toBe('/a/b');
       });
 
       it('leaves query string and hash intact', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.remove('/foo/bar/a/b?c=y#1234')).toBe('/a/b?c=y#1234');
       });
 
       it('ignores urls with hostnames', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.remove('http://localhost:5601/foo/bar/a/b')).toBe(
           'http://localhost:5601/foo/bar/a/b'
@@ -66,13 +62,13 @@ describe('BasePath', () => {
       });
 
       it('returns slash if path is just basePath', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.remove('/foo/bar')).toBe('/');
       });
 
       it('returns full path if basePath is not its own segment', () => {
-        const basePath = new BasePath('/foo/bar');
+        const basePath = new BasePath({ basePath: '/foo/bar' });
 
         expect(basePath.remove('/foo/barhop')).toBe('/foo/barhop');
       });
@@ -81,20 +77,39 @@ describe('BasePath', () => {
 
   describe('serverBasePath', () => {
     it('defaults to basePath', () => {
-      expect(new BasePath('/foo/bar').serverBasePath).toEqual('/foo/bar');
+      expect(new BasePath({ basePath: '/foo/bar' }).serverBasePath).toEqual('/foo/bar');
     });
 
     it('returns value when passed into constructor', () => {
-      expect(new BasePath('/foo/bar', '/foo').serverBasePath).toEqual('/foo');
+      expect(new BasePath({ basePath: '/foo/bar', serverBasePath: '/foo' }).serverBasePath).toEqual(
+        '/foo'
+      );
     });
   });
 
   describe('publicBaseUrl', () => {
     it('returns value passed into construtor', () => {
-      expect(new BasePath('/foo/bar', '/foo').publicBaseUrl).toEqual(undefined);
-      expect(new BasePath('/foo/bar', '/foo', 'http://myhost.com/foo').publicBaseUrl).toEqual(
-        'http://myhost.com/foo'
+      expect(new BasePath({ basePath: '/foo/bar' }).publicBaseUrl).toEqual(undefined);
+      expect(
+        new BasePath({ basePath: '/foo/bar', publicBaseUrl: 'http://myhost.com/foo' }).publicBaseUrl
+      ).toEqual('http://myhost.com/foo');
+    });
+  });
+
+  describe('assetsHrefBase', () => {
+    it('default to the serverBasePath if unspecified', () => {
+      expect(new BasePath({ basePath: '/foo/bar', serverBasePath: '/foo' }).assetsHrefBase).toEqual(
+        '/foo'
       );
     });
+    it('returns the correct value when explicitly set', () => {
+      expect(
+        new BasePath({
+          basePath: '/foo/bar',
+          serverBasePath: '/foo',
+          assetsHrefBase: 'http://cdn/foo',
+        }).assetsHrefBase
+      ).toEqual('http://cdn/foo');
+    });
   });
 });
diff --git a/packages/core/http/core-http-browser-internal/src/base_path.ts b/packages/core/http/core-http-browser-internal/src/base_path.ts
index 63fb8917421e01..4eaa71f8290d9e 100644
--- a/packages/core/http/core-http-browser-internal/src/base_path.ts
+++ b/packages/core/http/core-http-browser-internal/src/base_path.ts
@@ -10,18 +10,36 @@ import { IBasePath } from '@kbn/core-http-browser';
 import { modifyUrl } from '@kbn/std';
 
 export class BasePath implements IBasePath {
-  constructor(
-    private readonly basePath: string = '',
-    public readonly serverBasePath: string = basePath,
-    public readonly publicBaseUrl?: string
-  ) {}
+  private readonly basePath: string;
+  public readonly serverBasePath: string;
+  public readonly assetsHrefBase: string;
+  public readonly publicBaseUrl?: string;
+
+  constructor({
+    basePath,
+    serverBasePath,
+    assetsHrefBase,
+    publicBaseUrl,
+  }: {
+    basePath: string;
+    serverBasePath?: string;
+    assetsHrefBase?: string;
+    publicBaseUrl?: string;
+  }) {
+    this.basePath = basePath;
+    this.serverBasePath = serverBasePath ?? this.basePath;
+    this.assetsHrefBase = assetsHrefBase ?? this.serverBasePath;
+    this.publicBaseUrl = publicBaseUrl;
+  }
 
   public get = () => {
     return this.basePath;
   };
 
   public prepend = (path: string): string => {
-    if (!this.basePath) return path;
+    if (!this.basePath) {
+      return path;
+    }
     return modifyUrl(path, (parts) => {
       if (!parts.hostname && parts.pathname && parts.pathname.startsWith('/')) {
         parts.pathname = `${this.basePath}${parts.pathname}`;
diff --git a/packages/core/http/core-http-browser-internal/src/fetch.test.ts b/packages/core/http/core-http-browser-internal/src/fetch.test.ts
index b46a34f768b660..d4f37a6601b698 100644
--- a/packages/core/http/core-http-browser-internal/src/fetch.test.ts
+++ b/packages/core/http/core-http-browser-internal/src/fetch.test.ts
@@ -27,7 +27,7 @@ const BASE_PATH = 'http://localhost/myBase';
 describe('Fetch', () => {
   const executionContextMock = executionContextServiceMock.createSetupContract();
   const fetchInstance = new Fetch({
-    basePath: new BasePath(BASE_PATH),
+    basePath: new BasePath({ basePath: BASE_PATH }),
     kibanaVersion: 'VERSION',
     buildNumber: 1234,
     executionContext: executionContextMock,
diff --git a/packages/core/http/core-http-browser-internal/src/http_service.ts b/packages/core/http/core-http-browser-internal/src/http_service.ts
index d097dc7a14c9ae..a054ca3a7c11ce 100644
--- a/packages/core/http/core-http-browser-internal/src/http_service.ts
+++ b/packages/core/http/core-http-browser-internal/src/http_service.ts
@@ -10,8 +10,9 @@ import type { CoreService } from '@kbn/core-base-browser-internal';
 import type { ExecutionContextSetup } from '@kbn/core-execution-context-browser';
 import type { InternalInjectedMetadataSetup } from '@kbn/core-injected-metadata-browser-internal';
 import type { FatalErrorsSetup } from '@kbn/core-fatal-errors-browser';
-import type { HttpSetup, HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpSetup, InternalHttpStart } from './types';
 import { BasePath } from './base_path';
+import { StaticAssets } from './static_assets';
 import { AnonymousPathsService } from './anonymous_paths_service';
 import { LoadingCountService } from './loading_count_service';
 import { Fetch } from './fetch';
@@ -24,19 +25,23 @@ interface HttpDeps {
 }
 
 /** @internal */
-export class HttpService implements CoreService<HttpSetup, HttpStart> {
+export class HttpService implements CoreService<InternalHttpSetup, InternalHttpStart> {
   private readonly anonymousPaths = new AnonymousPathsService();
   private readonly loadingCount = new LoadingCountService();
-  private service?: HttpSetup;
+  private service?: InternalHttpSetup;
 
-  public setup({ injectedMetadata, fatalErrors, executionContext }: HttpDeps): HttpSetup {
+  public setup({ injectedMetadata, fatalErrors, executionContext }: HttpDeps): InternalHttpSetup {
     const kibanaVersion = injectedMetadata.getKibanaVersion();
     const buildNumber = injectedMetadata.getKibanaBuildNumber();
-    const basePath = new BasePath(
-      injectedMetadata.getBasePath(),
-      injectedMetadata.getServerBasePath(),
-      injectedMetadata.getPublicBaseUrl()
-    );
+    const basePath = new BasePath({
+      basePath: injectedMetadata.getBasePath(),
+      serverBasePath: injectedMetadata.getServerBasePath(),
+      publicBaseUrl: injectedMetadata.getPublicBaseUrl(),
+      assetsHrefBase: injectedMetadata.getAssetsHrefBase(),
+    });
+    const staticAssets = new StaticAssets({
+      assetsHrefBase: injectedMetadata.getAssetsHrefBase(),
+    });
 
     const fetchService = new Fetch({ basePath, kibanaVersion, buildNumber, executionContext });
     const loadingCount = this.loadingCount.setup({ fatalErrors });
@@ -44,6 +49,7 @@ export class HttpService implements CoreService<HttpSetup, HttpStart> {
 
     this.service = {
       basePath,
+      staticAssets,
       anonymousPaths: this.anonymousPaths.setup({ basePath }),
       externalUrl: new ExternalUrlService().setup({ injectedMetadata, location: window.location }),
       intercept: fetchService.intercept.bind(fetchService),
diff --git a/packages/core/http/core-http-browser-internal/src/static_assets.test.ts b/packages/core/http/core-http-browser-internal/src/static_assets.test.ts
new file mode 100644
index 00000000000000..c9083e2fd01777
--- /dev/null
+++ b/packages/core/http/core-http-browser-internal/src/static_assets.test.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { StaticAssets } from './static_assets';
+
+describe('StaticAssets', () => {
+  describe('#getPluginAssetHref()', () => {
+    it('returns the expected value when the base is a path', () => {
+      const staticAssets = new StaticAssets({ assetsHrefBase: '/base-path' });
+      expect(staticAssets.getPluginAssetHref('foo', 'path/to/img.gif')).toEqual(
+        '/base-path/plugins/foo/assets/path/to/img.gif'
+      );
+    });
+
+    it('returns the expected value when the base is a full url', () => {
+      const staticAssets = new StaticAssets({ assetsHrefBase: 'http://cdn/cdn-base-path' });
+      expect(staticAssets.getPluginAssetHref('bar', 'path/to/img.gif')).toEqual(
+        'http://cdn/cdn-base-path/plugins/bar/assets/path/to/img.gif'
+      );
+    });
+
+    it('removes leading slash from the', () => {
+      const staticAssets = new StaticAssets({ assetsHrefBase: '/base-path' });
+      expect(staticAssets.getPluginAssetHref('dolly', '/path/for/something.svg')).toEqual(
+        '/base-path/plugins/dolly/assets/path/for/something.svg'
+      );
+    });
+  });
+});
diff --git a/packages/core/http/core-http-browser-internal/src/static_assets.ts b/packages/core/http/core-http-browser-internal/src/static_assets.ts
new file mode 100644
index 00000000000000..02218e3d375d6a
--- /dev/null
+++ b/packages/core/http/core-http-browser-internal/src/static_assets.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { InternalStaticAssets } from './types';
+
+export class StaticAssets implements InternalStaticAssets {
+  public readonly assetsHrefBase: string;
+
+  constructor({ assetsHrefBase }: { assetsHrefBase: string }) {
+    this.assetsHrefBase = assetsHrefBase.endsWith('/')
+      ? assetsHrefBase.slice(0, -1)
+      : assetsHrefBase;
+  }
+
+  getPluginAssetHref(pluginName: string, assetPath: string): string {
+    if (assetPath.startsWith('/')) {
+      assetPath = assetPath.slice(1);
+    }
+    return `${this.assetsHrefBase}/plugins/${pluginName}/assets/${assetPath}`;
+  }
+}
diff --git a/packages/core/http/core-http-browser-internal/src/types.ts b/packages/core/http/core-http-browser-internal/src/types.ts
new file mode 100644
index 00000000000000..83e47ff0b72626
--- /dev/null
+++ b/packages/core/http/core-http-browser-internal/src/types.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { HttpSetup, HttpStart } from '@kbn/core-http-browser';
+
+export type InternalHttpSetup = Omit<HttpSetup, 'staticAssets'> & {
+  staticAssets: InternalStaticAssets;
+};
+
+export type InternalHttpStart = Omit<HttpStart, 'staticAssets'> & {
+  staticAssets: InternalStaticAssets;
+};
+
+export interface InternalStaticAssets {
+  getPluginAssetHref(pluginId: string, assetPath: string): string;
+}
diff --git a/packages/core/http/core-http-browser-mocks/src/base_path.mock.ts b/packages/core/http/core-http-browser-mocks/src/base_path.mock.ts
index 9d36d4e33c1066..ad27677dd41ff6 100644
--- a/packages/core/http/core-http-browser-mocks/src/base_path.mock.ts
+++ b/packages/core/http/core-http-browser-mocks/src/base_path.mock.ts
@@ -11,13 +11,15 @@ import type { IBasePath } from '@kbn/core-http-browser';
 const createBasePathMock = ({
   publicBaseUrl = '/',
   serverBasePath = '/',
-}: { publicBaseUrl?: string; serverBasePath?: string } = {}) => {
+  assetsHrefBase = '/',
+}: { publicBaseUrl?: string; serverBasePath?: string; assetsHrefBase?: string } = {}) => {
   const mock: jest.Mocked<IBasePath> = {
     prepend: jest.fn(),
     get: jest.fn(),
     remove: jest.fn(),
     publicBaseUrl,
     serverBasePath,
+    assetsHrefBase,
   };
 
   return mock;
diff --git a/packages/core/http/core-http-browser-mocks/src/http_service.mock.ts b/packages/core/http/core-http-browser-mocks/src/http_service.mock.ts
index 553e09875ae9e4..45b445b39fad42 100644
--- a/packages/core/http/core-http-browser-mocks/src/http_service.mock.ts
+++ b/packages/core/http/core-http-browser-mocks/src/http_service.mock.ts
@@ -29,7 +29,10 @@ const createServiceMock = ({
   patch: jest.fn(),
   delete: jest.fn(),
   options: jest.fn(),
-  basePath: new BasePath(basePath, undefined, publicBaseUrl),
+  basePath: new BasePath({
+    basePath,
+    publicBaseUrl,
+  }),
   anonymousPaths: {
     register: jest.fn(),
     isAnonymous: jest.fn(),
@@ -38,6 +41,9 @@ const createServiceMock = ({
     isInternalUrl: jest.fn(),
     validateUrl: jest.fn(),
   },
+  staticAssets: {
+    getPluginAssetHref: jest.fn(),
+  },
   addLoadingCountSource: jest.fn(),
   getLoadingCount$: jest.fn().mockReturnValue(new BehaviorSubject(0)),
   intercept: jest.fn(),
diff --git a/packages/core/http/core-http-browser/index.ts b/packages/core/http/core-http-browser/index.ts
index 5f733d720c17de..de1e201132d3df 100644
--- a/packages/core/http/core-http-browser/index.ts
+++ b/packages/core/http/core-http-browser/index.ts
@@ -12,6 +12,7 @@ export type {
   IBasePath,
   IExternalUrl,
   IAnonymousPaths,
+  IStaticAssets,
   HttpHeadersInit,
   HttpRequestInit,
   HttpFetchQuery,
diff --git a/packages/core/http/core-http-browser/src/types.ts b/packages/core/http/core-http-browser/src/types.ts
index e9b3d2ecdd6607..5d270d77afc2e6 100644
--- a/packages/core/http/core-http-browser/src/types.ts
+++ b/packages/core/http/core-http-browser/src/types.ts
@@ -19,6 +19,12 @@ export interface HttpSetup {
    */
   basePath: IBasePath;
 
+  /**
+   * APIs for creating hrefs to static assets.
+   * See {@link IStaticAssets}
+   */
+  staticAssets: IStaticAssets;
+
   /**
    * APIs for denoting certain paths for not requiring authentication
    */
@@ -96,6 +102,12 @@ export interface IBasePath {
    */
   readonly serverBasePath: string;
 
+  /**
+   * Href (hypertext reference) intended to be used as the base for constructing
+   * other hrefs to static assets.
+   */
+  readonly assetsHrefBase: string;
+
   /**
    * The server's publicly exposed base URL, if configured. Includes protocol, host, port (optional) and the
    * {@link IBasePath.serverBasePath}.
@@ -105,6 +117,7 @@ export interface IBasePath {
    */
   readonly publicBaseUrl?: string;
 }
+
 /**
  * APIs for working with external URLs.
  *
@@ -130,6 +143,25 @@ export interface IExternalUrl {
   validateUrl(relativeOrAbsoluteUrl: string): URL | null;
 }
 
+/**
+ * APIs for creating hrefs to static assets.
+ *
+ * @public
+ */
+export interface IStaticAssets {
+  /**
+   * Gets the full href to the current plugin's asset,
+   * given its path relative to the plugin's `public/assets` folder.
+   *
+   * @example
+   * ```ts
+   * // I want to retrieve the href for the asset stored under `my_plugin/public/assets/some_folder/asset.png`:
+   * const assetHref = core.http.statisAssets.getPluginAssetHref('some_folder/asset.png');
+   * ```
+   */
+  getPluginAssetHref(assetPath: string): string;
+}
+
 /**
  * APIs for denoting paths as not requiring authentication
  */
@@ -318,10 +350,13 @@ export interface HttpHandler {
     path: string,
     options: HttpFetchOptions & { asResponse: true }
   ): Promise<HttpResponse<TResponseBody>>;
+
   <TResponseBody = unknown>(options: HttpFetchOptionsWithPath & { asResponse: true }): Promise<
     HttpResponse<TResponseBody>
   >;
+
   <TResponseBody = unknown>(path: string, options?: HttpFetchOptions): Promise<TResponseBody>;
+
   <TResponseBody = unknown>(options: HttpFetchOptionsWithPath): Promise<TResponseBody>;
 }
 
@@ -368,6 +403,7 @@ export interface HttpInterceptorResponseError extends HttpResponse {
   request: Readonly<Request>;
   error: Error | IHttpFetchError;
 }
+
 /** @public */
 export interface HttpInterceptorRequestError {
   fetchOptions: Readonly<HttpFetchOptionsWithPath>;
@@ -429,6 +465,7 @@ export interface HttpInterceptor {
 export interface IHttpInterceptController {
   /** Whether or not this chain has been halted. */
   halted: boolean;
+
   /** Halt the request Promise chain and do not process further interceptors or response handlers. */
   halt(): void;
 }
diff --git a/packages/core/http/core-http-router-server-internal/src/patch_requests.ts b/packages/core/http/core-http-router-server-internal/src/patch_requests.ts
new file mode 100644
index 00000000000000..685c815109a011
--- /dev/null
+++ b/packages/core/http/core-http-router-server-internal/src/patch_requests.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+// @ts-expect-error not in the definition file
+import HapiRequest from '@hapi/hapi/lib/request.js';
+import { IncomingMessage } from 'http';
+import { inspect } from 'util';
+
+export const patchRequest = () => {
+  // HAPI request
+  HapiRequest.prototype.toString = function () {
+    return `[HAPI.Request method="${this.method}" url="${this.url}"]`;
+  };
+
+  HapiRequest.prototype.toJSON = function () {
+    return {
+      method: this.method,
+      url: String(this.url),
+    };
+  };
+
+  HapiRequest.prototype[inspect.custom] = function () {
+    return this.toJSON();
+  };
+
+  // http.IncomingMessage
+  const IncomingMessageProto = IncomingMessage.prototype;
+
+  IncomingMessageProto.toString = function () {
+    return `[http.IncomingMessage method="${this.method}" url="${this.url}" complete="${this.complete}" aborted="${this.aborted}"]`;
+  };
+
+  // @ts-expect-error missing definition
+  IncomingMessageProto.toJSON = function () {
+    return {
+      method: this.method,
+      url: this.url,
+      complete: this.complete,
+      aborted: this.aborted,
+    };
+  };
+
+  // @ts-expect-error missing definition
+  IncomingMessageProto[inspect.custom] = function () {
+    // @ts-expect-error missing definition
+    return this.toJSON();
+  };
+};
diff --git a/packages/core/http/core-http-router-server-internal/src/request.ts b/packages/core/http/core-http-router-server-internal/src/request.ts
index 66efdbd61587c7..307950c1fe05db 100644
--- a/packages/core/http/core-http-router-server-internal/src/request.ts
+++ b/packages/core/http/core-http-router-server-internal/src/request.ts
@@ -8,6 +8,7 @@
 
 import { URL } from 'url';
 import { v4 as uuidv4 } from 'uuid';
+import { inspect } from 'util';
 import type { Request, RouteOptions } from '@hapi/hapi';
 import { fromEvent, NEVER } from 'rxjs';
 import { shareReplay, first, filter } from 'rxjs/operators';
@@ -36,6 +37,10 @@ import {
 import { RouteValidator } from './validator';
 import { isSafeMethod } from './route';
 import { KibanaSocket } from './socket';
+import { patchRequest } from './patch_requests';
+
+// patching at module load
+patchRequest();
 
 const requestSymbol = Symbol('request');
 
@@ -174,6 +179,29 @@ export class CoreKibanaRequest<
     };
   }
 
+  toString() {
+    return `[CoreKibanaRequest id="${this.id}" method="${this.route.method}" url="${this.url}" fake="${this.isFakeRequest}" system="${this.isSystemRequest}" api="${this.isInternalApiRequest}"]`;
+  }
+
+  toJSON() {
+    return {
+      id: this.id,
+      uuid: this.uuid,
+      url: `${this.url}`,
+      isFakeRequest: this.isFakeRequest,
+      isSystemRequest: this.isSystemRequest,
+      isInternalApiRequest: this.isInternalApiRequest,
+      auth: {
+        isAuthenticated: this.auth.isAuthenticated,
+      },
+      route: this.route,
+    };
+  }
+
+  [inspect.custom]() {
+    return this.toJSON();
+  }
+
   private getEvents(request: RawRequest): KibanaRequestEvents {
     if (isFakeRawRequest(request)) {
       return {
diff --git a/packages/core/http/core-http-server-internal/src/http_server.test.ts b/packages/core/http/core-http-server-internal/src/http_server.test.ts
index f188d7a06552e1..f70b035c5f22ff 100644
--- a/packages/core/http/core-http-server-internal/src/http_server.test.ts
+++ b/packages/core/http/core-http-server-internal/src/http_server.test.ts
@@ -82,6 +82,7 @@ beforeEach(() => {
     cors: {
       enabled: false,
     },
+    cdn: {},
     shutdownTimeout: moment.duration(500, 'ms'),
   } as any;
 
diff --git a/packages/core/http/core-http-server-internal/src/http_server.ts b/packages/core/http/core-http-server-internal/src/http_server.ts
index c8a6f55e0a55e4..fb776f5d29eb6f 100644
--- a/packages/core/http/core-http-server-internal/src/http_server.ts
+++ b/packages/core/http/core-http-server-internal/src/http_server.ts
@@ -58,7 +58,7 @@ import { AuthStateStorage } from './auth_state_storage';
 import { AuthHeadersStorage } from './auth_headers_storage';
 import { BasePath } from './base_path_service';
 import { getEcsResponseLog } from './logging';
-import { StaticAssets, type IStaticAssets } from './static_assets';
+import { StaticAssets, type InternalStaticAssets } from './static_assets';
 
 /**
  * Adds ELU timings for the executed function to the current's context transaction
@@ -136,7 +136,7 @@ export interface HttpServerSetup {
    * @note Static assets may be served over CDN
    */
   registerStaticDir: (path: string, dirPath: string) => void;
-  staticAssets: IStaticAssets;
+  staticAssets: InternalStaticAssets;
   basePath: HttpServiceSetup['basePath'];
   csp: HttpServiceSetup['csp'];
   createCookieSessionStorageFactory: HttpServiceSetup['createCookieSessionStorageFactory'];
diff --git a/packages/core/http/core-http-server-internal/src/http_service.ts b/packages/core/http/core-http-server-internal/src/http_service.ts
index 96e9c8a85ba89f..99d286b26f83fa 100644
--- a/packages/core/http/core-http-server-internal/src/http_service.ts
+++ b/packages/core/http/core-http-server-internal/src/http_service.ts
@@ -199,7 +199,7 @@ export class HttpService
   // the `plugin` and `legacy` services.
   public getStartContract(): InternalHttpServiceStart {
     return {
-      ...pick(this.internalSetup!, ['auth', 'basePath', 'getServerInfo']),
+      ...pick(this.internalSetup!, ['auth', 'basePath', 'getServerInfo', 'staticAssets']),
       isListening: () => this.httpServer.isListening(),
     };
   }
diff --git a/packages/core/http/core-http-server-internal/src/static_assets.test.ts b/packages/core/http/core-http-server-internal/src/static_assets.test.ts
index d80ec6aaf6ed88..0b1acd4e73fd9a 100644
--- a/packages/core/http/core-http-server-internal/src/static_assets.test.ts
+++ b/packages/core/http/core-http-server-internal/src/static_assets.test.ts
@@ -14,18 +14,48 @@ describe('StaticAssets', () => {
   let basePath: BasePath;
   let cdnConfig: CdnConfig;
   let staticAssets: StaticAssets;
+
   beforeEach(() => {
-    basePath = new BasePath('/test');
-    cdnConfig = CdnConfig.from();
-    staticAssets = new StaticAssets(basePath, cdnConfig);
+    basePath = new BasePath('/base-path');
   });
-  it('provides fallsback to server base path', () => {
-    expect(staticAssets.getHrefBase()).toEqual('/test');
+
+  describe('#getHrefBase()', () => {
+    it('provides fallback to server base path', () => {
+      cdnConfig = CdnConfig.from();
+      staticAssets = new StaticAssets(basePath, cdnConfig);
+      expect(staticAssets.getHrefBase()).toEqual('/base-path');
+    });
+
+    it('provides the correct HREF given a CDN is configured', () => {
+      cdnConfig = CdnConfig.from({ url: 'https://cdn.example.com/test' });
+      staticAssets = new StaticAssets(basePath, cdnConfig);
+      expect(staticAssets.getHrefBase()).toEqual('https://cdn.example.com/test');
+    });
   });
 
-  it('provides the correct HREF given a CDN is configured', () => {
-    cdnConfig = CdnConfig.from({ url: 'https://cdn.example.com/test' });
-    staticAssets = new StaticAssets(basePath, cdnConfig);
-    expect(staticAssets.getHrefBase()).toEqual('https://cdn.example.com/test');
+  describe('#getPluginAssetHref()', () => {
+    it('returns the expected value when CDN config is not set', () => {
+      cdnConfig = CdnConfig.from();
+      staticAssets = new StaticAssets(basePath, cdnConfig);
+      expect(staticAssets.getPluginAssetHref('foo', 'path/to/img.gif')).toEqual(
+        '/base-path/plugins/foo/assets/path/to/img.gif'
+      );
+    });
+
+    it('returns the expected value when CDN config is set', () => {
+      cdnConfig = CdnConfig.from({ url: 'https://cdn.example.com/test' });
+      staticAssets = new StaticAssets(basePath, cdnConfig);
+      expect(staticAssets.getPluginAssetHref('bar', 'path/to/img.gif')).toEqual(
+        'https://cdn.example.com/test/plugins/bar/assets/path/to/img.gif'
+      );
+    });
+
+    it('removes leading slash from the', () => {
+      cdnConfig = CdnConfig.from();
+      staticAssets = new StaticAssets(basePath, cdnConfig);
+      expect(staticAssets.getPluginAssetHref('dolly', '/path/for/something.svg')).toEqual(
+        '/base-path/plugins/dolly/assets/path/for/something.svg'
+      );
+    });
   });
 });
diff --git a/packages/core/http/core-http-server-internal/src/static_assets.ts b/packages/core/http/core-http-server-internal/src/static_assets.ts
index b4e7a529fe9489..4dfe46d8d31a6c 100644
--- a/packages/core/http/core-http-server-internal/src/static_assets.ts
+++ b/packages/core/http/core-http-server-internal/src/static_assets.ts
@@ -9,20 +9,31 @@
 import type { BasePath } from './base_path_service';
 import { CdnConfig } from './cdn';
 
-export interface IStaticAssets {
+export interface InternalStaticAssets {
   getHrefBase(): string;
+  getPluginAssetHref(pluginName: string, assetPath: string): string;
 }
 
-export class StaticAssets implements IStaticAssets {
-  constructor(private readonly basePath: BasePath, private readonly cdnConfig: CdnConfig) {}
+export class StaticAssets implements InternalStaticAssets {
+  private readonly assetsHrefBase: string;
+
+  constructor(basePath: BasePath, cdnConfig: CdnConfig) {
+    const hrefToUse = cdnConfig.baseHref ?? basePath.serverBasePath;
+    this.assetsHrefBase = hrefToUse.endsWith('/') ? hrefToUse.slice(0, -1) : hrefToUse;
+  }
+
   /**
    * Returns a href (hypertext reference) intended to be used as the base for constructing
    * other hrefs to static assets.
    */
   getHrefBase(): string {
-    if (this.cdnConfig.baseHref) {
-      return this.cdnConfig.baseHref;
+    return this.assetsHrefBase;
+  }
+
+  getPluginAssetHref(pluginName: string, assetPath: string): string {
+    if (assetPath.startsWith('/')) {
+      assetPath = assetPath.slice(1);
     }
-    return this.basePath.serverBasePath;
+    return `${this.assetsHrefBase}/plugins/${pluginName}/assets/${assetPath}`;
   }
 }
diff --git a/packages/core/http/core-http-server-internal/src/types.ts b/packages/core/http/core-http-server-internal/src/types.ts
index 0acbb0d0508d68..72dde630e03dbd 100644
--- a/packages/core/http/core-http-server-internal/src/types.ts
+++ b/packages/core/http/core-http-server-internal/src/types.ts
@@ -16,8 +16,9 @@ import type {
   HttpServiceSetup,
   HttpServiceStart,
 } from '@kbn/core-http-server';
-import { HttpServerSetup } from './http_server';
-import { ExternalUrlConfig } from './external_url';
+import type { HttpServerSetup } from './http_server';
+import type { ExternalUrlConfig } from './external_url';
+import type { InternalStaticAssets } from './static_assets';
 
 /** @internal */
 export interface InternalHttpServicePreboot
@@ -43,10 +44,10 @@ export interface InternalHttpServicePreboot
 
 /** @internal */
 export interface InternalHttpServiceSetup
-  extends Omit<HttpServiceSetup, 'createRouter' | 'registerRouteHandlerContext'> {
+  extends Omit<HttpServiceSetup, 'createRouter' | 'registerRouteHandlerContext' | 'staticAssets'> {
   auth: HttpServerSetup['auth'];
   server: HttpServerSetup['server'];
-  staticAssets: HttpServerSetup['staticAssets'];
+  staticAssets: InternalStaticAssets;
   externalUrl: ExternalUrlConfig;
   createRouter: <Context extends RequestHandlerContextBase = RequestHandlerContextBase>(
     path: string,
@@ -66,7 +67,8 @@ export interface InternalHttpServiceSetup
 }
 
 /** @internal */
-export interface InternalHttpServiceStart extends HttpServiceStart {
+export interface InternalHttpServiceStart extends Omit<HttpServiceStart, 'staticAssets'> {
+  staticAssets: InternalStaticAssets;
   /** Indicates if the http server is listening on the configured port */
   isListening: () => boolean;
 }
diff --git a/packages/core/http/core-http-server-mocks/src/http_service.mock.ts b/packages/core/http/core-http-server-mocks/src/http_service.mock.ts
index ad7e310f5a2d8a..f8ecfadfeb87e5 100644
--- a/packages/core/http/core-http-server-mocks/src/http_service.mock.ts
+++ b/packages/core/http/core-http-server-mocks/src/http_service.mock.ts
@@ -20,6 +20,7 @@ import type {
   HttpServicePreboot,
   HttpServiceSetup,
   HttpServiceStart,
+  IStaticAssets,
 } from '@kbn/core-http-server';
 import { AuthStatus } from '@kbn/core-http-server';
 import { mockRouter, RouterMock } from '@kbn/core-http-router-server-mocks';
@@ -34,17 +35,19 @@ import type {
 import { sessionStorageMock } from './cookie_session_storage.mocks';
 
 type BasePathMocked = jest.Mocked<InternalHttpServiceSetup['basePath']>;
-type StaticAssetsMocked = jest.Mocked<InternalHttpServiceSetup['staticAssets']>;
+type InternalStaticAssetsMocked = jest.Mocked<InternalHttpServiceSetup['staticAssets']>;
+type StaticAssetsMocked = jest.Mocked<IStaticAssets>;
 type AuthMocked = jest.Mocked<InternalHttpServiceSetup['auth']>;
 
 export type HttpServicePrebootMock = jest.Mocked<HttpServicePreboot>;
 export type InternalHttpServicePrebootMock = jest.Mocked<
   Omit<InternalHttpServicePreboot, 'basePath' | 'staticAssets'>
-> & { basePath: BasePathMocked; staticAssets: StaticAssetsMocked };
+> & { basePath: BasePathMocked; staticAssets: InternalStaticAssetsMocked };
 export type HttpServiceSetupMock<
   ContextType extends RequestHandlerContextBase = RequestHandlerContextBase
 > = jest.Mocked<Omit<HttpServiceSetup<ContextType>, 'basePath' | 'createRouter'>> & {
   basePath: BasePathMocked;
+  staticAssets: StaticAssetsMocked;
   createRouter: jest.MockedFunction<() => RouterMock>;
 };
 export type InternalHttpServiceSetupMock = jest.Mocked<
@@ -55,15 +58,17 @@ export type InternalHttpServiceSetupMock = jest.Mocked<
 > & {
   auth: AuthMocked;
   basePath: BasePathMocked;
-  staticAssets: StaticAssetsMocked;
+  staticAssets: InternalStaticAssetsMocked;
   createRouter: jest.MockedFunction<(path: string) => RouterMock>;
   authRequestHeaders: jest.Mocked<IAuthHeadersStorage>;
 };
 export type HttpServiceStartMock = jest.Mocked<HttpServiceStart> & {
   basePath: BasePathMocked;
+  staticAssets: StaticAssetsMocked;
 };
 export type InternalHttpServiceStartMock = jest.Mocked<InternalHttpServiceStart> & {
   basePath: BasePathMocked;
+  staticAssets: InternalStaticAssetsMocked;
 };
 
 const createBasePathMock = (
@@ -78,11 +83,12 @@ const createBasePathMock = (
   remove: jest.fn(),
 });
 
-const createStaticAssetsMock = (
+const createInternalStaticAssetsMock = (
   basePath: BasePathMocked,
   cdnUrl: undefined | string = undefined
-): StaticAssetsMocked => ({
+): InternalStaticAssetsMocked => ({
   getHrefBase: jest.fn(() => cdnUrl ?? basePath.serverBasePath),
+  getPluginAssetHref: jest.fn().mockReturnValue(cdnUrl ?? basePath.serverBasePath),
 });
 
 const createAuthMock = () => {
@@ -106,6 +112,7 @@ const createAuthHeaderStorageMock = () => {
 interface CreateMockArgs {
   cdnUrl?: string;
 }
+
 const createInternalPrebootContractMock = (args: CreateMockArgs = {}) => {
   const basePath = createBasePathMock();
   const mock: InternalHttpServicePrebootMock = {
@@ -113,7 +120,7 @@ const createInternalPrebootContractMock = (args: CreateMockArgs = {}) => {
     registerRouteHandlerContext: jest.fn(),
     registerStaticDir: jest.fn(),
     basePath,
-    staticAssets: createStaticAssetsMock(basePath, args.cdnUrl),
+    staticAssets: createInternalStaticAssetsMock(basePath, args.cdnUrl),
     csp: CspConfig.DEFAULT,
     externalUrl: ExternalUrlConfig.DEFAULT,
     auth: createAuthMock(),
@@ -144,6 +151,7 @@ const createPrebootContractMock = () => {
 };
 
 const createInternalSetupContractMock = () => {
+  const basePath = createBasePathMock();
   const mock: InternalHttpServiceSetupMock = {
     // we can mock other hapi server methods when we need it
     server: {
@@ -164,9 +172,9 @@ const createInternalSetupContractMock = () => {
     registerOnPreResponse: jest.fn(),
     createRouter: jest.fn().mockImplementation(() => mockRouter.create({})),
     registerStaticDir: jest.fn(),
-    basePath: createBasePathMock(),
+    basePath,
     csp: CspConfig.DEFAULT,
-    staticAssets: { getHrefBase: jest.fn(() => mock.basePath.serverBasePath) },
+    staticAssets: createInternalStaticAssetsMock(basePath),
     externalUrl: ExternalUrlConfig.DEFAULT,
     auth: createAuthMock(),
     authRequestHeaders: createAuthHeaderStorageMock(),
@@ -202,6 +210,9 @@ const createSetupContractMock = <
     createRouter: jest.fn(),
     registerRouteHandlerContext: jest.fn(),
     getServerInfo: internalMock.getServerInfo,
+    staticAssets: {
+      getPluginAssetHref: jest.fn().mockImplementation((assetPath: string) => assetPath),
+    },
   };
 
   mock.createRouter.mockImplementation(() => internalMock.createRouter(''));
@@ -214,14 +225,19 @@ const createStartContractMock = () => {
     auth: createAuthMock(),
     basePath: createBasePathMock(),
     getServerInfo: jest.fn(),
+    staticAssets: {
+      getPluginAssetHref: jest.fn().mockImplementation((assetPath: string) => assetPath),
+    },
   };
 
   return mock;
 };
 
 const createInternalStartContractMock = () => {
+  const basePath = createBasePathMock();
   const mock: InternalHttpServiceStartMock = {
     ...createStartContractMock(),
+    staticAssets: createInternalStaticAssetsMock(basePath),
     isListening: jest.fn(),
   };
 
diff --git a/packages/core/http/core-http-server/index.ts b/packages/core/http/core-http-server/index.ts
index 94eefba610a444..9a28a7be5033e3 100644
--- a/packages/core/http/core-http-server/index.ts
+++ b/packages/core/http/core-http-server/index.ts
@@ -142,3 +142,5 @@ export type {
   VersionedRouteRegistrar,
   VersionedRouter,
 } from './src/versioning';
+
+export type { IStaticAssets } from './src/static_assets';
diff --git a/packages/core/http/core-http-server/src/http_contract.ts b/packages/core/http/core-http-server/src/http_contract.ts
index 753b7b8cf00669..8ac34b26a386cf 100644
--- a/packages/core/http/core-http-server/src/http_contract.ts
+++ b/packages/core/http/core-http-server/src/http_contract.ts
@@ -20,6 +20,7 @@ import type {
   OnPreRoutingHandler,
 } from './lifecycle';
 import type { IBasePath } from './base_path';
+import type { IStaticAssets } from './static_assets';
 import type { ICspConfig } from './csp';
 import type { GetAuthState, IsAuthenticated } from './auth_state';
 import type { SessionStorageCookieOptions, SessionStorageFactory } from './session_storage';
@@ -287,6 +288,12 @@ export interface HttpServiceSetup<
    */
   basePath: IBasePath;
 
+  /**
+   * APIs for creating hrefs to static assets.
+   * See {@link IStaticAssets}
+   */
+  staticAssets: IStaticAssets;
+
   /**
    * The CSP config used for Kibana.
    */
@@ -361,6 +368,12 @@ export interface HttpServiceStart {
    */
   basePath: IBasePath;
 
+  /**
+   * APIs for creating hrefs to static assets.
+   * See {@link IStaticAssets}
+   */
+  staticAssets: IStaticAssets;
+
   /**
    * Auth status.
    * See {@link HttpAuth}
diff --git a/packages/core/http/core-http-server/src/static_assets.ts b/packages/core/http/core-http-server/src/static_assets.ts
new file mode 100644
index 00000000000000..c0cc8597d1540d
--- /dev/null
+++ b/packages/core/http/core-http-server/src/static_assets.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/**
+ * APIs for creating hrefs to static assets.
+ *
+ * @public
+ */
+export interface IStaticAssets {
+  /**
+   * Gets the full href to the current plugin's asset,
+   * given its path relative to the plugin's `public/assets` folder.
+   *
+   * @example
+   * ```ts
+   * // I want to retrieve the href for the asset stored under `my_plugin/public/assets/some_folder/asset.png`:
+   * const assetHref = core.http.statisAssets.getPluginAssetHref('some_folder/asset.png');
+   * ```
+   */
+  getPluginAssetHref(assetPath: string): string;
+}
diff --git a/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/injected_metadata_service.ts b/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/injected_metadata_service.ts
index ca818f9f79dc73..a50de7ca3f5e77 100644
--- a/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/injected_metadata_service.ts
+++ b/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/injected_metadata_service.ts
@@ -48,6 +48,10 @@ export class InjectedMetadataService {
         return this.state.publicBaseUrl;
       },
 
+      getAssetsHrefBase: () => {
+        return this.state.assetsHrefBase;
+      },
+
       getAnonymousStatusPage: () => {
         return this.state.anonymousStatusPage;
       },
diff --git a/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/types.ts b/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/types.ts
index 67c9c6ff4d665c..3b996e68e50b3d 100644
--- a/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/types.ts
+++ b/packages/core/injected-metadata/core-injected-metadata-browser-internal/src/types.ts
@@ -29,6 +29,7 @@ export interface InternalInjectedMetadataSetup {
   getBasePath: () => string;
   getServerBasePath: () => string;
   getPublicBaseUrl: () => string | undefined;
+  getAssetsHrefBase: () => string;
   getKibanaBuildNumber: () => number;
   getKibanaBranch: () => string;
   getKibanaVersion: () => string;
diff --git a/packages/core/injected-metadata/core-injected-metadata-browser-mocks/src/injected_metadata_service.mock.ts b/packages/core/injected-metadata/core-injected-metadata-browser-mocks/src/injected_metadata_service.mock.ts
index 98f1f8c65c37f0..3d76d48cbdb9b8 100644
--- a/packages/core/injected-metadata/core-injected-metadata-browser-mocks/src/injected_metadata_service.mock.ts
+++ b/packages/core/injected-metadata/core-injected-metadata-browser-mocks/src/injected_metadata_service.mock.ts
@@ -16,6 +16,7 @@ const createSetupContractMock = () => {
   const setupContract: jest.Mocked<InternalInjectedMetadataSetup> = {
     getBasePath: jest.fn(),
     getServerBasePath: jest.fn(),
+    getAssetsHrefBase: jest.fn(),
     getPublicBaseUrl: jest.fn(),
     getKibanaVersion: jest.fn(),
     getKibanaBranch: jest.fn(),
@@ -31,6 +32,9 @@ const createSetupContractMock = () => {
     getKibanaBuildNumber: jest.fn(),
     getCustomBranding: jest.fn(),
   };
+  setupContract.getBasePath.mockReturnValue('/base-path');
+  setupContract.getServerBasePath.mockReturnValue('/server-base-path');
+  setupContract.getAssetsHrefBase.mockReturnValue('/assets-base-path');
   setupContract.getCspConfig.mockReturnValue({ warnLegacyBrowsers: true });
   setupContract.getExternalUrlConfig.mockReturnValue({ policy: [] });
   setupContract.getKibanaVersion.mockReturnValue('kibanaVersion');
diff --git a/packages/core/injected-metadata/core-injected-metadata-common-internal/src/types.ts b/packages/core/injected-metadata/core-injected-metadata-common-internal/src/types.ts
index 944ec94554b256..dd9d6bced5c989 100644
--- a/packages/core/injected-metadata/core-injected-metadata-common-internal/src/types.ts
+++ b/packages/core/injected-metadata/core-injected-metadata-common-internal/src/types.ts
@@ -42,6 +42,7 @@ export interface InjectedMetadata {
   basePath: string;
   serverBasePath: string;
   publicBaseUrl?: string;
+  assetsHrefBase: string;
   clusterInfo: InjectedMetadataClusterInfo;
   env: {
     mode: EnvironmentMode;
diff --git a/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_setup.ts b/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_setup.ts
index 9ef51b986458cb..396c834082422c 100644
--- a/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_setup.ts
+++ b/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_setup.ts
@@ -9,10 +9,12 @@
 import type { CoreSetup } from '@kbn/core-lifecycle-browser';
 import type { InternalApplicationSetup } from '@kbn/core-application-browser-internal';
 import type { InternalInjectedMetadataSetup } from '@kbn/core-injected-metadata-browser-internal';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 
 /** @internal */
 export interface InternalCoreSetup
-  extends Omit<CoreSetup, 'application' | 'plugins' | 'getStartServices'> {
+  extends Omit<CoreSetup, 'application' | 'plugins' | 'getStartServices' | 'http'> {
   application: InternalApplicationSetup;
   injectedMetadata: InternalInjectedMetadataSetup;
+  http: InternalHttpSetup;
 }
diff --git a/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_start.ts b/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_start.ts
index f6b20626cd561e..1806f52b8292d1 100644
--- a/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_start.ts
+++ b/packages/core/lifecycle/core-lifecycle-browser-internal/src/internal_core_start.ts
@@ -9,9 +9,11 @@
 import type { CoreStart } from '@kbn/core-lifecycle-browser';
 import type { InternalApplicationStart } from '@kbn/core-application-browser-internal';
 import type { InternalInjectedMetadataStart } from '@kbn/core-injected-metadata-browser-internal';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 
 /** @internal */
-export interface InternalCoreStart extends Omit<CoreStart, 'application' | 'plugins'> {
+export interface InternalCoreStart extends Omit<CoreStart, 'application' | 'plugins' | 'http'> {
   application: InternalApplicationStart;
   injectedMetadata: InternalInjectedMetadataStart;
+  http: InternalHttpStart;
 }
diff --git a/packages/core/lifecycle/core-lifecycle-browser-internal/tsconfig.json b/packages/core/lifecycle/core-lifecycle-browser-internal/tsconfig.json
index 5f6dcff8fd678e..7d5c7fd5c06fd0 100644
--- a/packages/core/lifecycle/core-lifecycle-browser-internal/tsconfig.json
+++ b/packages/core/lifecycle/core-lifecycle-browser-internal/tsconfig.json
@@ -14,7 +14,8 @@
   "kbn_references": [
     "@kbn/core-lifecycle-browser",
     "@kbn/core-application-browser-internal",
-    "@kbn/core-injected-metadata-browser-internal"
+    "@kbn/core-injected-metadata-browser-internal",
+    "@kbn/core-http-browser-internal"
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts
index dfa2144c280150..60b415b1b2a2b2 100644
--- a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts
+++ b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts
@@ -365,3 +365,90 @@ test('format() meta can not override tracing properties', () => {
     transaction: { id: 'transaction_override' },
   });
 });
+
+test('format() meta.toJSON() is used if own property', () => {
+  const layout = new JsonLayout();
+  expect(
+    JSON.parse(
+      layout.format({
+        message: 'foo',
+        timestamp,
+        level: LogLevel.Debug,
+        context: 'bar',
+        pid: 3,
+        meta: {
+          server: {
+            address: 'localhost',
+          },
+          service: {
+            version: '1',
+          },
+          // @ts-expect-error cannot override @timestamp
+          toJSON() {
+            return {
+              server: {
+                address: 'localhost',
+              },
+            };
+          },
+        },
+      })
+    )
+  ).toStrictEqual({
+    ecs: { version: expect.any(String) },
+    '@timestamp': '2012-02-01T09:30:22.011-05:00',
+    message: 'foo',
+    log: {
+      level: 'DEBUG',
+      logger: 'bar',
+    },
+    process: {
+      pid: 3,
+    },
+    server: {
+      address: 'localhost',
+    },
+  });
+});
+
+test('format() meta.toJSON() is used if present on prototype', () => {
+  class SomeClass {
+    foo: string = 'bar';
+    hello: string = 'dolly';
+
+    toJSON() {
+      return {
+        foo: this.foo,
+      };
+    }
+  }
+
+  const someInstance = new SomeClass();
+
+  const layout = new JsonLayout();
+  expect(
+    JSON.parse(
+      layout.format({
+        message: 'foo',
+        timestamp,
+        level: LogLevel.Debug,
+        context: 'bar',
+        pid: 3,
+        // @ts-expect-error meta is not of the correct type
+        meta: someInstance,
+      })
+    )
+  ).toStrictEqual({
+    ecs: { version: expect.any(String) },
+    '@timestamp': '2012-02-01T09:30:22.011-05:00',
+    message: 'foo',
+    log: {
+      level: 'DEBUG',
+      logger: 'bar',
+    },
+    process: {
+      pid: 3,
+    },
+    foo: 'bar',
+  });
+});
diff --git a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts
index cd41b7675464e4..43b906fa8407cf 100644
--- a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts
+++ b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts
@@ -58,7 +58,13 @@ export class JsonLayout implements Layout {
       trace: traceId ? { id: traceId } : undefined,
       transaction: transactionId ? { id: transactionId } : undefined,
     };
-    const output = record.meta ? merge({ ...record.meta }, log) : log;
+
+    let output = log;
+    if (record.meta) {
+      // @ts-expect-error toJSON not defined on `LogMeta`, but some structured meta can have it defined
+      const serializedMeta = record.meta.toJSON ? record.meta.toJSON() : { ...record.meta };
+      output = merge(serializedMeta, log);
+    }
 
     return JSON.stringify(output);
   }
diff --git a/packages/core/plugins/core-plugins-browser-internal/src/plugin_context.ts b/packages/core/plugins/core-plugins-browser-internal/src/plugin_context.ts
index 604eb86093758c..94ada11ac5b248 100644
--- a/packages/core/plugins/core-plugins-browser-internal/src/plugin_context.ts
+++ b/packages/core/plugins/core-plugins-browser-internal/src/plugin_context.ts
@@ -82,7 +82,13 @@ export function createPluginSetupContext<
     customBranding: deps.customBranding,
     fatalErrors: deps.fatalErrors,
     executionContext: deps.executionContext,
-    http: deps.http,
+    http: {
+      ...deps.http,
+      staticAssets: {
+        getPluginAssetHref: (assetPath: string) =>
+          deps.http.staticAssets.getPluginAssetHref(plugin.name, assetPath),
+      },
+    },
     notifications: deps.notifications,
     uiSettings: deps.uiSettings,
     settings: deps.settings,
@@ -133,7 +139,13 @@ export function createPluginStartContext<
     customBranding: deps.customBranding,
     docLinks: deps.docLinks,
     executionContext: deps.executionContext,
-    http: deps.http,
+    http: {
+      ...deps.http,
+      staticAssets: {
+        getPluginAssetHref: (assetPath: string) =>
+          deps.http.staticAssets.getPluginAssetHref(plugin.name, assetPath),
+      },
+    },
     chrome: omit(deps.chrome, 'getComponent'),
     i18n: deps.i18n,
     notifications: deps.notifications,
diff --git a/packages/core/plugins/core-plugins-browser-internal/src/plugins_service.test.ts b/packages/core/plugins/core-plugins-browser-internal/src/plugins_service.test.ts
index 00c056a20d87d8..c1c612d3872048 100644
--- a/packages/core/plugins/core-plugins-browser-internal/src/plugins_service.test.ts
+++ b/packages/core/plugins/core-plugins-browser-internal/src/plugins_service.test.ts
@@ -104,6 +104,10 @@ describe('PluginsService', () => {
       application: expect.any(Object),
       plugins: expect.any(Object),
       getStartServices: expect.any(Function),
+      http: {
+        ...mockSetupDeps.http,
+        staticAssets: expect.any(Object),
+      },
     };
     // @ts-expect-error this file was not being type checked properly in the past, error is legit
     mockStartDeps = {
@@ -128,6 +132,10 @@ describe('PluginsService', () => {
       application: expect.any(Object),
       plugins: expect.any(Object),
       chrome: omit(mockStartDeps.chrome, 'getComponent'),
+      http: {
+        ...mockStartDeps.http,
+        staticAssets: expect.any(Object),
+      },
     };
 
     // Reset these for each test.
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugin.test.ts b/packages/core/plugins/core-plugins-server-internal/src/plugin.test.ts
index 5b11139397a124..128c6747531290 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugin.test.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugin.test.ts
@@ -157,7 +157,7 @@ describe('`constructor` correctly sets non-external source', () => {
   });
 });
 
-test('`setup` fails if `plugin` initializer is not exported', () => {
+test('`setup` fails if the plugin has not been initialized', () => {
   const manifest = createPluginManifest();
   const opaqueId = Symbol();
   const plugin = new PluginWrapper({
@@ -176,11 +176,32 @@ test('`setup` fails if `plugin` initializer is not exported', () => {
   expect(() =>
     plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {})
   ).toThrowErrorMatchingInlineSnapshot(
+    `"The plugin is not initialized. Call the init method first."`
+  );
+});
+
+test('`init` fails if `plugin` initializer is not exported', async () => {
+  const manifest = createPluginManifest();
+  const opaqueId = Symbol();
+  const plugin = new PluginWrapper({
+    path: 'plugin-without-initializer-path',
+    manifest,
+    opaqueId,
+    initializerContext: createPluginInitializerContext({
+      coreContext,
+      opaqueId,
+      manifest,
+      instanceInfo,
+      nodeInfo,
+    }),
+  });
+
+  await expect(() => plugin.init()).rejects.toThrowErrorMatchingInlineSnapshot(
     `"Plugin \\"some-plugin-id\\" does not export \\"plugin\\" definition (plugin-without-initializer-path)."`
   );
 });
 
-test('`setup` fails if plugin initializer is not a function', () => {
+test('`init` fails if plugin initializer is not a function', async () => {
   const manifest = createPluginManifest();
   const opaqueId = Symbol();
   const plugin = new PluginWrapper({
@@ -196,14 +217,12 @@ test('`setup` fails if plugin initializer is not a function', () => {
     }),
   });
 
-  expect(() =>
-    plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {})
-  ).toThrowErrorMatchingInlineSnapshot(
+  await expect(() => plugin.init()).rejects.toThrowErrorMatchingInlineSnapshot(
     `"Definition of plugin \\"some-plugin-id\\" should be a function (plugin-with-wrong-initializer-path)."`
   );
 });
 
-test('`setup` fails if initializer does not return object', () => {
+test('`init` fails if initializer does not return object', async () => {
   const manifest = createPluginManifest();
   const opaqueId = Symbol();
   const plugin = new PluginWrapper({
@@ -219,16 +238,14 @@ test('`setup` fails if initializer does not return object', () => {
     }),
   });
 
-  mockPluginInitializer.mockReturnValue(null);
+  mockPluginInitializer.mockResolvedValue(null);
 
-  expect(() =>
-    plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {})
-  ).toThrowErrorMatchingInlineSnapshot(
+  await expect(() => plugin.init()).rejects.toThrowErrorMatchingInlineSnapshot(
     `"Initializer for plugin \\"some-plugin-id\\" is expected to return plugin instance, but returned \\"null\\"."`
   );
 });
 
-test('`setup` fails if object returned from initializer does not define `setup` function', () => {
+test('`init` fails if object returned from initializer does not define `setup` function', async () => {
   const manifest = createPluginManifest();
   const opaqueId = Symbol();
   const plugin = new PluginWrapper({
@@ -245,11 +262,9 @@ test('`setup` fails if object returned from initializer does not define `setup`
   });
 
   const mockPluginInstance = { run: jest.fn() };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
 
-  expect(() =>
-    plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {})
-  ).toThrowErrorMatchingInlineSnapshot(
+  await expect(() => plugin.init()).rejects.toThrowErrorMatchingInlineSnapshot(
     `"Instance of plugin \\"some-plugin-id\\" does not define \\"setup\\" function."`
   );
 });
@@ -272,7 +287,9 @@ test('`setup` initializes plugin and calls appropriate lifecycle hook', async ()
   });
 
   const mockPluginInstance = { setup: jest.fn().mockResolvedValue({ contract: 'yes' }) };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
+
+  await plugin.init();
 
   const setupContext = createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver });
   const setupDependencies = { 'some-required-dep': { contract: 'no' } };
@@ -323,8 +340,9 @@ test('`start` fails invoked for the `preboot` plugin', async () => {
   });
 
   const mockPluginInstance = { setup: jest.fn() };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
 
+  await plugin.init();
   await plugin.setup({} as any, {} as any);
 
   expect(() => plugin.start({} as any, {} as any)).toThrowErrorMatchingInlineSnapshot(
@@ -355,8 +373,9 @@ test('`start` calls plugin.start with context and dependencies', async () => {
     setup: jest.fn(),
     start: jest.fn().mockResolvedValue(pluginStartContract),
   };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
 
+  await plugin.init();
   await plugin.setup({} as any, {} as any);
 
   const startContract = await plugin.start(context, deps);
@@ -399,8 +418,9 @@ test("`start` resolves `startDependencies` Promise after plugin's start", async
       return pluginStartContract;
     },
   };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
 
+  await plugin.init();
   await plugin.setup({} as any, {} as any);
 
   const startDependenciesCheck = plugin.startDependencies.then((resolvedStartDeps) => {
@@ -429,7 +449,7 @@ test('`stop` fails if plugin is not set up', async () => {
   });
 
   const mockPluginInstance = { setup: jest.fn(), stop: jest.fn() };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
 
   await expect(plugin.stop()).rejects.toMatchInlineSnapshot(
     `[Error: Plugin "some-plugin-id" can't be stopped since it isn't set up.]`
@@ -453,7 +473,8 @@ test('`stop` does nothing if plugin does not define `stop` function', async () =
     }),
   });
 
-  mockPluginInitializer.mockReturnValue({ setup: jest.fn() });
+  mockPluginInitializer.mockResolvedValue({ setup: jest.fn() });
+  await plugin.init();
   await plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {});
 
   await expect(plugin.stop()).resolves.toBeUndefined();
@@ -476,7 +497,8 @@ test('`stop` calls `stop` defined by the plugin instance', async () => {
   });
 
   const mockPluginInstance = { setup: jest.fn(), stop: jest.fn() };
-  mockPluginInitializer.mockReturnValue(mockPluginInstance);
+  mockPluginInitializer.mockResolvedValue(mockPluginInstance);
+  await plugin.init();
   await plugin.setup(createPluginSetupContext({ deps: setupDeps, plugin, runtimeResolver }), {});
 
   await expect(plugin.stop()).resolves.toBeUndefined();
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugin.ts b/packages/core/plugins/core-plugins-server-internal/src/plugin.ts
index 3a8015aad4d59a..7877886198cf5e 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugin.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugin.ts
@@ -87,6 +87,10 @@ export class PluginWrapper<
     this.includesUiPlugin = params.manifest.ui;
   }
 
+  public async init() {
+    this.instance = await this.createPluginInstance();
+  }
+
   /**
    * Instantiates plugin and calls `setup` function exposed by the plugin initializer.
    * @param setupContext Context that consists of various core services tailored specifically
@@ -98,7 +102,9 @@ export class PluginWrapper<
     setupContext: CoreSetup<TPluginsStart> | CorePreboot,
     plugins: TPluginsSetup
   ): TSetup | Promise<TSetup> {
-    this.instance = this.createPluginInstance();
+    if (!this.instance) {
+      throw new Error('The plugin is not initialized. Call the init method first.');
+    }
 
     if (this.isPrebootPluginInstance(this.instance)) {
       return this.instance.setup(setupContext as CorePreboot, plugins);
@@ -170,7 +176,7 @@ export class PluginWrapper<
     return configDescriptor;
   }
 
-  private createPluginInstance() {
+  private async createPluginInstance() {
     this.log.debug('Initializing plugin');
 
     // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -186,7 +192,7 @@ export class PluginWrapper<
       throw new Error(`Definition of plugin "${this.name}" should be a function (${this.path}).`);
     }
 
-    const instance = initializer(this.initializerContext);
+    const instance = await initializer(this.initializerContext);
     if (!instance || typeof instance !== 'object') {
       throw new Error(
         `Initializer for plugin "${
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts b/packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts
index 8d493e78aae8be..c3ed7f6a433b9d 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts
@@ -235,6 +235,10 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>({
       registerOnPostAuth: deps.http.registerOnPostAuth,
       registerOnPreResponse: deps.http.registerOnPreResponse,
       basePath: deps.http.basePath,
+      staticAssets: {
+        getPluginAssetHref: (assetPath: string) =>
+          deps.http.staticAssets.getPluginAssetHref(plugin.name, assetPath),
+      },
       csp: deps.http.csp,
       getServerInfo: deps.http.getServerInfo,
     },
@@ -324,6 +328,10 @@ export function createPluginStartContext<TPlugin, TPluginDependencies>({
       auth: deps.http.auth,
       basePath: deps.http.basePath,
       getServerInfo: deps.http.getServerInfo,
+      staticAssets: {
+        getPluginAssetHref: (assetPath: string) =>
+          deps.http.staticAssets.getPluginAssetHref(plugin.name, assetPath),
+      },
     },
     savedObjects: {
       getScopedClient: deps.savedObjects.getScopedClient,
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugins_service.ts b/packages/core/plugins/core-plugins-server-internal/src/plugins_service.ts
index bfa6b6ab5a222d..03327b1d7be522 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugins_service.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugins_service.ts
@@ -201,7 +201,7 @@ export class PluginsService
     this.log.debug('Stopping plugins service');
 
     if (!this.arePrebootPluginsStopped) {
-      this.arePrebootPluginsStopped = false;
+      this.arePrebootPluginsStopped = true;
       await this.prebootPluginsSystem.stopPlugins();
     }
 
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugins_system.test.ts b/packages/core/plugins/core-plugins-server-internal/src/plugins_system.test.ts
index 42ea7012745f28..5406b60cb09e81 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugins_system.test.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugins_system.test.ts
@@ -43,7 +43,7 @@ function createPlugin(
     type?: PluginType;
   } = {}
 ): PluginWrapper<any, any> {
-  return new PluginWrapper<any, any>({
+  const plugin = new PluginWrapper<any, any>({
     path: 'some-path',
     manifest: {
       id,
@@ -62,6 +62,8 @@ function createPlugin(
     opaqueId: Symbol(id),
     initializerContext: { logger } as any,
   });
+  jest.spyOn(plugin, 'init').mockResolvedValue();
+  return plugin;
 }
 
 const prebootDeps = coreInternalLifecycleMock.createInternalPreboot();
@@ -602,7 +604,10 @@ describe('setup', () => {
     mockCreatePluginSetupContext.mockImplementation(() => ({}));
 
     const promise = pluginsSystem.setupPlugins(setupDeps);
-    jest.runAllTimers();
+    process.nextTick(() => {
+      // let the await init go through. then simulate the timeout
+      jest.runAllTimers();
+    });
 
     await expect(promise).rejects.toMatchInlineSnapshot(
       `[Error: Setup lifecycle of "timeout-setup" plugin wasn't completed in 10sec. Consider disabling the plugin and re-start.]`
diff --git a/packages/core/plugins/core-plugins-server-internal/src/plugins_system.ts b/packages/core/plugins/core-plugins-server-internal/src/plugins_system.ts
index a7ca6d64da5455..6b5d14846b7548 100644
--- a/packages/core/plugins/core-plugins-server-internal/src/plugins_system.ts
+++ b/packages/core/plugins/core-plugins-server-internal/src/plugins_system.ts
@@ -131,6 +131,7 @@ export class PluginsSystem<T extends PluginType> {
         });
       }
 
+      await plugin.init();
       let contract: unknown;
       const contractOrPromise = plugin.setup(pluginSetupContext, pluginDepContracts);
       if (isPromise(contractOrPromise)) {
diff --git a/packages/core/plugins/core-plugins-server/src/types.ts b/packages/core/plugins/core-plugins-server/src/types.ts
index e518bd7db7eb6e..297bdb147c2928 100644
--- a/packages/core/plugins/core-plugins-server/src/types.ts
+++ b/packages/core/plugins/core-plugins-server/src/types.ts
@@ -473,7 +473,8 @@ export type PluginInitializer<
   TPluginsStart extends object = object
 > = (
   core: PluginInitializerContext
-) =>
+) => Promise<
   | Plugin<TSetup, TStart, TPluginsSetup, TPluginsStart>
   | PrebootPlugin<TSetup, TPluginsSetup>
-  | AsyncPlugin<TSetup, TStart, TPluginsSetup, TPluginsStart>;
+  | AsyncPlugin<TSetup, TStart, TPluginsSetup, TPluginsStart>
+>;
diff --git a/packages/core/rendering/core-rendering-server-internal/src/__snapshots__/rendering_service.test.ts.snap b/packages/core/rendering/core-rendering-server-internal/src/__snapshots__/rendering_service.test.ts.snap
index d444959de3c9e8..535624e4a83202 100644
--- a/packages/core/rendering/core-rendering-server-internal/src/__snapshots__/rendering_service.test.ts.snap
+++ b/packages/core/rendering/core-rendering-server-internal/src/__snapshots__/rendering_service.test.ts.snap
@@ -3,6 +3,7 @@
 exports[`RenderingService preboot() render() renders "core" CDN url injected 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "http://foo.bar:1773",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -70,6 +71,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" page 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -133,6 +135,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" page driven by settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -200,6 +203,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" page for blank basepath 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -263,6 +267,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" page for unauthenticated requests 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -326,6 +331,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" page with global settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -393,6 +399,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" with excluded global user settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -456,6 +463,7 @@ Object {
 exports[`RenderingService preboot() render() renders "core" with excluded user settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -519,6 +527,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" CDN url injected 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -591,6 +600,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" page 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -654,6 +664,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" page driven by settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -726,6 +737,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" page for blank basepath 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -794,6 +806,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" page for unauthenticated requests 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -857,6 +870,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" page with global settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -929,6 +943,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" with excluded global user settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
@@ -997,6 +1012,7 @@ Object {
 exports[`RenderingService setup() render() renders "core" with excluded user settings 1`] = `
 Object {
   "anonymousStatusPage": false,
+  "assetsHrefBase": "/mock-server-basepath",
   "basePath": "/mock-server-basepath",
   "branch": Any<String>,
   "buildNumber": Any<Number>,
diff --git a/packages/core/rendering/core-rendering-server-internal/src/rendering_service.tsx b/packages/core/rendering/core-rendering-server-internal/src/rendering_service.tsx
index 1791f55e563b65..f5bb1f5fa115f2 100644
--- a/packages/core/rendering/core-rendering-server-internal/src/rendering_service.tsx
+++ b/packages/core/rendering/core-rendering-server-internal/src/rendering_service.tsx
@@ -209,6 +209,7 @@ export class RenderingService {
         basePath,
         serverBasePath,
         publicBaseUrl,
+        assetsHrefBase: staticAssetsHrefBase,
         env,
         clusterInfo,
         anonymousStatusPage: status?.isStatusPageAnonymous() ?? false,
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search/aggregations/validation.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search/aggregations/validation.ts
index d5dfbb8e8cb1dc..d058feb31ba78b 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search/aggregations/validation.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search/aggregations/validation.ts
@@ -98,13 +98,14 @@ const validateAggregationContainer = (
 ) => {
   return Object.entries(container).reduce<estypes.AggregationsAggregationContainer>(
     (memo, [aggName, aggregation]) => {
-      if (aggregationKeys.includes(aggName)) {
-        return memo;
+      if (!aggregationKeys.includes(aggName)) {
+        (memo as Record<string, unknown>)[aggName] = validateAggregationType(
+          aggName,
+          aggregation,
+          childContext(context, aggName)
+        );
       }
-      return {
-        ...memo,
-        [aggName]: validateAggregationType(aggName, aggregation, childContext(context, aggName)),
-      };
+      return memo;
     },
     {}
   );
diff --git a/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts b/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts
index 0493652b1192f3..a5e112ca2aa745 100644
--- a/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts
+++ b/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts
@@ -7,7 +7,8 @@
  */
 
 import { pick, throttle, cloneDeep } from 'lodash';
-import type { HttpSetup, HttpFetchOptions } from '@kbn/core-http-browser';
+import type { HttpFetchOptions } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 import type { SavedObject, SavedObjectTypeIdTuple } from '@kbn/core-saved-objects-common';
 import type {
   SavedObjectsBulkResolveResponse as SavedObjectsBulkResolveResponseServer,
@@ -106,7 +107,7 @@ const getObjectsToResolve = (queue: BatchResolveQueueEntry[]) => {
  * @deprecated See https://github.com/elastic/kibana/issues/149098
  */
 export class SavedObjectsClient implements SavedObjectsClientContract {
-  private http: HttpSetup;
+  private http: InternalHttpSetup;
   private batchGetQueue: BatchGetQueueEntry[];
   private batchResolveQueue: BatchResolveQueueEntry[];
 
@@ -180,7 +181,7 @@ export class SavedObjectsClient implements SavedObjectsClientContract {
   );
 
   /** @internal */
-  constructor(http: HttpSetup) {
+  constructor(http: InternalHttpSetup) {
     this.http = http;
     this.batchGetQueue = [];
     this.batchResolveQueue = [];
diff --git a/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_service.ts b/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_service.ts
index 7cef8a1c390575..f806dc6b69ef0e 100644
--- a/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_service.ts
+++ b/packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_service.ts
@@ -7,7 +7,7 @@
  */
 
 import type { CoreService } from '@kbn/core-base-browser-internal';
-import type { HttpStart } from '@kbn/core-http-browser';
+import type { InternalHttpStart } from '@kbn/core-http-browser-internal';
 import type { SavedObjectsStart } from '@kbn/core-saved-objects-browser';
 import { SavedObjectsClient } from './saved_objects_client';
 
@@ -17,7 +17,7 @@ import { SavedObjectsClient } from './saved_objects_client';
 export class SavedObjectsService implements CoreService<void, SavedObjectsStart> {
   public async setup() {}
 
-  public async start({ http }: { http: HttpStart }): Promise<SavedObjectsStart> {
+  public async start({ http }: { http: InternalHttpStart }): Promise<SavedObjectsStart> {
     return { client: new SavedObjectsClient(http) };
   }
 
diff --git a/packages/core/saved-objects/core-saved-objects-browser-internal/tsconfig.json b/packages/core/saved-objects/core-saved-objects-browser-internal/tsconfig.json
index a29dbf58b41173..d9b414c39220e6 100644
--- a/packages/core/saved-objects/core-saved-objects-browser-internal/tsconfig.json
+++ b/packages/core/saved-objects/core-saved-objects-browser-internal/tsconfig.json
@@ -19,6 +19,7 @@
     "@kbn/core-saved-objects-api-server",
     "@kbn/core-saved-objects-api-browser",
     "@kbn/core-http-browser-mocks",
+    "@kbn/core-http-browser-internal",
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/ui-settings/core-ui-settings-browser-internal/src/settings_service.ts b/packages/core/ui-settings/core-ui-settings-browser-internal/src/settings_service.ts
index edda603644fa2c..202f8ceb1206dd 100644
--- a/packages/core/ui-settings/core-ui-settings-browser-internal/src/settings_service.ts
+++ b/packages/core/ui-settings/core-ui-settings-browser-internal/src/settings_service.ts
@@ -9,14 +9,14 @@
 import { Subject } from 'rxjs';
 
 import type { InternalInjectedMetadataSetup } from '@kbn/core-injected-metadata-browser-internal';
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 import type { SettingsStart, SettingsSetup } from '@kbn/core-ui-settings-browser';
 import { UiSettingsApi } from './ui_settings_api';
 import { UiSettingsClient } from './ui_settings_client';
 import { UiSettingsGlobalClient } from './ui_settings_global_client';
 
 export interface SettingsServiceDeps {
-  http: HttpSetup;
+  http: InternalHttpSetup;
   injectedMetadata: InternalInjectedMetadataSetup;
 }
 
diff --git a/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_api.ts b/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_api.ts
index c96232b9f9b488..ac469734609c81 100644
--- a/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_api.ts
+++ b/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_api.ts
@@ -7,7 +7,7 @@
  */
 
 import { BehaviorSubject } from 'rxjs';
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 
 import type { UiSettingsState } from '@kbn/core-ui-settings-browser';
 import { UiSettingsScope } from '@kbn/core-ui-settings-common';
@@ -37,7 +37,7 @@ export class UiSettingsApi {
 
   private readonly loadingCount$ = new BehaviorSubject(0);
 
-  constructor(private readonly http: HttpSetup) {}
+  constructor(private readonly http: InternalHttpSetup) {}
 
   /**
    * Adds a key+value that will be sent to the server ASAP. If a request is
diff --git a/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_service.ts b/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_service.ts
index c531d18aded13d..5827919f21ad57 100644
--- a/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_service.ts
+++ b/packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_service.ts
@@ -9,14 +9,14 @@
 import { Subject } from 'rxjs';
 
 import type { InternalInjectedMetadataSetup } from '@kbn/core-injected-metadata-browser-internal';
-import type { HttpSetup } from '@kbn/core-http-browser';
+import type { InternalHttpSetup } from '@kbn/core-http-browser-internal';
 
 import type { IUiSettingsClient } from '@kbn/core-ui-settings-browser';
 import { UiSettingsApi } from './ui_settings_api';
 import { UiSettingsClient } from './ui_settings_client';
 
 export interface UiSettingsServiceDeps {
-  http: HttpSetup;
+  http: InternalHttpSetup;
   injectedMetadata: InternalInjectedMetadataSetup;
 }
 
diff --git a/packages/core/ui-settings/core-ui-settings-browser-internal/tsconfig.json b/packages/core/ui-settings/core-ui-settings-browser-internal/tsconfig.json
index 0beed2d6ddfb06..bcedc9db9175e0 100644
--- a/packages/core/ui-settings/core-ui-settings-browser-internal/tsconfig.json
+++ b/packages/core/ui-settings/core-ui-settings-browser-internal/tsconfig.json
@@ -12,12 +12,12 @@
   ],
   "kbn_references": [
     "@kbn/core-test-helpers-http-setup-browser",
-    "@kbn/core-http-browser",
     "@kbn/core-ui-settings-browser",
     "@kbn/core-ui-settings-common",
     "@kbn/core-http-browser-mocks",
     "@kbn/core-injected-metadata-browser-mocks",
     "@kbn/core-injected-metadata-browser-internal",
+    "@kbn/core-http-browser-internal",
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/home/sample_data_card/src/sample_data_card.tsx b/packages/home/sample_data_card/src/sample_data_card.tsx
index a8da0a7494da4f..a952431c50971d 100644
--- a/packages/home/sample_data_card/src/sample_data_card.tsx
+++ b/packages/home/sample_data_card/src/sample_data_card.tsx
@@ -6,11 +6,10 @@
  * Side Public License, v 1.
  */
 
-import React, { useMemo } from 'react';
+import React from 'react';
 import { useEuiTheme } from '@elastic/eui';
 
 import type { SampleDataSet } from '@kbn/home-sample-data-types';
-import { useServices } from './services';
 import { SampleDataCard as Component, Props as ComponentProps } from './sample_data_card.component';
 
 /**
@@ -27,12 +26,10 @@ export interface Props extends Pick<ComponentProps, 'onStatusChange'> {
  * function.
  */
 export const SampleDataCard = ({ sampleDataSet, onStatusChange }: Props) => {
-  const { addBasePath } = useServices();
   const { colorMode } = useEuiTheme();
   const { darkPreviewImagePath, previewImagePath } = sampleDataSet;
-  const path =
+  const imagePath =
     colorMode === 'DARK' && darkPreviewImagePath ? darkPreviewImagePath : previewImagePath;
-  const imagePath = useMemo(() => addBasePath(path), [addBasePath, path]);
 
   return <Component {...{ sampleDataSet, imagePath, onStatusChange }} />;
 };
diff --git a/packages/kbn-apm-synthtrace-client/index.ts b/packages/kbn-apm-synthtrace-client/index.ts
index 04bef11e3f6573..c1f2bd25750c08 100644
--- a/packages/kbn-apm-synthtrace-client/index.ts
+++ b/packages/kbn-apm-synthtrace-client/index.ts
@@ -33,3 +33,4 @@ export { dedot } from './src/lib/utils/dedot';
 export { generateLongId, generateShortId } from './src/lib/utils/generate_id';
 export { appendHash, hashKeysOf } from './src/lib/utils/hash';
 export type { ESDocumentWithOperation, SynthtraceESAction, SynthtraceGenerator } from './src/types';
+export { log, type LogDocument } from './src/lib/logs';
diff --git a/packages/kbn-apm-synthtrace-client/kibana.jsonc b/packages/kbn-apm-synthtrace-client/kibana.jsonc
index 99055f3da4fe9c..a50ec2be221d0e 100644
--- a/packages/kbn-apm-synthtrace-client/kibana.jsonc
+++ b/packages/kbn-apm-synthtrace-client/kibana.jsonc
@@ -2,5 +2,5 @@
   "type": "shared-common",
   "id": "@kbn/apm-synthtrace-client",
   "devOnly": true,
-  "owner": "@elastic/obs-ux-infra_services-team"
+  "owner": ["@elastic/obs-ux-infra_services-team", "@elastic/obs-ux-logs-team"]
 }
diff --git a/packages/kbn-apm-synthtrace-client/src/lib/logs/index.ts b/packages/kbn-apm-synthtrace-client/src/lib/logs/index.ts
new file mode 100644
index 00000000000000..8a1476cd58277f
--- /dev/null
+++ b/packages/kbn-apm-synthtrace-client/src/lib/logs/index.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Fields } from '../entity';
+import { Serializable } from '../serializable';
+
+export type LogDocument = Fields &
+  Partial<{
+    'input.type': string;
+    'log.file.path'?: string;
+    'service.name'?: string;
+    'data_stream.namespace': string;
+    'data_stream.type': string;
+    'data_stream.dataset': string;
+    message?: string;
+    'event.dataset': string;
+    'log.level'?: string;
+    'host.name'?: string;
+    'trace.id'?: string;
+    'agent.name'?: string;
+    'orchestrator.cluster.name'?: string;
+    'orchestrator.cluster.id'?: string;
+    'orchestrator.resource.id'?: string;
+    'cloud.provider'?: string;
+    'cloud.region'?: string;
+    'cloud.availability_zone'?: string;
+    'cloud.project.id'?: string;
+    'cloud.instance.id'?: string;
+  }>;
+
+class Log extends Serializable<LogDocument> {
+  service(name: string) {
+    this.fields['service.name'] = name;
+    return this;
+  }
+
+  namespace(value: string) {
+    this.fields['data_stream.namespace'] = value;
+    return this;
+  }
+
+  dataset(value: string) {
+    this.fields['data_stream.dataset'] = value;
+    this.fields['event.dataset'] = value;
+    return this;
+  }
+
+  logLevel(level: string) {
+    this.fields['log.level'] = level;
+    return this;
+  }
+
+  message(message: string) {
+    this.fields.message = message;
+    return this;
+  }
+}
+
+function create(): Log {
+  return new Log({
+    'input.type': 'logs',
+    'data_stream.namespace': 'default',
+    'data_stream.type': 'logs',
+    'data_stream.dataset': 'synth',
+    'event.dataset': 'synth',
+    'host.name': 'synth-host',
+  });
+}
+
+export const log = {
+  create,
+};
diff --git a/packages/kbn-apm-synthtrace/README.md b/packages/kbn-apm-synthtrace/README.md
index 6a6d0b726a5e4c..6daad014ff0e52 100644
--- a/packages/kbn-apm-synthtrace/README.md
+++ b/packages/kbn-apm-synthtrace/README.md
@@ -21,6 +21,7 @@ This library can currently be used in two ways:
 - `Instance`: a single instance of a monitored service. E.g., the workload for a monitored service might be spread across multiple containers. An `Instance` object contains fields like `service.node.name` and `container.id`.
 - `Timerange`: an object that will return an array of timestamps based on an interval and a rate. These timestamps can be used to generate events/metricsets.
 - `Transaction`, `Span`, `APMError` and `Metricset`: events/metricsets that occur on an instance. For more background, see the [explanation of the APM data model](https://www.elastic.co/guide/en/apm/get-started/7.15/apm-data-model.html)
+- `Log`: An instance of Log generating Service which supports additional helpers to customise fields like `messages`, `logLevel`
 
 #### Example
 
@@ -109,12 +110,22 @@ node scripts/synthtrace simple_trace.ts --target=http://admin:changeme@localhost
 
 The script will try to automatically find bootstrapped APM indices. **If these indices do not exist, the script will exit with an error. It will not bootstrap the indices itself.**
 
+### Understanding Scenario Files
+
+Scenario files accept 3 arguments, 2 of them optional and 1 mandatory
+
+| Arguments   | Type      | Description                                                                                                                                          |
+|-------------|:----------|------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `generate`  | mandatory | This is the main function responsible for returning the events which will be indexed                                                                 |
+| `bootstrap`  | optional  | In case some setup needs to be done, before the data is generated, this function provides access to all available ES Clients to play with            |
+| `setClient` | optional  | By default the apmEsClient used to generate data. If anyother client like logsEsClient needs to be used instead, this is where it should be returned |
+
 The following options are supported:
 
 ### Connection options
 
 | Option              | Type     | Default | Description                                                                                |
-| ------------------- | -------- | :------ | ------------------------------------------------------------------------------------------ |
+|---------------------|----------|:--------|--------------------------------------------------------------------------------------------|
 | `--target`          | [string] |         | Elasticsearch target                                                                       |
 | `--kibana`          | [string] |         | Kibana target, used to bootstrap datastreams/mappings/templates/settings                   |
 | `--versionOverride` | [string] |         | String to be used for `observer.version`. Defauls to the version of the installed package. |
@@ -129,12 +140,11 @@ Note:
 ### Scenario options
 
 | Option           | Type      | Default | Description                          |
-| ---------------- | --------- | :------ | ------------------------------------ |
+|------------------|-----------|:--------|--------------------------------------|
 | `--from`         | [date]    | `now()` | The start of the time window         |
 | `--to`           | [date]    |         | The end of the time window           |
 | `--live`         | [boolean] |         | Generate and index data continuously |
 | `--scenarioOpts` |           |         | Raw options specific to the scenario |
-
 Note:
 
 - The default `--to` is `15m`.
@@ -143,11 +153,12 @@ Note:
 
 ### Setup options
 
-| Option       | Type      | Default | Description                             |
-| ------------ | --------- | :------ | --------------------------------------- |
-| `--clean`    | [boolean] | `false` | Clean APM data before indexing new data |
-| `--workers`  | [number]  |         | Amount of Node.js worker threads        |
-| `--logLevel` | [enum]    | `info`  | Log level                               |
+| Option       | Type      | Default | Description                                                             |
+|--------------|-----------|:--------|-------------------------------------------------------------------------|
+| `--clean`    | [boolean] | `false` | Clean APM data before indexing new data                                 |
+| `--workers`  | [number]  |         | Amount of Node.js worker threads                                        |
+| `--logLevel` | [enum]    | `info`  | Log level                                                               |
+| `--type`     | [string]  | `apm`   | Type of data to be generated, `log` must be passed when generating logs |
 
 ## Testing
 
diff --git a/packages/kbn-apm-synthtrace/index.ts b/packages/kbn-apm-synthtrace/index.ts
index 921243e67ac6a4..880b97cac2a8f3 100644
--- a/packages/kbn-apm-synthtrace/index.ts
+++ b/packages/kbn-apm-synthtrace/index.ts
@@ -17,6 +17,8 @@ export { AssetsSynthtraceEsClient } from './src/lib/assets/assets_synthtrace_es_
 
 export { MonitoringSynthtraceEsClient } from './src/lib/monitoring/monitoring_synthtrace_es_client';
 
+export { LogsSynthtraceEsClient } from './src/lib/logs/logs_synthtrace_es_client';
+
 export {
   addObserverVersionTransform,
   deleteSummaryFieldTransform,
diff --git a/packages/kbn-apm-synthtrace/kibana.jsonc b/packages/kbn-apm-synthtrace/kibana.jsonc
index 1b3ef5b8461495..9c85fa210bdd92 100644
--- a/packages/kbn-apm-synthtrace/kibana.jsonc
+++ b/packages/kbn-apm-synthtrace/kibana.jsonc
@@ -2,5 +2,5 @@
   "type": "shared-server",
   "id": "@kbn/apm-synthtrace",
   "devOnly": true,
-  "owner": "@elastic/obs-ux-infra_services-team"
+  "owner": ["@elastic/obs-ux-infra_services-team", "@elastic/obs-ux-logs-team"]
 }
diff --git a/packages/kbn-apm-synthtrace/src/cli/scenario.ts b/packages/kbn-apm-synthtrace/src/cli/scenario.ts
index f89d335749326a..0ba4665f0ee0e5 100644
--- a/packages/kbn-apm-synthtrace/src/cli/scenario.ts
+++ b/packages/kbn-apm-synthtrace/src/cli/scenario.ts
@@ -6,17 +6,24 @@
  * Side Public License, v 1.
  */
 
-import { SynthtraceGenerator, Timerange } from '@kbn/apm-synthtrace-client';
-import { Readable } from 'stream';
-import { ApmSynthtraceEsClient } from '../lib/apm/client/apm_synthtrace_es_client';
+import { Timerange } from '@kbn/apm-synthtrace-client';
 import { Logger } from '../lib/utils/create_logger';
 import { RunOptions } from './utils/parse_run_cli_flags';
+import { ApmSynthtraceEsClient, LogsSynthtraceEsClient } from '../..';
+import { ScenarioReturnType } from '../lib/utils/with_client';
 
 type Generate<TFields> = (options: {
   range: Timerange;
-}) => SynthtraceGenerator<TFields> | Array<SynthtraceGenerator<TFields>> | Readable;
+  clients: {
+    apmEsClient: ApmSynthtraceEsClient;
+    logsEsClient: LogsSynthtraceEsClient;
+  };
+}) => ScenarioReturnType<TFields> | Array<ScenarioReturnType<TFields>>;
 
 export type Scenario<TFields> = (options: RunOptions & { logger: Logger }) => Promise<{
-  bootstrap?: (options: { apmEsClient: ApmSynthtraceEsClient }) => Promise<void>;
+  bootstrap?: (options: {
+    apmEsClient: ApmSynthtraceEsClient;
+    logsEsClient: LogsSynthtraceEsClient;
+  }) => Promise<void>;
   generate: Generate<TFields>;
 }>;
diff --git a/packages/kbn-apm-synthtrace/src/cli/utils/bootstrap.ts b/packages/kbn-apm-synthtrace/src/cli/utils/bootstrap.ts
index c12f6fc6beb51e..be0bd7ff6168a2 100644
--- a/packages/kbn-apm-synthtrace/src/cli/utils/bootstrap.ts
+++ b/packages/kbn-apm-synthtrace/src/cli/utils/bootstrap.ts
@@ -7,7 +7,8 @@
  */
 
 import { createLogger } from '../../lib/utils/create_logger';
-import { getEsClient } from './get_es_client';
+import { getApmEsClient } from './get_apm_es_client';
+import { getLogsEsClient } from './get_logs_es_client';
 import { getKibanaClient } from './get_kibana_client';
 import { getServiceUrls } from './get_service_urls';
 import { RunOptions } from './parse_run_cli_flags';
@@ -26,22 +27,30 @@ export async function bootstrap(runOptions: RunOptions) {
 
   const version = runOptions.versionOverride || latestPackageVersion;
 
-  const apmEsClient = getEsClient({
+  const apmEsClient = getApmEsClient({
     target: esUrl,
     logger,
     concurrency: runOptions.concurrency,
     version,
   });
 
+  const logsEsClient = getLogsEsClient({
+    target: esUrl,
+    logger,
+    concurrency: runOptions.concurrency,
+  });
+
   await kibanaClient.installApmPackage(latestPackageVersion);
 
   if (runOptions.clean) {
     await apmEsClient.clean();
+    await logsEsClient.clean();
   }
 
   return {
     logger,
     apmEsClient,
+    logsEsClient,
     version,
     kibanaUrl,
     esUrl,
diff --git a/packages/kbn-apm-synthtrace/src/cli/utils/get_es_client.ts b/packages/kbn-apm-synthtrace/src/cli/utils/get_apm_es_client.ts
similarity index 87%
rename from packages/kbn-apm-synthtrace/src/cli/utils/get_es_client.ts
rename to packages/kbn-apm-synthtrace/src/cli/utils/get_apm_es_client.ts
index e5caf0dcc22bd8..ee350ab3c56d8e 100644
--- a/packages/kbn-apm-synthtrace/src/cli/utils/get_es_client.ts
+++ b/packages/kbn-apm-synthtrace/src/cli/utils/get_apm_es_client.ts
@@ -7,11 +7,11 @@
  */
 
 import { Client } from '@elastic/elasticsearch';
-import { ApmSynthtraceEsClient } from '../../lib/apm/client/apm_synthtrace_es_client';
+import { ApmSynthtraceEsClient } from '../../..';
 import { Logger } from '../../lib/utils/create_logger';
 import { RunOptions } from './parse_run_cli_flags';
 
-export function getEsClient({
+export function getApmEsClient({
   target,
   logger,
   version,
diff --git a/packages/kbn-apm-synthtrace/src/cli/utils/get_logs_es_client.ts b/packages/kbn-apm-synthtrace/src/cli/utils/get_logs_es_client.ts
new file mode 100644
index 00000000000000..8bfcdaef908399
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/cli/utils/get_logs_es_client.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Client } from '@elastic/elasticsearch';
+import { LogsSynthtraceEsClient } from '../../lib/logs/logs_synthtrace_es_client';
+import { Logger } from '../../lib/utils/create_logger';
+import { RunOptions } from './parse_run_cli_flags';
+
+export function getLogsEsClient({
+  target,
+  logger,
+  concurrency,
+}: Pick<RunOptions, 'concurrency'> & {
+  target: string;
+  logger: Logger;
+}) {
+  const client = new Client({
+    node: target,
+  });
+
+  return new LogsSynthtraceEsClient({
+    client,
+    logger,
+    concurrency,
+  });
+}
diff --git a/packages/kbn-apm-synthtrace/src/cli/utils/start_live_data_upload.ts b/packages/kbn-apm-synthtrace/src/cli/utils/start_live_data_upload.ts
index 4fe29e3c949300..669ee9b3e3275c 100644
--- a/packages/kbn-apm-synthtrace/src/cli/utils/start_live_data_upload.ts
+++ b/packages/kbn-apm-synthtrace/src/cli/utils/start_live_data_upload.ts
@@ -14,6 +14,7 @@ import { awaitStream } from '../../lib/utils/wait_until_stream_finished';
 import { bootstrap } from './bootstrap';
 import { getScenario } from './get_scenario';
 import { RunOptions } from './parse_run_cli_flags';
+import { SynthtraceEsClient } from '../../lib/utils/with_client';
 
 export async function startLiveDataUpload({
   runOptions,
@@ -24,7 +25,7 @@ export async function startLiveDataUpload({
 }) {
   const file = runOptions.file;
 
-  const { logger, apmEsClient } = await bootstrap(runOptions);
+  const { logger, apmEsClient, logsEsClient } = await bootstrap(runOptions);
 
   const scenario = await getScenario({ file, logger });
   const { generate } = await scenario({ ...runOptions, logger });
@@ -32,22 +33,22 @@ export async function startLiveDataUpload({
   const bucketSizeInMs = 1000 * 60;
   let requestedUntil = start;
 
-  const stream = new PassThrough({
-    objectMode: true,
-  });
+  let currentStreams: PassThrough[] = [];
+  const cachedStreams: WeakMap<SynthtraceEsClient, PassThrough> = new WeakMap();
 
-  apmEsClient.index(stream);
+  process.on('SIGINT', () => closeStreams());
+  process.on('SIGTERM', () => closeStreams());
+  process.on('SIGQUIT', () => closeStreams());
 
-  function closeStream() {
-    stream.end(() => {
-      process.exit(0);
+  function closeStreams() {
+    currentStreams.forEach((stream) => {
+      stream.end(() => {
+        process.exit(0);
+      });
     });
+    currentStreams = []; // Reset the stream array
   }
 
-  process.on('SIGINT', closeStream);
-  process.on('SIGTERM', closeStream);
-  process.on('SIGQUIT', closeStream);
-
   async function uploadNextBatch() {
     const now = Date.now();
 
@@ -59,22 +60,52 @@ export async function startLiveDataUpload({
         `Requesting ${new Date(bucketFrom).toISOString()} to ${new Date(bucketTo).toISOString()}`
       );
 
-      const next = logger.perf('execute_scenario', () =>
-        generate({ range: timerange(bucketFrom.getTime(), bucketTo.getTime()) })
-      );
+      const generatorsAndClients = generate({
+        range: timerange(bucketFrom.getTime(), bucketTo.getTime()),
+        clients: { logsEsClient, apmEsClient },
+      });
+
+      const generatorsAndClientsArray = castArray(generatorsAndClients);
+
+      const streams = generatorsAndClientsArray.map(({ client }) => {
+        let stream: PassThrough;
+
+        if (cachedStreams.has(client)) {
+          stream = cachedStreams.get(client)!;
+        } else {
+          stream = new PassThrough({ objectMode: true });
+          cachedStreams.set(client, stream);
+          client.index(stream);
+        }
+
+        return stream;
+      });
 
-      const concatenatedStream = castArray(next)
-        .reverse()
-        .reduce<Writable>((prev, current) => {
-          const currentStream = isGeneratorObject(current) ? Readable.from(current) : current;
-          return currentStream.pipe(prev);
-        }, new PassThrough({ objectMode: true }));
+      currentStreams = streams;
 
-      concatenatedStream.pipe(stream, { end: false });
+      const promises = generatorsAndClientsArray.map(({ generator }, i) => {
+        const concatenatedStream = castArray(generator)
+          .reverse()
+          .reduce<Writable>((prev, current) => {
+            const currentStream = isGeneratorObject(current) ? Readable.from(current) : current;
+            return currentStream.pipe(prev);
+          }, new PassThrough({ objectMode: true }));
 
-      await awaitStream(concatenatedStream);
+        concatenatedStream.pipe(streams[i], { end: false });
 
-      await apmEsClient.refresh();
+        return awaitStream(concatenatedStream);
+      });
+
+      await Promise.all(promises);
+
+      logger.info('Indexing completed');
+
+      const refreshPromise = generatorsAndClientsArray.map(async ({ client }) => {
+        await client.refresh();
+      });
+
+      await Promise.all(refreshPromise);
+      logger.info('Refreshing completed');
 
       requestedUntil = bucketTo;
     }
@@ -85,6 +116,7 @@ export async function startLiveDataUpload({
     await delay(bucketSizeInMs);
   } while (true);
 }
+
 async function delay(ms: number) {
   return await new Promise((resolve) => setTimeout(resolve, ms));
 }
diff --git a/packages/kbn-apm-synthtrace/src/cli/utils/synthtrace_worker.ts b/packages/kbn-apm-synthtrace/src/cli/utils/synthtrace_worker.ts
index 7617a9d58dd96f..48a9bd60e5ac17 100644
--- a/packages/kbn-apm-synthtrace/src/cli/utils/synthtrace_worker.ts
+++ b/packages/kbn-apm-synthtrace/src/cli/utils/synthtrace_worker.ts
@@ -7,12 +7,14 @@
  */
 import { parentPort, workerData } from 'worker_threads';
 import pidusage from 'pidusage';
+import { castArray } from 'lodash';
 import { memoryUsage } from 'process';
 import { timerange } from '@kbn/apm-synthtrace-client';
-import { getEsClient } from './get_es_client';
+import { getApmEsClient } from './get_apm_es_client';
 import { getScenario } from './get_scenario';
 import { loggerProxy } from './logger_proxy';
 import { RunOptions } from './parse_run_cli_flags';
+import { getLogsEsClient } from './get_logs_es_client';
 
 export interface WorkerData {
   bucketFrom: Date;
@@ -27,13 +29,19 @@ const { bucketFrom, bucketTo, runOptions, esUrl, version } = workerData as Worke
 
 async function start() {
   const logger = loggerProxy;
-  const apmEsClient = getEsClient({
+  const apmEsClient = getApmEsClient({
     concurrency: runOptions.concurrency,
     target: esUrl,
     logger,
     version,
   });
 
+  const logsEsClient = getLogsEsClient({
+    concurrency: runOptions.concurrency,
+    target: esUrl,
+    logger,
+  });
+
   const file = runOptions.file;
 
   const scenario = await logger.perf('get_scenario', () => getScenario({ file, logger }));
@@ -43,15 +51,17 @@ async function start() {
   const { generate, bootstrap } = await scenario({ ...runOptions, logger });
 
   if (bootstrap) {
-    await bootstrap({ apmEsClient });
+    await bootstrap({ apmEsClient, logsEsClient });
   }
 
   logger.debug('Generating scenario');
 
-  const generators = logger.perf('generate_scenario', () =>
-    generate({ range: timerange(bucketFrom, bucketTo) })
+  const generatorsAndClients = logger.perf('generate_scenario', () =>
+    generate({ range: timerange(bucketFrom, bucketTo), clients: { logsEsClient, apmEsClient } })
   );
 
+  const generatorsAndClientsArray = castArray(generatorsAndClients);
+
   logger.debug('Indexing scenario');
 
   function mb(value: number): string {
@@ -65,8 +75,12 @@ async function start() {
   }, 5000);
 
   await logger.perf('index_scenario', async () => {
-    await apmEsClient.index(generators);
-    await apmEsClient.refresh();
+    const promises = generatorsAndClientsArray.map(async ({ client, generator }) => {
+      await client.index(generator);
+      await client.refresh();
+    });
+
+    await Promise.all(promises);
   });
 }
 
diff --git a/packages/kbn-apm-synthtrace/src/lib/logs/logs_synthtrace_es_client.ts b/packages/kbn-apm-synthtrace/src/lib/logs/logs_synthtrace_es_client.ts
new file mode 100644
index 00000000000000..8d2b32849bd8f2
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/lib/logs/logs_synthtrace_es_client.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Client } from '@elastic/elasticsearch';
+import { ESDocumentWithOperation } from '@kbn/apm-synthtrace-client';
+import { pipeline, Readable, Transform } from 'stream';
+import { LogDocument } from '@kbn/apm-synthtrace-client/src/lib/logs';
+import { SynthtraceEsClient, SynthtraceEsClientOptions } from '../shared/base_client';
+import { getSerializeTransform } from '../shared/get_serialize_transform';
+import { Logger } from '../utils/create_logger';
+
+export type LogsSynthtraceEsClientOptions = Omit<SynthtraceEsClientOptions, 'pipeline'>;
+
+export class LogsSynthtraceEsClient extends SynthtraceEsClient<LogDocument> {
+  constructor(options: { client: Client; logger: Logger } & LogsSynthtraceEsClientOptions) {
+    super({
+      ...options,
+      pipeline: logsPipeline(),
+    });
+    this.dataStreams = ['logs-*-*'];
+  }
+}
+
+function logsPipeline() {
+  return (base: Readable) => {
+    return pipeline(
+      base,
+      getSerializeTransform<LogDocument>(),
+      getRoutingTransform(),
+      (err: unknown) => {
+        if (err) {
+          throw err;
+        }
+      }
+    );
+  };
+}
+
+function getRoutingTransform() {
+  return new Transform({
+    objectMode: true,
+    transform(document: ESDocumentWithOperation<LogDocument>, encoding, callback) {
+      if (
+        'data_stream.type' in document &&
+        'data_stream.dataset' in document &&
+        'data_stream.namespace' in document
+      ) {
+        document._index = `${document['data_stream.type']}-${document['data_stream.dataset']}-${document['data_stream.namespace']}`;
+      } else {
+        throw new Error('Cannot determine index for event');
+      }
+
+      callback(null, document);
+    },
+  });
+}
diff --git a/packages/kbn-apm-synthtrace/src/lib/shared/get_serialize_transform.ts b/packages/kbn-apm-synthtrace/src/lib/shared/get_serialize_transform.ts
index 26edb98429779e..ed93c9502b722d 100644
--- a/packages/kbn-apm-synthtrace/src/lib/shared/get_serialize_transform.ts
+++ b/packages/kbn-apm-synthtrace/src/lib/shared/get_serialize_transform.ts
@@ -9,13 +9,13 @@
 import { ApmFields, Serializable } from '@kbn/apm-synthtrace-client';
 import { Transform } from 'stream';
 
-export function getSerializeTransform() {
-  const buffer: ApmFields[] = [];
+export function getSerializeTransform<TFields = ApmFields>() {
+  const buffer: TFields[] = [];
 
   let cb: (() => void) | undefined;
 
-  function push(stream: Transform, events: ApmFields[], callback?: () => void) {
-    let event: ApmFields | undefined;
+  function push(stream: Transform, events: TFields[], callback?: () => void) {
+    let event: TFields | undefined;
     while ((event = events.shift())) {
       if (!stream.push(event)) {
         buffer.push(...events);
@@ -37,7 +37,7 @@ export function getSerializeTransform() {
         push(this, nextEvents, nextCallback);
       }
     },
-    write(chunk: Serializable<ApmFields>, encoding, callback) {
+    write(chunk: Serializable<TFields>, encoding, callback) {
       push(this, chunk.serialize(), callback);
     },
   });
diff --git a/packages/kbn-apm-synthtrace/src/lib/utils/with_client.ts b/packages/kbn-apm-synthtrace/src/lib/utils/with_client.ts
new file mode 100644
index 00000000000000..68dc780ac64646
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/lib/utils/with_client.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SynthtraceGenerator } from '@kbn/apm-synthtrace-client';
+import { Readable } from 'stream';
+import { ApmSynthtraceEsClient, LogsSynthtraceEsClient } from '../../..';
+
+export type SynthtraceEsClient = ApmSynthtraceEsClient | LogsSynthtraceEsClient;
+export type SynthGenerator<TFields> =
+  | SynthtraceGenerator<TFields>
+  | Array<SynthtraceGenerator<TFields>>
+  | Readable;
+
+export const withClient = <TFields>(
+  client: SynthtraceEsClient,
+  generator: SynthGenerator<TFields>
+) => {
+  return {
+    client,
+    generator,
+  };
+};
+
+export type ScenarioReturnType<TFields> = ReturnType<typeof withClient<TFields>>;
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/agent_config.ts b/packages/kbn-apm-synthtrace/src/scenarios/agent_config.ts
index 7f72e27193756f..e77a16bef6c14f 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/agent_config.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/agent_config.ts
@@ -7,21 +7,25 @@
  */
 import { observer, AgentConfigFields } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
+import { withClient } from '../lib/utils/with_client';
 
 const scenario: Scenario<AgentConfigFields> = async ({ logger }) => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const agentConfig = observer().agentConfig();
 
-      return range
-        .interval('30s')
-        .rate(1)
-        .generator((timestamp) => {
-          const events = logger.perf('generating_agent_config_events', () => {
-            return agentConfig.etag('test-etag').timestamp(timestamp);
-          });
-          return events;
-        });
+      return withClient(
+        apmEsClient,
+        range
+          .interval('30s')
+          .rate(1)
+          .generator((timestamp) => {
+            const events = logger.perf('generating_agent_config_events', () => {
+              return agentConfig.etag('test-etag').timestamp(timestamp);
+            });
+            return events;
+          })
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/aws_lambda.ts b/packages/kbn-apm-synthtrace/src/scenarios/aws_lambda.ts
index 9b5ed599fa2fb5..44f11b05d90cf6 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/aws_lambda.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/aws_lambda.ts
@@ -10,12 +10,13 @@ import { apm, ApmFields } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const timestamps = range.ratePerMinute(180);
 
       const cloudFields: ApmFields = {
@@ -91,7 +92,7 @@ const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
         ];
       });
 
-      return awsLambdaEvents;
+      return withClient(apmEsClient, awsLambdaEvents);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/azure_functions.ts b/packages/kbn-apm-synthtrace/src/scenarios/azure_functions.ts
index 070b6218183b83..69be0a5b157e82 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/azure_functions.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/azure_functions.ts
@@ -10,12 +10,13 @@ import { apm, ApmFields } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const timestamps = range.ratePerMinute(180);
 
       const cloudFields: ApmFields = {
@@ -61,7 +62,7 @@ const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
         ];
       });
 
-      return awsLambdaEvents;
+      return withClient(apmEsClient, awsLambdaEvents);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/cloud_services_icons.ts b/packages/kbn-apm-synthtrace/src/scenarios/cloud_services_icons.ts
index c4ee421dbab4a7..3c7ee8d6566cda 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/cloud_services_icons.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/cloud_services_icons.ts
@@ -9,6 +9,7 @@
 import { apm, ApmFields, Instance } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -16,7 +17,7 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
   const { numServices = 3 } = scenarioOpts || {};
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const transactionName = 'Azure-AWS-Transaction';
 
       const successfulTimestamps = range.ratePerMinute(60);
@@ -176,7 +177,10 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
         return successfulTraceEvents;
       };
 
-      return logger.perf('generating_apm_events', () => instances.flatMap(instanceSpans));
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () => instances.flatMap(instanceSpans))
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/continuous_rollups.ts b/packages/kbn-apm-synthtrace/src/scenarios/continuous_rollups.ts
index 0a346dcf99542c..4b1a62a8004307 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/continuous_rollups.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/continuous_rollups.ts
@@ -11,6 +11,7 @@ import { merge, range as lodashRange } from 'lodash';
 import { Scenario } from '../cli/scenario';
 import { ComponentTemplateName } from '../lib/apm/client/apm_synthtrace_es_client';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENTS = ['production', 'development'].map((env) =>
   getSynthtraceEnvironment(__filename, env)
@@ -40,7 +41,7 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
         }
       );
     },
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const TRANSACTION_TYPES = ['request', 'custom'];
 
       const MIN_DURATION = 10;
@@ -64,36 +65,39 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
 
       const transactionGroupRange = lodashRange(0, numTxGroups);
 
-      return range
-        .interval('1m')
-        .rate(1)
-        .generator((timestamp, timestampIndex) => {
-          return logger.perf(
-            'generate_events_for_timestamp ' + new Date(timestamp).toISOString(),
-            () => {
-              const events = instances.flatMap((instance) =>
-                transactionGroupRange.flatMap((groupId, groupIndex) =>
-                  OUTCOMES.map((outcome) => {
-                    const duration = Math.round(
-                      (timestampIndex % MAX_BUCKETS) * BUCKET_SIZE + MIN_DURATION
-                    );
-
-                    return instance
-                      .transaction(
-                        `transaction-${groupId}`,
-                        TRANSACTION_TYPES[groupIndex % TRANSACTION_TYPES.length]
-                      )
-                      .timestamp(timestamp)
-                      .duration(duration)
-                      .outcome(outcome);
-                  })
-                )
-              );
-
-              return events;
-            }
-          );
-        });
+      return withClient(
+        apmEsClient,
+        range
+          .interval('1m')
+          .rate(1)
+          .generator((timestamp, timestampIndex) => {
+            return logger.perf(
+              'generate_events_for_timestamp ' + new Date(timestamp).toISOString(),
+              () => {
+                const events = instances.flatMap((instance) =>
+                  transactionGroupRange.flatMap((groupId, groupIndex) =>
+                    OUTCOMES.map((outcome) => {
+                      const duration = Math.round(
+                        (timestampIndex % MAX_BUCKETS) * BUCKET_SIZE + MIN_DURATION
+                      );
+
+                      return instance
+                        .transaction(
+                          `transaction-${groupId}`,
+                          TRANSACTION_TYPES[groupIndex % TRANSACTION_TYPES.length]
+                        )
+                        .timestamp(timestamp)
+                        .duration(duration)
+                        .outcome(outcome);
+                    })
+                  )
+                );
+
+                return events;
+              }
+            );
+          })
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace.ts b/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace.ts
index c47e10733fd5f4..5b591078c46bf0 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace.ts
@@ -11,12 +11,13 @@ import { Scenario } from '../cli/scenario';
 
 import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const transactionName = '240rpm/75% 1000ms';
       const successfulTimestamps = range.interval('1s').rate(3);
 
@@ -86,7 +87,7 @@ const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
           );
       });
 
-      return traces;
+      return withClient(apmEsClient, traces);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace_long.ts b/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace_long.ts
index cd4b719494b56f..d298a76ffccae9 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace_long.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/distributed_trace_long.ts
@@ -12,12 +12,13 @@ import { apm, ApmFields, DistributedTrace } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const ratePerMinute = 1;
       const traceDuration = 1100;
       const rootTransactionName = `${ratePerMinute}rpm / ${traceDuration}ms`;
@@ -122,7 +123,7 @@ const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
         }).getTransaction();
       });
 
-      return traces;
+      return withClient(apmEsClient, traces);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/high_throughput.ts b/packages/kbn-apm-synthtrace/src/scenarios/high_throughput.ts
index 2e7d8c22a4696a..70988d16a0744f 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/high_throughput.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/high_throughput.ts
@@ -10,6 +10,7 @@ import { random } from 'lodash';
 import { apm, Instance, ApmFields } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -18,7 +19,7 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
   const services = ['web', 'order-processing', 'api-backend'];
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const successfulTimestamps = range.interval('1s');
 
       const instances = services.map((service, index) =>
@@ -95,10 +96,13 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
         return successfulTraceEvents;
       };
 
-      return logger.perf('generating_apm_events', () =>
-        instances
-          .flatMap((instance) => urls.map((url) => ({ instance, url })))
-          .map(({ instance, url }, index) => instanceSpans(instance, url, index))
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () =>
+          instances
+            .flatMap((instance) => urls.map((url) => ({ instance, url })))
+            .map(({ instance, url }, index) => instanceSpans(instance, url, index))
+        )
       );
     },
   };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/logs_and_metrics.ts b/packages/kbn-apm-synthtrace/src/scenarios/logs_and_metrics.ts
new file mode 100644
index 00000000000000..7532b3dc9477cd
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/scenarios/logs_and_metrics.ts
@@ -0,0 +1,161 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import {
+  LogDocument,
+  log,
+  generateShortId,
+  generateLongId,
+  apm,
+  Instance,
+} from '@kbn/apm-synthtrace-client';
+import { Scenario } from '../cli/scenario';
+import { withClient } from '../lib/utils/with_client';
+import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+
+const ENVIRONMENT = getSynthtraceEnvironment(__filename);
+
+const scenario: Scenario<LogDocument> = async (runOptions) => {
+  return {
+    generate: ({ range, clients: { logsEsClient, apmEsClient } }) => {
+      const { numServices = 3 } = runOptions.scenarioOpts || {};
+      const { logger } = runOptions;
+
+      // Logs Data logic
+      const MESSAGE_LOG_LEVELS = [
+        { message: 'A simple log', level: 'info' },
+        { message: 'Yet another debug log', level: 'debug' },
+        { message: 'Error with certificate: "ca_trusted_fingerprint"', level: 'error' },
+      ];
+      const CLOUD_PROVIDERS = ['gcp', 'aws', 'azure'];
+      const CLOUD_REGION = ['eu-central-1', 'us-east-1', 'area-51'];
+
+      const CLUSTER = [
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-1' },
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-2' },
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-3' },
+      ];
+
+      const SERVICE_NAMES = Array(3)
+        .fill(null)
+        .map((_, idx) => `synth-service-${idx}`);
+
+      const logs = range
+        .interval('1m')
+        .rate(1)
+        .generator((timestamp) => {
+          return Array(20)
+            .fill(0)
+            .map(() => {
+              const index = Math.floor(Math.random() * 3);
+              return log
+                .create()
+                .message(MESSAGE_LOG_LEVELS[index].message)
+                .logLevel(MESSAGE_LOG_LEVELS[index].level)
+                .service(SERVICE_NAMES[index])
+                .defaults({
+                  'trace.id': generateShortId(),
+                  'agent.name': 'synth-agent',
+                  'orchestrator.cluster.name': CLUSTER[index].clusterName,
+                  'orchestrator.cluster.id': CLUSTER[index].clusterId,
+                  'orchestrator.resource.id': generateShortId(),
+                  'cloud.provider': CLOUD_PROVIDERS[Math.floor(Math.random() * 3)],
+                  'cloud.region': CLOUD_REGION[index],
+                  'cloud.availability_zone': `${CLOUD_REGION[index]}a`,
+                  'cloud.project.id': generateShortId(),
+                  'cloud.instance.id': generateShortId(),
+                  'log.file.path': `/logs/${generateLongId()}/error.txt`,
+                })
+                .timestamp(timestamp);
+            });
+        });
+
+      // APM Simple Trace
+
+      const transactionName = '240rpm/75% 1000ms';
+
+      const successfulTimestamps = range.interval('1m').rate(180);
+      const failedTimestamps = range.interval('1m').rate(180);
+
+      const instances = [...Array(numServices).keys()].map((index) =>
+        apm
+          .service({ name: SERVICE_NAMES[index], environment: ENVIRONMENT, agentName: 'go' })
+          .instance('instance')
+      );
+      const instanceSpans = (instance: Instance) => {
+        const successfulTraceEvents = successfulTimestamps.generator((timestamp) =>
+          instance
+            .transaction({ transactionName })
+            .timestamp(timestamp)
+            .duration(1000)
+            .success()
+            .children(
+              instance
+                .span({
+                  spanName: 'GET apm-*/_search',
+                  spanType: 'db',
+                  spanSubtype: 'elasticsearch',
+                })
+                .duration(1000)
+                .success()
+                .destination('elasticsearch')
+                .timestamp(timestamp),
+              instance
+                .span({ spanName: 'custom_operation', spanType: 'custom' })
+                .duration(100)
+                .success()
+                .timestamp(timestamp)
+            )
+        );
+
+        const failedTraceEvents = failedTimestamps.generator((timestamp) =>
+          instance
+            .transaction({ transactionName })
+            .timestamp(timestamp)
+            .duration(1000)
+            .failure()
+            .errors(
+              instance
+                .error({ message: '[ResponseError] index_not_found_exception' })
+                .timestamp(timestamp + 50)
+            )
+        );
+
+        const metricsets = range
+          .interval('30s')
+          .rate(1)
+          .generator((timestamp) =>
+            instance
+              .appMetrics({
+                'system.memory.actual.free': 800,
+                'system.memory.total': 1000,
+                'system.cpu.total.norm.pct': 0.6,
+                'system.process.cpu.total.norm.pct': 0.7,
+              })
+              .timestamp(timestamp)
+          );
+
+        return [successfulTraceEvents, failedTraceEvents, metricsets];
+      };
+
+      return [
+        withClient(
+          logsEsClient,
+          logger.perf('generating_logs', () => logs)
+        ),
+        withClient(
+          apmEsClient,
+          logger.perf('generating_apm_events', () =>
+            instances.flatMap((instance) => instanceSpans(instance))
+          )
+        ),
+      ];
+    },
+  };
+};
+
+export default scenario;
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/low_throughput.ts b/packages/kbn-apm-synthtrace/src/scenarios/low_throughput.ts
index 8a79706289cea8..de54a7a7219115 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/low_throughput.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/low_throughput.ts
@@ -10,6 +10,7 @@ import { ApmFields, Instance, apm } from '@kbn/apm-synthtrace-client';
 import { random } from 'lodash';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -18,7 +19,7 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
   const services = ['web', 'order-processing', 'api-backend'];
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const successfulTimestamps = range.ratePerMinute(60);
 
       const instances = services.map((serviceName, index) =>
@@ -78,10 +79,13 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
         return successfulTraceEvents;
       };
 
-      return logger.perf('generating_apm_events', () =>
-        instances
-          .flatMap((instance) => urls.map((url) => ({ instance, url })))
-          .map(({ instance, url }, index) => instanceSpans(instance, url, index))
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () =>
+          instances
+            .flatMap((instance) => urls.map((url) => ({ instance, url })))
+            .map(({ instance, url }, index) => instanceSpans(instance, url, index))
+        )
       );
     },
   };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/many_services.ts b/packages/kbn-apm-synthtrace/src/scenarios/many_services.ts
index 14bd5d9a700424..705d425d8d9321 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/many_services.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/many_services.ts
@@ -10,6 +10,7 @@ import { ApmFields, apm, Instance } from '@kbn/apm-synthtrace-client';
 import { flatten, random } from 'lodash';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -25,7 +26,7 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
   };
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const successfulTimestamps = range.ratePerMinute(180);
 
       const instances = flatten(
@@ -95,10 +96,13 @@ const scenario: Scenario<ApmFields> = async ({ logger }) => {
         return successfulTraceEvents;
       };
 
-      return logger.perf('generating_apm_events', () =>
-        instances
-          .flatMap((instance) => urls.map((url) => ({ instance, url })))
-          .map(({ instance, url }) => instanceSpans(instance, url))
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () =>
+          instances
+            .flatMap((instance) => urls.map((url) => ({ instance, url })))
+            .map(({ instance, url }) => instanceSpans(instance, url))
+        )
       );
     },
   };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/many_transactions_per_service.ts b/packages/kbn-apm-synthtrace/src/scenarios/many_transactions_per_service.ts
index e814ed51b08e6c..565ac8ea4f1abc 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/many_transactions_per_service.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/many_transactions_per_service.ts
@@ -8,6 +8,7 @@
 import { ApmFields, apm, Instance } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -17,7 +18,7 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
   const numTransactions = 100;
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const urls = ['GET /order', 'POST /basket', 'DELETE /basket', 'GET /products'];
 
       const successfulTimestamps = range.ratePerMinute(180);
@@ -68,14 +69,17 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
         return [successfulTraceEvents, failedTraceEvents, metricsets];
       };
 
-      return logger.perf('generating_apm_events', () =>
-        instances
-          .flatMap((instance) =>
-            transactionNames.map((transactionName) => ({ instance, transactionName }))
-          )
-          .flatMap(({ instance, transactionName }, index) =>
-            instanceSpans(instance, transactionName)
-          )
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () =>
+          instances
+            .flatMap((instance) =>
+              transactionNames.map((transactionName) => ({ instance, transactionName }))
+            )
+            .flatMap(({ instance, transactionName }, index) =>
+              instanceSpans(instance, transactionName)
+            )
+        )
       );
     },
   };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/mobile.ts b/packages/kbn-apm-synthtrace/src/scenarios/mobile.ts
index 0ca4abf07bf911..594bd0b8753248 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/mobile.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/mobile.ts
@@ -15,6 +15,7 @@ import type {
 } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -328,7 +329,7 @@ const scenario: Scenario<ApmFields> = async ({ scenarioOpts, logger }) => {
   const { numDevices = 10 } = scenarioOpts || {};
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const androidDevices = [...Array(numDevices).keys()].map((index) => {
         const deviceMetadata = ANDROID_DEVICES[randomInt(ANDROID_DEVICES.length)];
         const geoNetwork = GEO_AND_NETWORK[randomInt(GEO_AND_NETWORK.length)];
@@ -444,13 +445,13 @@ const scenario: Scenario<ApmFields> = async ({ scenarioOpts, logger }) => {
         );
       };
 
-      return [
+      return withClient(apmEsClient, [
         ...androidDevices.flatMap((device) => [
           sessionTransactions(device),
           appLaunchMetrics(device),
         ]),
         ...iOSDevices.map((device) => sessionTransactions(device)),
-      ];
+      ]);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/other_bucket_group.ts b/packages/kbn-apm-synthtrace/src/scenarios/other_bucket_group.ts
index 49fcc2f6ac47b5..db0de7e5a5b324 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/other_bucket_group.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/other_bucket_group.ts
@@ -9,6 +9,7 @@ import { apm, ApmFields } from '@kbn/apm-synthtrace-client';
 import { range as lodashRange } from 'lodash';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENTS = ['production', 'development'].map((env) =>
   getSynthtraceEnvironment(__filename, env)
@@ -18,7 +19,7 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
   const { services: numServices = 10, txGroups: numTxGroups = 10 } = scenarioOpts ?? {};
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const TRANSACTION_TYPES = ['request'];
 
       const MIN_DURATION = 10;
@@ -46,41 +47,47 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
         '_other',
       ];
 
-      return range
-        .interval('1m')
-        .rate(1)
-        .generator((timestamp, timestampIndex) => {
-          return logger.perf(
-            'generate_events_for_timestamp ' + new Date(timestamp).toISOString(),
-            () => {
-              const events = instances.flatMap((instance) =>
-                transactionGroupRange.flatMap((groupId, groupIndex) => {
-                  const duration = Math.round(
-                    (timestampIndex % MAX_BUCKETS) * BUCKET_SIZE + MIN_DURATION
-                  );
+      return withClient(
+        apmEsClient,
+        range
+          .interval('1m')
+          .rate(1)
+          .generator((timestamp, timestampIndex) => {
+            return logger.perf(
+              'generate_events_for_timestamp ' + new Date(timestamp).toISOString(),
+              () => {
+                const events = instances.flatMap((instance) =>
+                  transactionGroupRange.flatMap((groupId, groupIndex) => {
+                    const duration = Math.round(
+                      (timestampIndex % MAX_BUCKETS) * BUCKET_SIZE + MIN_DURATION
+                    );
+
+                    if (groupId === '_other') {
+                      return instance
+                        .transaction(groupId)
+                        .timestamp(timestamp)
+                        .duration(duration)
+                        .defaults({
+                          'transaction.aggregation.overflow_count': 10,
+                        });
+                    }
 
-                  if (groupId === '_other') {
                     return instance
-                      .transaction(groupId)
+                      .transaction(
+                        groupId,
+                        TRANSACTION_TYPES[groupIndex % TRANSACTION_TYPES.length]
+                      )
                       .timestamp(timestamp)
                       .duration(duration)
-                      .defaults({
-                        'transaction.aggregation.overflow_count': 10,
-                      });
-                  }
-
-                  return instance
-                    .transaction(groupId, TRANSACTION_TYPES[groupIndex % TRANSACTION_TYPES.length])
-                    .timestamp(timestamp)
-                    .duration(duration)
-                    .success();
-                })
-              );
+                      .success();
+                  })
+                );
 
-              return events;
-            }
-          );
-        });
+                return events;
+              }
+            );
+          })
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts b/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
index f39d4bdd1e2213..2c6c75e4dfe814 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/service_map.ts
@@ -10,67 +10,71 @@ import { ApmFields, serviceMap } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const environment = getSynthtraceEnvironment(__filename);
 
 const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
   return {
-    generate: ({ range }) => {
-      return range
-        .interval('1s')
-        .rate(3)
-        .generator(
-          serviceMap({
-            services: [
-              { 'frontend-rum': 'rum-js' },
-              { 'frontend-node': 'nodejs' },
-              { advertService: 'java' },
-              { checkoutService: 'go' },
-              { cartService: 'dotnet' },
-              { paymentService: 'nodejs' },
-              { productCatalogService: 'go' },
-            ],
-            environment,
-            definePaths([rum, node, adv, chk, cart, pay, prod]) {
-              return [
-                [
-                  [rum, 'fetchAd'],
-                  [node, 'GET /nodejs/adTag'],
-                  [adv, 'APIRestController#getAd'],
-                  ['elasticsearch', 'GET ad-*/_search'],
-                ],
-                [
-                  [rum, 'AddToCart'],
-                  [node, 'POST /nodejs/addToCart'],
-                  [cart, 'POST /dotnet/reserveProduct'],
-                  ['redis', 'DECR inventory:i012345:stock'],
-                ],
-                [
-                  [rum, 'Checkout'],
-                  [node, 'POST /nodejs/placeOrder'],
-                  [chk, 'POST /go/placeOrder'],
-                  [pay, 'POST /nodejs/processPayment'],
-                ],
-                [
-                  [chk, 'POST /go/clearCart'],
-                  [cart, 'PUT /dotnet/cart/c12345/reset'],
-                  ['redis', 'INCR inventory:i012345:stock'],
-                ],
-                [
-                  [rum, 'ProductDashboard'],
-                  [node, 'GET /nodejs/products'],
-                  [prod, 'GET /go/product-catalog'],
-                  ['elasticsearch', 'GET product-*/_search'],
-                ],
-                [
-                  [chk, 'PUT /go/update-inventory'],
-                  [prod, 'PUT /go/product/i012345'],
-                ],
-                [pay],
-              ];
-            },
-          })
-        );
+    generate: ({ range, clients: { apmEsClient } }) => {
+      return withClient(
+        apmEsClient,
+        range
+          .interval('1s')
+          .rate(3)
+          .generator(
+            serviceMap({
+              services: [
+                { 'frontend-rum': 'rum-js' },
+                { 'frontend-node': 'nodejs' },
+                { advertService: 'java' },
+                { checkoutService: 'go' },
+                { cartService: 'dotnet' },
+                { paymentService: 'nodejs' },
+                { productCatalogService: 'go' },
+              ],
+              environment,
+              definePaths([rum, node, adv, chk, cart, pay, prod]) {
+                return [
+                  [
+                    [rum, 'fetchAd'],
+                    [node, 'GET /nodejs/adTag'],
+                    [adv, 'APIRestController#getAd'],
+                    ['elasticsearch', 'GET ad-*/_search'],
+                  ],
+                  [
+                    [rum, 'AddToCart'],
+                    [node, 'POST /nodejs/addToCart'],
+                    [cart, 'POST /dotnet/reserveProduct'],
+                    ['redis', 'DECR inventory:i012345:stock'],
+                  ],
+                  [
+                    [rum, 'Checkout'],
+                    [node, 'POST /nodejs/placeOrder'],
+                    [chk, 'POST /go/placeOrder'],
+                    [pay, 'POST /nodejs/processPayment'],
+                  ],
+                  [
+                    [chk, 'POST /go/clearCart'],
+                    [cart, 'PUT /dotnet/cart/c12345/reset'],
+                    ['redis', 'INCR inventory:i012345:stock'],
+                  ],
+                  [
+                    [rum, 'ProductDashboard'],
+                    [node, 'GET /nodejs/products'],
+                    [prod, 'GET /go/product-catalog'],
+                    ['elasticsearch', 'GET product-*/_search'],
+                  ],
+                  [
+                    [chk, 'PUT /go/update-inventory'],
+                    [prod, 'PUT /go/product/i012345'],
+                  ],
+                  [pay],
+                ];
+              },
+            })
+          )
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/service_map_oom.ts b/packages/kbn-apm-synthtrace/src/scenarios/service_map_oom.ts
index 30f0a8c58e577d..7c0d4dbbc8475b 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/service_map_oom.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/service_map_oom.ts
@@ -10,18 +10,18 @@ import { ApmFields, httpExitSpan } from '@kbn/apm-synthtrace-client';
 import { service } from '@kbn/apm-synthtrace-client/src/lib/apm/service';
 import { Transaction } from '@kbn/apm-synthtrace-client/src/lib/apm/transaction';
 import { Scenario } from '../cli/scenario';
-import { RunOptions } from '../cli/utils/parse_run_cli_flags';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const environment = getSynthtraceEnvironment(__filename);
 
-const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
+const scenario: Scenario<ApmFields> = async () => {
   const numServices = 500;
 
   const tracesPerMinute = 10;
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const services = new Array(numServices)
         .fill(undefined)
         .map((_, idx) => {
@@ -29,34 +29,37 @@ const scenario: Scenario<ApmFields> = async (runOptions: RunOptions) => {
         })
         .reverse();
 
-      return range.ratePerMinute(tracesPerMinute).generator((timestamp) => {
-        const rootTransaction = services.reduce((prev, currentService) => {
-          const tx = currentService
-            .transaction(`GET /my/function`, 'request')
-            .timestamp(timestamp)
-            .duration(1000)
-            .children(
-              ...(prev
-                ? [
-                    currentService
-                      .span(
-                        httpExitSpan({
-                          spanName: `exit-span-${currentService.fields['service.name']}`,
-                          destinationUrl: `http://address-to-exit-span-${currentService.fields['service.name']}`,
-                        })
-                      )
-                      .timestamp(timestamp)
-                      .duration(1000)
-                      .children(prev),
-                  ]
-                : [])
-            );
+      return withClient(
+        apmEsClient,
+        range.ratePerMinute(tracesPerMinute).generator((timestamp) => {
+          const rootTransaction = services.reduce((prev, currentService) => {
+            const tx = currentService
+              .transaction(`GET /my/function`, 'request')
+              .timestamp(timestamp)
+              .duration(1000)
+              .children(
+                ...(prev
+                  ? [
+                      currentService
+                        .span(
+                          httpExitSpan({
+                            spanName: `exit-span-${currentService.fields['service.name']}`,
+                            destinationUrl: `http://address-to-exit-span-${currentService.fields['service.name']}`,
+                          })
+                        )
+                        .timestamp(timestamp)
+                        .duration(1000)
+                        .children(prev),
+                    ]
+                  : [])
+              );
 
-          return tx;
-        }, undefined as Transaction | undefined);
+            return tx;
+          }, undefined as Transaction | undefined);
 
-        return rootTransaction!;
-      });
+          return rootTransaction!;
+        })
+      );
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts b/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
index c7d535028a1af2..b06111d4b60266 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/services_without_transactions.ts
@@ -8,12 +8,13 @@
 import { apm, ApmFields } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
-const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
+const scenario: Scenario<ApmFields> = async () => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const withTx = apm
         .service('service-with-transactions', ENVIRONMENT, 'java')
         .instance('instance');
@@ -26,7 +27,7 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
         .service('service-with-app-metrics-only', ENVIRONMENT, 'java')
         .instance('instance');
 
-      return range
+      const data = range
         .interval('1m')
         .rate(1)
         .generator((timestamp) => {
@@ -45,6 +46,8 @@ const scenario: Scenario<ApmFields> = async ({ logger, scenarioOpts }) => {
               .timestamp(timestamp),
           ];
         });
+
+      return withClient(apmEsClient, data);
     },
   };
 };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/simple_logs.ts b/packages/kbn-apm-synthtrace/src/scenarios/simple_logs.ts
new file mode 100644
index 00000000000000..18c1fc1c525503
--- /dev/null
+++ b/packages/kbn-apm-synthtrace/src/scenarios/simple_logs.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { LogDocument, log, generateShortId, generateLongId } from '@kbn/apm-synthtrace-client';
+import { Scenario } from '../cli/scenario';
+import { withClient } from '../lib/utils/with_client';
+
+const scenario: Scenario<LogDocument> = async (runOptions) => {
+  return {
+    generate: ({ range, clients: { logsEsClient } }) => {
+      const { logger } = runOptions;
+
+      // Logs Data logic
+      const MESSAGE_LOG_LEVELS = [
+        { message: 'A simple log', level: 'info' },
+        { message: 'Yet another debug log', level: 'debug' },
+        { message: 'Error with certificate: "ca_trusted_fingerprint"', level: 'error' },
+      ];
+      const CLOUD_PROVIDERS = ['gcp', 'aws', 'azure'];
+      const CLOUD_REGION = ['eu-central-1', 'us-east-1', 'area-51'];
+
+      const CLUSTER = [
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-1' },
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-2' },
+        { clusterId: generateShortId(), clusterName: 'synth-cluster-3' },
+      ];
+
+      const SERVICE_NAMES = Array(3)
+        .fill(null)
+        .map((_, idx) => `synth-service-${idx}`);
+
+      const logs = range
+        .interval('1m')
+        .rate(1)
+        .generator((timestamp) => {
+          return Array(20)
+            .fill(0)
+            .map(() => {
+              const index = Math.floor(Math.random() * 3);
+              return log
+                .create()
+                .message(MESSAGE_LOG_LEVELS[index].message)
+                .logLevel(MESSAGE_LOG_LEVELS[index].level)
+                .service(SERVICE_NAMES[index])
+                .defaults({
+                  'trace.id': generateShortId(),
+                  'agent.name': 'synth-agent',
+                  'orchestrator.cluster.name': CLUSTER[index].clusterName,
+                  'orchestrator.cluster.id': CLUSTER[index].clusterId,
+                  'orchestrator.resource.id': generateShortId(),
+                  'cloud.provider': CLOUD_PROVIDERS[Math.floor(Math.random() * 3)],
+                  'cloud.region': CLOUD_REGION[index],
+                  'cloud.availability_zone': `${CLOUD_REGION[index]}a`,
+                  'cloud.project.id': generateShortId(),
+                  'cloud.instance.id': generateShortId(),
+                  'log.file.path': `/logs/${generateLongId()}/error.txt`,
+                })
+                .timestamp(timestamp);
+            });
+        });
+
+      return withClient(
+        logsEsClient,
+        logger.perf('generating_logs', () => logs)
+      );
+    },
+  };
+};
+
+export default scenario;
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/simple_trace.ts b/packages/kbn-apm-synthtrace/src/scenarios/simple_trace.ts
index 827cbfca46e793..26b0c1282d5149 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/simple_trace.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/simple_trace.ts
@@ -8,6 +8,7 @@
 import { ApmFields, apm, Instance } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -16,7 +17,7 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
   const { numServices = 3 } = runOptions.scenarioOpts || {};
 
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const transactionName = '240rpm/75% 1000ms';
 
       const successfulTimestamps = range.interval('1m').rate(180);
@@ -83,8 +84,11 @@ const scenario: Scenario<ApmFields> = async (runOptions) => {
         return [successfulTraceEvents, failedTraceEvents, metricsets];
       };
 
-      return logger.perf('generating_apm_events', () =>
-        instances.flatMap((instance) => instanceSpans(instance))
+      return withClient(
+        apmEsClient,
+        logger.perf('generating_apm_events', () =>
+          instances.flatMap((instance) => instanceSpans(instance))
+        )
       );
     },
   };
diff --git a/packages/kbn-apm-synthtrace/src/scenarios/span_links.ts b/packages/kbn-apm-synthtrace/src/scenarios/span_links.ts
index 60f63f80e3decb..08930a815ffdf2 100644
--- a/packages/kbn-apm-synthtrace/src/scenarios/span_links.ts
+++ b/packages/kbn-apm-synthtrace/src/scenarios/span_links.ts
@@ -11,6 +11,7 @@ import { Readable } from 'stream';
 import { apm, ApmFields, generateLongId, generateShortId } from '@kbn/apm-synthtrace-client';
 import { Scenario } from '../cli/scenario';
 import { getSynthtraceEnvironment } from '../lib/utils/get_synthtrace_environment';
+import { withClient } from '../lib/utils/with_client';
 
 const ENVIRONMENT = getSynthtraceEnvironment(__filename);
 
@@ -32,7 +33,7 @@ function getSpanLinksFromEvents(events: ApmFields[]) {
 
 const scenario: Scenario<ApmFields> = async () => {
   return {
-    generate: ({ range }) => {
+    generate: ({ range, clients: { apmEsClient } }) => {
       const producerInternalOnlyInstance = apm
 
         .service({ name: 'producer-internal-only', environment: ENVIRONMENT, agentName: 'go' })
@@ -111,8 +112,9 @@ const scenario: Scenario<ApmFields> = async () => {
             );
         });
 
-      return Readable.from(
-        Array.from(producerInternalOnlyEvents).concat(Array.from(consumerEvents))
+      return withClient(
+        apmEsClient,
+        Readable.from(Array.from(producerInternalOnlyEvents).concat(Array.from(consumerEvents)))
       );
     },
   };
diff --git a/packages/kbn-check-mappings-update-cli/current_mappings.json b/packages/kbn-check-mappings-update-cli/current_mappings.json
index 8b8f1acffc9032..023a26e787bfa3 100644
--- a/packages/kbn-check-mappings-update-cli/current_mappings.json
+++ b/packages/kbn-check-mappings-update-cli/current_mappings.json
@@ -42,10 +42,6 @@
       }
     }
   },
-  "metrics-data-source": {
-    "dynamic": false,
-    "properties": {}
-  },
   "url": {
     "dynamic": false,
     "properties": {
@@ -1473,6 +1469,10 @@
       }
     }
   },
+  "metrics-data-source": {
+    "dynamic": false,
+    "properties": {}
+  },
   "canvas-element": {
     "dynamic": false,
     "properties": {
@@ -2176,6 +2176,9 @@
       "interval": {
         "type": "keyword"
       },
+      "timeout": {
+        "type": "short"
+      },
       "ecs_mapping": {
         "dynamic": false,
         "properties": {}
@@ -2224,6 +2227,9 @@
           "interval": {
             "type": "text"
           },
+          "timeout": {
+            "type": "short"
+          },
           "platform": {
             "type": "keyword"
           },
@@ -2266,6 +2272,9 @@
           "interval": {
             "type": "text"
           },
+          "timeout": {
+            "type": "short"
+          },
           "platform": {
             "type": "keyword"
           },
@@ -2362,6 +2371,9 @@
       },
       "tags": {
         "type": "keyword"
+      },
+      "version": {
+        "type": "long"
       }
     }
   },
@@ -2687,50 +2699,6 @@
       }
     }
   },
-  "apm-telemetry": {
-    "dynamic": false,
-    "properties": {}
-  },
-  "apm-server-schema": {
-    "properties": {
-      "schemaJson": {
-        "type": "text",
-        "index": false
-      }
-    }
-  },
-  "apm-service-group": {
-    "properties": {
-      "groupName": {
-        "type": "keyword"
-      },
-      "kuery": {
-        "type": "text"
-      },
-      "description": {
-        "type": "text"
-      },
-      "color": {
-        "type": "text"
-      }
-    }
-  },
-  "apm-custom-dashboards": {
-    "properties": {
-      "dashboardSavedObjectId": {
-        "type": "keyword"
-      },
-      "kuery": {
-        "type": "text"
-      },
-      "serviceEnvironmentFilterEnabled": {
-        "type": "boolean"
-      },
-      "serviceNameFilterEnabled": {
-        "type": "boolean"
-      }
-    }
-  },
   "enterprise_search_telemetry": {
     "dynamic": false,
     "properties": {}
@@ -3204,5 +3172,49 @@
         "index": false
       }
     }
+  },
+  "apm-telemetry": {
+    "dynamic": false,
+    "properties": {}
+  },
+  "apm-server-schema": {
+    "properties": {
+      "schemaJson": {
+        "type": "text",
+        "index": false
+      }
+    }
+  },
+  "apm-service-group": {
+    "properties": {
+      "groupName": {
+        "type": "keyword"
+      },
+      "kuery": {
+        "type": "text"
+      },
+      "description": {
+        "type": "text"
+      },
+      "color": {
+        "type": "text"
+      }
+    }
+  },
+  "apm-custom-dashboards": {
+    "properties": {
+      "dashboardSavedObjectId": {
+        "type": "keyword"
+      },
+      "kuery": {
+        "type": "text"
+      },
+      "serviceEnvironmentFilterEnabled": {
+        "type": "boolean"
+      },
+      "serviceNameFilterEnabled": {
+        "type": "boolean"
+      }
+    }
   }
 }
diff --git a/packages/kbn-config-schema/src/types/object_type.ts b/packages/kbn-config-schema/src/types/object_type.ts
index fa72ee61ab7ff6..6927a10630b1eb 100644
--- a/packages/kbn-config-schema/src/types/object_type.ts
+++ b/packages/kbn-config-schema/src/types/object_type.ts
@@ -159,10 +159,7 @@ export class ObjectType<P extends Props = any> extends Type<ObjectResultType<P>>
       ...newProps,
     }).reduce((memo, [key, value]) => {
       if (value !== null && value !== undefined) {
-        return {
-          ...memo,
-          [key]: value,
-        };
+        (memo as Record<string, unknown>)[key] = value;
       }
       return memo;
     }, {} as ExtendedProps<P, NP>);
diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts
index a5f2bf8677cfd0..9e0d380c2f016d 100644
--- a/packages/kbn-doc-links/src/get_doc_links.ts
+++ b/packages/kbn-doc-links/src/get_doc_links.ts
@@ -536,7 +536,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       infrastructureThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/infrastructure-threshold-alert.html`,
       logsThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/logs-threshold-alert.html`,
       metricsThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/metrics-threshold-alert.html`,
-      threshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/threshold-alert.html`,
+      customThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/custom-threshold-alert.html`,
       monitorStatus: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/monitor-status-alert.html`,
       monitorUptime: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/monitor-uptime.html`,
       tlsCertificate: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/tls-certificate-alert.html`,
diff --git a/packages/kbn-doc-links/src/types.ts b/packages/kbn-doc-links/src/types.ts
index c2b90abf24aca8..37974c9244b73f 100644
--- a/packages/kbn-doc-links/src/types.ts
+++ b/packages/kbn-doc-links/src/types.ts
@@ -408,7 +408,7 @@ export interface DocLinks {
     infrastructureThreshold: string;
     logsThreshold: string;
     metricsThreshold: string;
-    threshold: string;
+    customThreshold: string;
     monitorStatus: string;
     monitorUptime: string;
     tlsCertificate: string;
diff --git a/packages/kbn-generate-csv-types/README.md b/packages/kbn-generate-csv-types/README.md
deleted file mode 100644
index 9046a9264ea6b5..00000000000000
--- a/packages/kbn-generate-csv-types/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# @kbn/generate-csv-types
-
-This package includes interfaces specific to the @kbn/generate-csv package. 
\ No newline at end of file
diff --git a/packages/kbn-generate-csv/kibana.jsonc b/packages/kbn-generate-csv/kibana.jsonc
index 9769151714f2a5..d29b33047007cb 100644
--- a/packages/kbn-generate-csv/kibana.jsonc
+++ b/packages/kbn-generate-csv/kibana.jsonc
@@ -1,5 +1,5 @@
 {
-  "type": "shared-common",
+  "type": "shared-server",
   "id": "@kbn/generate-csv",
   "owner": "@elastic/appex-sharedux"
 }
diff --git a/packages/kbn-generate-csv/src/constants.ts b/packages/kbn-generate-csv/src/constants.ts
index cdaadf7451e376..aa4fb3f1b49802 100644
--- a/packages/kbn-generate-csv/src/constants.ts
+++ b/packages/kbn-generate-csv/src/constants.ts
@@ -10,3 +10,5 @@ export const CSV_BOM_CHARS = '\ufeff';
 export const CONTENT_TYPE_CSV = 'text/csv';
 export const UI_SETTINGS_CSV_SEPARATOR = 'csv:separator';
 export const UI_SETTINGS_CSV_QUOTE_VALUES = 'csv:quoteValues';
+export const UI_SETTINGS_SEARCH_INCLUDE_FROZEN = 'search:includeFrozen';
+export const UI_SETTINGS_DATEFORMAT_TZ = 'dateFormat:tz';
diff --git a/packages/kbn-generate-csv/src/generate_csv.test.ts b/packages/kbn-generate-csv/src/generate_csv.test.ts
index 52f15d6a82c49f..22857f37afdaf6 100644
--- a/packages/kbn-generate-csv/src/generate_csv.test.ts
+++ b/packages/kbn-generate-csv/src/generate_csv.test.ts
@@ -6,6 +6,10 @@
  * Side Public License, v 1.
  */
 
+import { identity, range } from 'lodash';
+import * as Rx from 'rxjs';
+import type { Writable } from 'stream';
+
 import { errors as esErrors, estypes } from '@elastic/elasticsearch';
 import type { SearchResponse } from '@elastic/elasticsearch/lib/api/types';
 import type { IScopedClusterClient, IUiSettingsClient, Logger } from '@kbn/core/server';
@@ -20,22 +24,24 @@ import { searchSourceInstanceMock } from '@kbn/data-plugin/common/search/search_
 import { IScopedSearchClient } from '@kbn/data-plugin/server';
 import { dataPluginMock } from '@kbn/data-plugin/server/mocks';
 import { FieldFormatsRegistry } from '@kbn/field-formats-plugin/common';
-import { identity, range } from 'lodash';
-import * as Rx from 'rxjs';
-import type { Writable } from 'stream';
+import { CancellationToken } from '@kbn/reporting-common';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+import { JobParamsCSV } from '@kbn/reporting-export-types-csv-common';
+import {
+  UI_SETTINGS_CSV_QUOTE_VALUES,
+  UI_SETTINGS_CSV_SEPARATOR,
+  UI_SETTINGS_DATEFORMAT_TZ,
+} from './constants';
 import { CsvGenerator } from './generate_csv';
-import { CancellationToken, UI_SETTINGS_DATEFORMAT_TZ } from '@kbn/reporting-common';
-import { CsvConfig, JobParams } from '@kbn/generate-csv-types';
-import { UI_SETTINGS_CSV_QUOTE_VALUES, UI_SETTINGS_CSV_SEPARATOR } from './constants';
 
-const createMockJob = (baseObj: any = {}): JobParams => ({
+const createMockJob = (baseObj: any = {}): JobParamsCSV => ({
   ...baseObj,
 });
 
 describe('CsvGenerator', () => {
   let mockEsClient: IScopedClusterClient;
   let mockDataClient: IScopedSearchClient;
-  let mockConfig: CsvConfig;
+  let mockConfig: ReportingConfigType['csv'];
   let mockLogger: jest.Mocked<Logger>;
   let uiSettingsClient: IUiSettingsClient;
   let stream: jest.Mocked<Writable>;
@@ -111,6 +117,7 @@ describe('CsvGenerator', () => {
       maxSizeBytes: 180000,
       useByteOrderMarkEncoding: false,
       scroll: { size: 500, duration: '30s' },
+      enablePanelActionDownload: true,
     };
 
     searchSourceMock.getField = jest.fn((key: string) => {
@@ -237,6 +244,7 @@ describe('CsvGenerator', () => {
       maxSizeBytes: TEST_MAX_SIZE,
       useByteOrderMarkEncoding: false,
       scroll: { size: 500, duration: '30s' },
+      enablePanelActionDownload: true,
     };
 
     mockDataClient.search = jest.fn().mockImplementation(() =>
@@ -750,6 +758,7 @@ describe('CsvGenerator', () => {
         maxSizeBytes: 180000,
         useByteOrderMarkEncoding: false,
         scroll: { size: 500, duration: '30s' },
+        enablePanelActionDownload: true,
       };
       mockDataClient.search = jest.fn().mockImplementation(() =>
         Rx.of({
diff --git a/packages/kbn-generate-csv/src/generate_csv.ts b/packages/kbn-generate-csv/src/generate_csv.ts
index 9d3b85b214c945..59e69e9989c8e0 100644
--- a/packages/kbn-generate-csv/src/generate_csv.ts
+++ b/packages/kbn-generate-csv/src/generate_csv.ts
@@ -6,10 +6,13 @@
  * Side Public License, v 1.
  */
 
+import { lastValueFrom } from 'rxjs';
+import type { Writable } from 'stream';
+
 import { errors as esErrors, estypes } from '@elastic/elasticsearch';
 import type { IScopedClusterClient, IUiSettingsClient, Logger } from '@kbn/core/server';
 import type { ISearchSource, ISearchStartSearchSource } from '@kbn/data-plugin/common';
-import { cellHasFormulas, ES_SEARCH_STRATEGY, tabifyDocs } from '@kbn/data-plugin/common';
+import { ES_SEARCH_STRATEGY, cellHasFormulas, tabifyDocs } from '@kbn/data-plugin/common';
 import type { IScopedSearchClient } from '@kbn/data-plugin/server';
 import type { Datatable } from '@kbn/expressions-plugin/server';
 import type {
@@ -17,20 +20,20 @@ import type {
   FieldFormatConfig,
   IFieldFormatsRegistry,
 } from '@kbn/field-formats-plugin/common';
-import { lastValueFrom } from 'rxjs';
-import type { Writable } from 'stream';
 import {
-  CancellationToken,
   AuthenticationExpiredError,
+  CancellationToken,
   ReportingError,
-  TaskRunResult,
   byteSizeValueToNumber,
 } from '@kbn/reporting-common';
-import { CsvConfig, JobParams } from '@kbn/generate-csv-types';
-import { MaxSizeStringBuilder } from './max_size_string_builder';
-import { i18nTexts } from './i18n_texts';
-import { CsvExportSettings, getExportSettings } from './get_export_settings';
+import type { TaskRunResult } from '@kbn/reporting-common/types';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+
 import { CONTENT_TYPE_CSV } from './constants';
+import { CsvExportSettings, getExportSettings } from './get_export_settings';
+import { i18nTexts } from './i18n_texts';
+import { MaxSizeStringBuilder } from './max_size_string_builder';
+import { JobParamsCSV } from '../types';
 
 interface Clients {
   es: IScopedClusterClient;
@@ -49,8 +52,8 @@ export class CsvGenerator {
   private csvRowCount = 0;
 
   constructor(
-    private job: Omit<JobParams, 'version'>,
-    private config: CsvConfig,
+    private job: Omit<JobParamsCSV, 'version'>,
+    private config: ReportingConfigType['csv'],
     private clients: Clients,
     private dependencies: Dependencies,
     private cancellationToken: CancellationToken,
diff --git a/packages/kbn-generate-csv/src/get_export_settings.test.ts b/packages/kbn-generate-csv/src/get_export_settings.test.ts
index 4afbeeabcdaa52..18b2525cf79420 100644
--- a/packages/kbn-generate-csv/src/get_export_settings.test.ts
+++ b/packages/kbn-generate-csv/src/get_export_settings.test.ts
@@ -6,28 +6,31 @@
  * Side Public License, v 1.
  */
 
-import {
-  UI_SETTINGS_SEARCH_INCLUDE_FROZEN,
-  UI_SETTINGS_DATEFORMAT_TZ,
-} from '@kbn/reporting-common';
-import { IUiSettingsClient } from '@kbn/core/server';
+import type { IUiSettingsClient } from '@kbn/core/server';
 import {
   loggingSystemMock,
   savedObjectsClientMock,
   uiSettingsServiceMock,
 } from '@kbn/core/server/mocks';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+
+import {
+  UI_SETTINGS_CSV_QUOTE_VALUES,
+  UI_SETTINGS_CSV_SEPARATOR,
+  UI_SETTINGS_DATEFORMAT_TZ,
+  UI_SETTINGS_SEARCH_INCLUDE_FROZEN,
+} from './constants';
 import { getExportSettings } from './get_export_settings';
-import { CsvConfig } from '@kbn/generate-csv-types';
-import { UI_SETTINGS_CSV_QUOTE_VALUES, UI_SETTINGS_CSV_SEPARATOR } from './constants';
 
 describe('getExportSettings', () => {
   let uiSettingsClient: IUiSettingsClient;
-  const config: CsvConfig = {
+  const config: ReportingConfigType['csv'] = {
     checkForFormulas: true,
     escapeFormulaValues: false,
     maxSizeBytes: 180000,
     scroll: { size: 500, duration: '30s' },
     useByteOrderMarkEncoding: false,
+    enablePanelActionDownload: true,
   };
   const logger = loggingSystemMock.createLogger();
 
diff --git a/packages/kbn-generate-csv/src/get_export_settings.ts b/packages/kbn-generate-csv/src/get_export_settings.ts
index 46d31afaf9e4f4..faef6fdc60f87c 100644
--- a/packages/kbn-generate-csv/src/get_export_settings.ts
+++ b/packages/kbn-generate-csv/src/get_export_settings.ts
@@ -6,18 +6,16 @@
  * Side Public License, v 1.
  */
 
-import { ByteSizeValue } from '@kbn/config-schema';
+import type { ByteSizeValue } from '@kbn/config-schema';
 import type { IUiSettingsClient, Logger } from '@kbn/core/server';
 import { createEscapeValue } from '@kbn/data-plugin/common';
-import { CsvConfig } from '@kbn/generate-csv-types';
-import {
-  UI_SETTINGS_DATEFORMAT_TZ,
-  UI_SETTINGS_SEARCH_INCLUDE_FROZEN,
-} from '@kbn/reporting-common';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 import {
   CSV_BOM_CHARS,
   UI_SETTINGS_CSV_QUOTE_VALUES,
   UI_SETTINGS_CSV_SEPARATOR,
+  UI_SETTINGS_DATEFORMAT_TZ,
+  UI_SETTINGS_SEARCH_INCLUDE_FROZEN,
 } from './constants';
 
 export interface CsvExportSettings {
@@ -37,7 +35,7 @@ export interface CsvExportSettings {
 
 export const getExportSettings = async (
   client: IUiSettingsClient,
-  config: CsvConfig,
+  config: ReportingConfigType['csv'],
   timezone: string | undefined,
   logger: Logger
 ): Promise<CsvExportSettings> => {
diff --git a/packages/kbn-generate-csv/tsconfig.json b/packages/kbn-generate-csv/tsconfig.json
index e09d9a392772ef..51dbd54dda73eb 100644
--- a/packages/kbn-generate-csv/tsconfig.json
+++ b/packages/kbn-generate-csv/tsconfig.json
@@ -21,9 +21,10 @@
     "@kbn/data-plugin",
     "@kbn/expressions-plugin",
     "@kbn/field-formats-plugin",
-    "@kbn/reporting-common",
     "@kbn/config-schema",
     "@kbn/i18n",
-    "@kbn/generate-csv-types",
+    "@kbn/reporting-common",
+    "@kbn/reporting-server",
+    "@kbn/reporting-export-types-csv-common",
   ]
 }
diff --git a/packages/kbn-generate-csv-types/index.ts b/packages/kbn-generate-csv/types.ts
similarity index 63%
rename from packages/kbn-generate-csv-types/index.ts
rename to packages/kbn-generate-csv/types.ts
index 865ac302e06b9f..6d7461609afe24 100644
--- a/packages/kbn-generate-csv-types/index.ts
+++ b/packages/kbn-generate-csv/types.ts
@@ -6,22 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { ByteSizeValue } from '@kbn/config-schema';
 import type { SerializedSearchSourceFields } from '@kbn/data-plugin/public';
 
-export interface JobParams {
+/**
+ * Duplicated from @kbn/reporting-export-types-csv-common to reduce dependencies
+ */
+export interface JobParamsCSV {
+  browserTimezone?: string;
   searchSource: SerializedSearchSourceFields;
   columns?: string[];
-  browserTimezone?: string;
-}
-
-export interface CsvConfig {
-  checkForFormulas: boolean;
-  escapeFormulaValues: boolean;
-  maxSizeBytes: number | ByteSizeValue;
-  useByteOrderMarkEncoding: boolean;
-  scroll: {
-    duration: string;
-    size: number;
-  };
 }
diff --git a/packages/kbn-i18n/src/core/helper.ts b/packages/kbn-i18n/src/core/helper.ts
index 405f0596cd0371..eef4bb88e49277 100644
--- a/packages/kbn-i18n/src/core/helper.ts
+++ b/packages/kbn-i18n/src/core/helper.ts
@@ -18,17 +18,12 @@ export const unique = <T>(arr: T[] = []): T[] => [...new Set(arr)];
 const merge = (a: any, b: any): { [k: string]: any } =>
   unique([...Object.keys(a), ...Object.keys(b)]).reduce((acc, key) => {
     if (isObject(a[key]) && isObject(b[key]) && !Array.isArray(a[key]) && !Array.isArray(b[key])) {
-      return {
-        ...acc,
-        [key]: merge(a[key], b[key]),
-      };
+      acc[key] = merge(a[key], b[key]);
+    } else {
+      acc[key] = b[key] === undefined ? a[key] : b[key];
     }
-
-    return {
-      ...acc,
-      [key]: b[key] === undefined ? a[key] : b[key],
-    };
-  }, {});
+    return acc;
+  }, {} as { [k: string]: any });
 
 export const mergeAll = (...sources: any[]) =>
   sources.filter(isObject).reduce((acc, source) => merge(acc, source));
diff --git a/packages/kbn-i18n/src/loader.ts b/packages/kbn-i18n/src/loader.ts
index 5b4417b54646c3..55c924e989daf0 100644
--- a/packages/kbn-i18n/src/loader.ts
+++ b/packages/kbn-i18n/src/loader.ts
@@ -148,13 +148,10 @@ export async function getAllTranslations(): Promise<{ [key: string]: Translation
   const locales = getRegisteredLocales();
   const translations = await Promise.all(locales.map(getTranslationsByLocale));
 
-  return locales.reduce(
-    (acc, locale, index) => ({
-      ...acc,
-      [locale]: translations[index],
-    }),
-    {}
-  );
+  return locales.reduce((acc, locale, index) => {
+    acc[locale] = translations[index];
+    return acc;
+  }, {} as { [key: string]: Translation });
 }
 
 /**
diff --git a/packages/kbn-io-ts-utils/index.ts b/packages/kbn-io-ts-utils/index.ts
index 57d9e7bb477135..8f1b974eccdcb1 100644
--- a/packages/kbn-io-ts-utils/index.ts
+++ b/packages/kbn-io-ts-utils/index.ts
@@ -32,3 +32,11 @@ export {
 export { datemathStringRt } from './src/datemath_string_rt';
 
 export { createPlainError, decodeOrThrow, formatErrors, throwErrors } from './src/decode_or_throw';
+
+export {
+  DateFromStringOrNumber,
+  minimalTimeKeyRT,
+  type MinimalTimeKey,
+  type TimeKey,
+  type UniqueTimeKey,
+} from './src/time_key_rt';
diff --git a/packages/kbn-io-ts-utils/src/time_key_rt/index.ts b/packages/kbn-io-ts-utils/src/time_key_rt/index.ts
new file mode 100644
index 00000000000000..1884ea5a52e835
--- /dev/null
+++ b/packages/kbn-io-ts-utils/src/time_key_rt/index.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as rt from 'io-ts';
+import moment from 'moment';
+import { pipe } from 'fp-ts/lib/pipeable';
+import { chain } from 'fp-ts/lib/Either';
+
+const NANO_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3,9}Z$/;
+
+export const DateFromStringOrNumber = new rt.Type<string, number | string>(
+  'DateFromStringOrNumber',
+  (input): input is string => typeof input === 'string',
+  (input, context) => {
+    if (typeof input === 'string') {
+      return NANO_DATE_PATTERN.test(input) ? rt.success(input) : rt.failure(input, context);
+    }
+    return pipe(
+      rt.number.validate(input, context),
+      chain((timestamp) => {
+        const momentValue = moment(timestamp);
+        return momentValue.isValid()
+          ? rt.success(momentValue.toISOString())
+          : rt.failure(timestamp, context);
+      })
+    );
+  },
+  String
+);
+
+export const minimalTimeKeyRT = rt.type({
+  time: DateFromStringOrNumber,
+  tiebreaker: rt.number,
+});
+export type MinimalTimeKey = rt.TypeOf<typeof minimalTimeKeyRT>;
+
+const timeKeyRT = rt.intersection([
+  minimalTimeKeyRT,
+  rt.partial({
+    gid: rt.string,
+    fromAutoReload: rt.boolean,
+  }),
+]);
+export type TimeKey = rt.TypeOf<typeof timeKeyRT>;
+
+export interface UniqueTimeKey extends TimeKey {
+  gid: string;
+}
diff --git a/packages/kbn-lens-embeddable-utils/attribute_builder/types.ts b/packages/kbn-lens-embeddable-utils/attribute_builder/types.ts
index 6c9011b9782dc3..428f6aacce133e 100644
--- a/packages/kbn-lens-embeddable-utils/attribute_builder/types.ts
+++ b/packages/kbn-lens-embeddable-utils/attribute_builder/types.ts
@@ -16,6 +16,7 @@ import type {
   XYState,
   FormulaPublicApi,
   XYLayerConfig,
+  FillStyle,
 } from '@kbn/lens-plugin/public';
 export type LensAttributes = TypedLensByValueInput['attributes'];
 
@@ -87,5 +88,6 @@ export type FormulaValueConfig = Omit<LensFormula, 'formula'> & {
 
 export type StaticValueConfig = Omit<LensFormula, 'formula'> & {
   color?: string;
+  fill?: FillStyle;
   value: string;
 };
diff --git a/packages/kbn-lens-embeddable-utils/attribute_builder/utils.ts b/packages/kbn-lens-embeddable-utils/attribute_builder/utils.ts
index ed75956cadbe19..58981aab8bcb4c 100644
--- a/packages/kbn-lens-embeddable-utils/attribute_builder/utils.ts
+++ b/packages/kbn-lens-embeddable-utils/attribute_builder/utils.ts
@@ -27,7 +27,7 @@ export type DateHistogramColumnParams = DateHistogramIndexPatternColumn['params'
 
 export type TopValuesColumnParams = Pick<
   TermsIndexPatternColumn['params'],
-  'size' | 'orderDirection' | 'orderBy'
+  'size' | 'orderDirection' | 'orderBy' | 'secondaryFields' | 'accuracyMode'
 >;
 
 export const getHistogramColumn = ({
@@ -37,10 +37,11 @@ export const getHistogramColumn = ({
   columnName: string;
   options?: Partial<
     Pick<DateHistogramIndexPatternColumn, 'sourceField'> & {
-      params: DateHistogramColumnParams;
+      params: Partial<DateHistogramColumnParams>;
     }
   >;
 }) => {
+  const { interval = 'auto', ...rest } = options?.params ?? {};
   return {
     [columnName]: {
       dataType: 'date',
@@ -48,9 +49,8 @@ export const getHistogramColumn = ({
       label: '@timestamp',
       operationType: 'date_histogram',
       scale: 'interval',
-      sourceField: '@timestamp',
-      ...options,
-      params: { interval: 'auto', ...options?.params },
+      sourceField: options?.sourceField ?? '@timestamp',
+      params: { interval, ...rest },
     } as DateHistogramIndexPatternColumn,
   };
 };
diff --git a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_data_layer.ts b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_data_layer.ts
index 21fe17d156cac0..f4845a5c93ab9c 100644
--- a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_data_layer.ts
+++ b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_data_layer.ts
@@ -86,7 +86,9 @@ export class XYDataLayer implements ChartLayer<XYDataLayerConfig> {
         ? getHistogramColumn({
             columnName: HISTOGRAM_COLUMN_NAME,
             options: {
-              ...options.buckets.params,
+              params: {
+                ...options.buckets.params,
+              },
               sourceField: options.buckets.field ?? dataView.timeFieldName,
             },
           })
diff --git a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_reference_lines_layer.ts b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_reference_lines_layer.ts
index 1823de59684e2d..2a105c10677af1 100644
--- a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_reference_lines_layer.ts
+++ b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/layers/xy_reference_lines_layer.ts
@@ -60,6 +60,7 @@ export class XYReferenceLinesLayer implements ChartLayer<XYReferenceLineLayerCon
         color: layer.getValueConfig().color,
         forAccessor: `${accessorId}_${index}_reference_column`,
         axisMode: 'left',
+        fill: layer.getValueConfig().fill,
       })),
     };
   }
diff --git a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/xy_chart.ts b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/xy_chart.ts
index cef612adc6b129..6e0390ffe9e104 100644
--- a/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/xy_chart.ts
+++ b/packages/kbn-lens-embeddable-utils/attribute_builder/visualization_types/xy_chart.ts
@@ -14,6 +14,7 @@ import type {
 } from '@kbn/lens-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/public';
 import type { SavedObjectReference } from '@kbn/core/server';
+import { AxesSettingsConfig } from '@kbn/visualizations-plugin/common';
 import type { Chart, ChartConfig, ChartLayer } from '../types';
 import { DEFAULT_LAYER_ID } from '../utils';
 
@@ -25,6 +26,8 @@ export interface XYVisualOptions {
   missingValues?: XYArgs['fittingFunction'];
   endValues?: XYArgs['endValue'];
   showDottedLine?: boolean;
+  valueLabels?: XYArgs['valueLabels'];
+  axisTitlesVisibilitySettings?: AxesSettingsConfig;
 }
 
 export class XYChart implements Chart<XYState> {
@@ -80,6 +83,8 @@ export class XYChart implements Chart<XYState> {
       endValue: this.chartConfig.visualOptions?.endValues,
       curveType: this.chartConfig.visualOptions?.lineInterpolation,
       emphasizeFitting: !this.chartConfig.visualOptions?.showDottedLine,
+      valueLabels: this.chartConfig.visualOptions?.valueLabels,
+      axisTitlesVisibilitySettings: this.chartConfig.visualOptions?.axisTitlesVisibilitySettings,
     };
   }
 
diff --git a/packages/kbn-lens-embeddable-utils/tsconfig.json b/packages/kbn-lens-embeddable-utils/tsconfig.json
index eca0b277bff1df..6238ba09d0374c 100644
--- a/packages/kbn-lens-embeddable-utils/tsconfig.json
+++ b/packages/kbn-lens-embeddable-utils/tsconfig.json
@@ -6,5 +6,11 @@
   },
   "include": ["**/*.ts"],
   "exclude": ["target/**/*"],
-  "kbn_references": ["@kbn/core", "@kbn/data-plugin", "@kbn/data-views-plugin", "@kbn/lens-plugin"]
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/data-plugin",
+    "@kbn/data-views-plugin",
+    "@kbn/lens-plugin",
+    "@kbn/visualizations-plugin",
+  ]
 }
diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index de07bccf8bbcbe..e79e6b4fa8be9f 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -28,6 +28,7 @@ pageLoadAssetSize:
   dashboard: 82025
   dashboardEnhanced: 65646
   data: 454087
+  datasetQuality: 35000
   dataViewEditor: 28082
   dataViewFieldEditor: 27000
   dataViewManagement: 5100
@@ -88,7 +89,7 @@ pageLoadAssetSize:
   licensing: 29004
   links: 44490
   lists: 22900
-  logExplorer: 39045
+  logExplorer: 54342
   logsShared: 281060
   logstash: 53548
   management: 46112
@@ -123,7 +124,7 @@ pageLoadAssetSize:
   screenshotting: 22870
   searchprofiler: 67080
   security: 81771
-  securitySolution: 66738
+  securitySolution: 67584
   securitySolutionEss: 16573
   securitySolutionServerless: 62488
   serverless: 16573
diff --git a/packages/kbn-osquery-io-ts-types/src/live_query/index.ts b/packages/kbn-osquery-io-ts-types/src/live_query/index.ts
index 378bb446cafab8..6fc9af23a6a72c 100644
--- a/packages/kbn-osquery-io-ts-types/src/live_query/index.ts
+++ b/packages/kbn-osquery-io-ts-types/src/live_query/index.ts
@@ -7,6 +7,7 @@
  */
 
 import * as t from 'io-ts';
+import { inRangeRt } from '@kbn/io-ts-utils';
 
 export const id = t.string;
 export type Id = t.TypeOf<typeof id>;
@@ -49,6 +50,11 @@ export type Interval = t.TypeOf<typeof interval>;
 export const intervalOrUndefined = t.union([interval, t.undefined]);
 export type IntervalOrUndefined = t.TypeOf<typeof intervalOrUndefined>;
 
+export const timeout = inRangeRt(60, 60 * 15);
+export type Timeout = t.TypeOf<typeof timeout>;
+export const timeoutOrUndefined = t.union([timeout, t.undefined]);
+export type TimeoutOrUndefined = t.TypeOf<typeof timeoutOrUndefined>;
+
 export const snapshot = t.boolean;
 export type Snapshot = t.TypeOf<typeof snapshot>;
 export const snapshotOrUndefined = t.union([snapshot, t.undefined]);
diff --git a/packages/kbn-osquery-io-ts-types/tsconfig.json b/packages/kbn-osquery-io-ts-types/tsconfig.json
index b72f7b0a15c5c6..780216a67a2475 100644
--- a/packages/kbn-osquery-io-ts-types/tsconfig.json
+++ b/packages/kbn-osquery-io-ts-types/tsconfig.json
@@ -12,5 +12,8 @@
   ],
   "exclude": [
     "target/**/*",
+  ],
+  "kbn_references": [
+    "@kbn/io-ts-utils",
   ]
 }
diff --git a/packages/kbn-plugin-generator/template/server/index.ts.ejs b/packages/kbn-plugin-generator/template/server/index.ts.ejs
index 5e0510b7ecb86e..68cce4a2157c9b 100644
--- a/packages/kbn-plugin-generator/template/server/index.ts.ejs
+++ b/packages/kbn-plugin-generator/template/server/index.ts.ejs
@@ -1,11 +1,10 @@
 import { PluginInitializerContext } from '<%= importFromRoot('src/core/server') %>';
-import { <%= upperCamelCase(name) %>Plugin } from './plugin';
-
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
- export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { <%= upperCamelCase(name) %>Plugin } = await import('./plugin');
   return new <%= upperCamelCase(name) %>Plugin(initializerContext);
 }
 
diff --git a/packages/kbn-reporting/common/README.md b/packages/kbn-reporting/common/README.md
index 3b40bc8ff8b930..1b53a6ea0de610 100644
--- a/packages/kbn-reporting/common/README.md
+++ b/packages/kbn-reporting/common/README.md
@@ -2,4 +2,4 @@
 
 Removes any circular dependency from the reporting plugin and the @kbn/generate-csv package. 
 
-This package includes the `CancellationToken` class, schema utils, constants, errors that extend `ReportingError`, and metrics such as `TaskRunResult`.  p
\ No newline at end of file
+This package includes the `CancellationToken` class, schema utils, constants, errors that extend `ReportingError`, and metrics such as `TaskRunResult`.  This package is shared-common vs specifically server or browser. The `@kbn/reporting-server` package has the server side helpers.
\ No newline at end of file
diff --git a/x-pack/plugins/reporting/common/build_kibana_path.ts b/packages/kbn-reporting/common/build_kibana_path.ts
similarity index 71%
rename from x-pack/plugins/reporting/common/build_kibana_path.ts
rename to packages/kbn-reporting/common/build_kibana_path.ts
index 2cb37013300ca9..b719d6a68f23a2 100644
--- a/x-pack/plugins/reporting/common/build_kibana_path.ts
+++ b/packages/kbn-reporting/common/build_kibana_path.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 interface Args {
diff --git a/packages/kbn-reporting/common/constants.ts b/packages/kbn-reporting/common/constants.ts
index f2bf7e7e99a80a..02926a53a14eb6 100644
--- a/packages/kbn-reporting/common/constants.ts
+++ b/packages/kbn-reporting/common/constants.ts
@@ -5,7 +5,74 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
+export const PLUGIN_ID = 'reporting';
+
+export const ALLOWED_JOB_CONTENT_TYPES = [
+  'application/json',
+  'application/pdf',
+  'text/csv',
+  'image/png',
+  'text/plain',
+];
+
+// APM
+export const REPORTING_TRANSACTION_TYPE = PLUGIN_ID;
+
+export const REPORTING_REDIRECT_LOCATOR_STORE_KEY = '__REPORTING_REDIRECT_LOCATOR_STORE_KEY__';
+
 export const UI_SETTINGS_SEARCH_INCLUDE_FROZEN = 'search:includeFrozen';
 export const UI_SETTINGS_CUSTOM_PDF_LOGO = 'xpackReporting:customPdfLogo';
 export const UI_SETTINGS_DATEFORMAT_TZ = 'dateFormat:tz';
-export const CSV_REPORTING_ACTION = 'downloadCsvReport';
+
+// Licenses
+export const LICENSE_TYPE_TRIAL = 'trial' as const;
+export const LICENSE_TYPE_BASIC = 'basic' as const;
+export const LICENSE_TYPE_CLOUD_STANDARD = 'standard' as const;
+export const LICENSE_TYPE_GOLD = 'gold' as const;
+export const LICENSE_TYPE_PLATINUM = 'platinum' as const;
+export const LICENSE_TYPE_ENTERPRISE = 'enterprise' as const;
+
+export const REPORTING_SYSTEM_INDEX = '.reporting';
+
+export const JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY =
+  'xpack.reporting.jobCompletionNotifications';
+
+/**
+ * A way to get the client side route for the reporting redirect app.
+ *
+ * TODO: Add a job ID and a locator to use so that we can redirect without expecting state to
+ * be injected to the page
+ */
+export const getRedirectAppPath = () => {
+  return '/app/reportingRedirect';
+};
+
+export const ILM_POLICY_NAME = 'kibana-reporting';
+
+// Usage counter types
+export const API_USAGE_COUNTER_TYPE = 'reportingApi';
+export const API_USAGE_ERROR_TYPE = 'reportingApiError';
+
+// Management UI route
+export const REPORTING_MANAGEMENT_HOME = '/app/management/insightsAndAlerting/reporting';
+
+/*
+ * JobStatus:
+ *  - Begins as 'pending'
+ *  - Changes to 'processing` when the job is claimed
+ *  - Then 'completed' | 'failed' when execution is done
+ * If the job needs a retry, it reverts back to 'pending'.
+ */
+export enum JOB_STATUS {
+  PENDING = 'pending',
+  PROCESSING = 'processing',
+  COMPLETED = 'completed',
+  FAILED = 'failed',
+  WARNINGS = 'completed_with_warnings',
+}
+
+// Job params require a `version` field as of 7.15.0. For older jobs set with
+// automation that have no version value in the job params, we assume the
+// intended version is 7.14.0
+export const UNVERSIONED_VERSION = '7.14.0';
diff --git a/packages/kbn-reporting/common/index.ts b/packages/kbn-reporting/common/index.ts
index 8b1636c1fbc22f..b299ae3a6eff31 100644
--- a/packages/kbn-reporting/common/index.ts
+++ b/packages/kbn-reporting/common/index.ts
@@ -6,8 +6,9 @@
  * Side Public License, v 1.
  */
 
-export { CancellationToken } from './cancellation_token';
-export type { TaskRunMetrics, CsvMetrics, TaskRunResult } from './metrics';
-export * from './errors';
 export * from './constants';
+export * from './errors';
 export * from './schema_utils';
+
+export { CancellationToken } from './cancellation_token';
+export { buildKibanaPath } from './build_kibana_path';
diff --git a/packages/kbn-reporting/common/kibana.jsonc b/packages/kbn-reporting/common/kibana.jsonc
index 1a6681268635eb..9b038548369157 100644
--- a/packages/kbn-reporting/common/kibana.jsonc
+++ b/packages/kbn-reporting/common/kibana.jsonc
@@ -1,5 +1,5 @@
 {
   "type": "shared-common",
   "id": "@kbn/reporting-common",
-  "owner": "@elastic/appex-sharedux"
+  "owner": "@elastic/appex-sharedux",
 }
diff --git a/packages/kbn-reporting/common/metrics.ts b/packages/kbn-reporting/common/metrics.ts
deleted file mode 100644
index a1ac55ddf63601..00000000000000
--- a/packages/kbn-reporting/common/metrics.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import type { PdfScreenshotResult, PngScreenshotResult } from '@kbn/screenshotting-plugin/server';
-
-export type PngMetrics = PngScreenshotResult['metrics'];
-
-export type PdfMetrics = PdfScreenshotResult['metrics'];
-
-export interface CsvMetrics {
-  rows: number;
-}
-
-export interface TaskRunMetrics {
-  csv?: CsvMetrics;
-  png?: PngMetrics;
-  pdf?: PdfMetrics;
-}
-
-export interface TaskRunResult {
-  content_type: string | null;
-  csv_contains_formulas?: boolean;
-  max_size_reached?: boolean;
-  warnings?: string[];
-  metrics?: TaskRunMetrics;
-  /**
-   * When running a report task we may finish with warnings that were triggered
-   * by an error. We can pass the error code via the task run result to the
-   * task runner so that it can be recorded for telemetry.
-   *
-   * Alternatively, this field can be populated in the event that the task does
-   * not complete in the task runner's error handler.
-   */
-  error_code?: string;
-}
diff --git a/packages/kbn-reporting/common/tsconfig.json b/packages/kbn-reporting/common/tsconfig.json
index 9a68b802c21f47..80ed6308f02ff7 100644
--- a/packages/kbn-reporting/common/tsconfig.json
+++ b/packages/kbn-reporting/common/tsconfig.json
@@ -5,7 +5,6 @@
     "types": [
       "jest",
       "node",
-      "react"
     ]
   },
   "include": [
@@ -16,8 +15,9 @@
     "target/**/*"
   ],
   "kbn_references": [
-    "@kbn/i18n",
-    "@kbn/screenshotting-plugin",
     "@kbn/config-schema",
+    "@kbn/utility-types",
+    "@kbn/screenshotting-plugin",
+    "@kbn/i18n",
   ]
 }
diff --git a/x-pack/plugins/reporting/common/types/index.ts b/packages/kbn-reporting/common/types.ts
similarity index 56%
rename from x-pack/plugins/reporting/common/types/index.ts
rename to packages/kbn-reporting/common/types.ts
index 48968e17a1cb99..a208bd24226f1f 100644
--- a/x-pack/plugins/reporting/common/types/index.ts
+++ b/packages/kbn-reporting/common/types.ts
@@ -1,37 +1,45 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { TaskRunMetrics, TaskRunResult } from '@kbn/reporting-common';
-import type { PdfScreenshotResult, PngScreenshotResult } from '@kbn/screenshotting-plugin/server';
-import type { BaseParams, BaseParamsV2, BasePayload, BasePayloadV2, JobId } from './base';
-
-export type {
-  JobParamsCsvFromSavedObject,
-  TaskPayloadCsvFromSavedObject,
-} from './export_types/csv_v2';
-export type { JobParamsPNGDeprecated } from './export_types/png';
-export type { JobParamsPNGV2 } from './export_types/png_v2';
-export type { JobAppParamsPDF, JobParamsPDFDeprecated } from './export_types/printable_pdf';
-export type { JobAppParamsPDFV2, JobParamsPDFV2 } from './export_types/printable_pdf_v2';
-export type {
-  DownloadReportFn,
-  IlmPolicyMigrationStatus,
-  IlmPolicyStatusResponse,
-  LocatorParams,
-  ManagementLinkFn,
-  UrlOrUrlLocatorTuple,
-} from './url';
-export type { JobId, BaseParams, BaseParamsV2, BasePayload, BasePayloadV2 };
+import type {
+  LayoutParams,
+  PerformanceMetrics as ScreenshotMetrics,
+} from '@kbn/screenshotting-plugin/common';
+import { JOB_STATUS } from './constants';
+import type { LocatorParams } from './url';
 
-export interface ReportDocumentHead {
-  _id: string;
-  _index: string;
-  _seq_no: number;
-  _primary_term: number;
+export * from './url';
+
+export interface CsvMetrics {
+  rows: number;
+}
+
+export interface TaskRunMetrics {
+  csv?: CsvMetrics;
+  png?: ScreenshotMetrics;
+  pdf?: ScreenshotMetrics & { pages?: number };
+}
+
+export interface TaskRunResult {
+  content_type: string | null;
+  csv_contains_formulas?: boolean;
+  max_size_reached?: boolean;
+  warnings?: string[];
+  metrics?: TaskRunMetrics;
+  /**
+   * When running a report task we may finish with warnings that were triggered
+   * by an error. We can pass the error code via the task run result to the
+   * task runner so that it can be recorded for telemetry.
+   *
+   * Alternatively, this field can be populated in the event that the task does
+   * not complete in the task runner's error handler.
+   */
+  error_code?: string;
 }
 
 export interface ReportOutput extends TaskRunResult {
@@ -39,9 +47,66 @@ export interface ReportOutput extends TaskRunResult {
   size: number;
 }
 
-export type PngMetrics = PngScreenshotResult['metrics'];
+/**
+ * @deprecated
+ */
+export interface BaseParams {
+  layout?: LayoutParams;
+  objectType: string;
+  title: string;
+  browserTimezone: string; // to format dates in the user's time zone
+  version: string; // to handle any state migrations
+}
+
+/**
+ * Report job parameters that an application must return from its
+ * getSharingData function.
+ */
+export type BaseParamsV2 = BaseParams & {
+  locatorParams: LocatorParams[];
+};
+
+/**
+ * @deprecated
+ */
+export interface BasePayload extends BaseParams {
+  headers: string;
+  spaceId?: string;
+  isDeprecated?: boolean;
+}
 
-export type PdfMetrics = PdfScreenshotResult['metrics'];
+export type JobId = string;
+
+/**
+ * Report job parameters, after they are processed in the request handler.
+ */
+export interface BasePayloadV2 extends BaseParamsV2 {
+  headers: string;
+  spaceId?: string;
+  isDeprecated?: boolean;
+}
+
+export interface ReportingServerInfo {
+  basePath: string;
+  protocol: string;
+  hostname: string;
+  port: number;
+  name: string;
+  uuid: string;
+}
+
+export type IlmPolicyMigrationStatus = 'policy-not-found' | 'indices-not-managed-by-policy' | 'ok';
+
+export interface IlmPolicyStatusResponse {
+  status: IlmPolicyMigrationStatus;
+}
+
+export interface ReportDocumentHead {
+  _id: string;
+  _index: string;
+  _seq_no: number;
+  _primary_term: number;
+}
 
 export interface ReportFields {
   queue_time_ms?: number[]; // runtime field: started_at - created_at
@@ -65,7 +130,7 @@ export interface ReportSource {
   migration_version: string; // for reminding the user to update their POST URL
   attempts: number; // initially populated as 0
   created_at: string; // timestamp in UTC
-  status: JobStatus;
+  status: JOB_STATUS;
 
   /*
    * `output` is only populated if the report job is completed or failed.
@@ -93,20 +158,6 @@ export interface ReportDocument extends ReportDocumentHead {
   _source: ReportSource;
 }
 
-/*
- * JobStatus:
- *  - Begins as 'pending'
- *  - Changes to 'processing` when the job is claimed
- *  - Then 'completed' | 'failed' when execution is done
- * If the job needs a retry, it reverts back to 'pending'.
- */
-export type JobStatus =
-  | 'completed' // Report was successful
-  | 'completed_with_warnings' // The download available for troubleshooting - it **should** show a meaningful error
-  | 'pending' // Report job is waiting to be claimed
-  | 'processing' // Report job has been claimed and is executing
-  | 'failed'; // Report was not successful, and all retries are done. Nothing to download.
-
 /*
  * Info API response: to avoid unnecessary large payloads on a network, the
  * report query results do not include `payload.headers` or `output.content`,
@@ -132,19 +183,3 @@ export interface LicenseCheckResults {
   showLinks: boolean;
   message: string;
 }
-
-/* Notifier Toasts */
-export interface JobSummary {
-  id: JobId;
-  status: JobStatus;
-  jobtype: ReportSource['jobtype'];
-  title: ReportSource['payload']['title'];
-  errorCode?: ReportOutput['error_code'];
-  maxSizeReached: TaskRunResult['max_size_reached'];
-  csvContainsFormulas: TaskRunResult['csv_contains_formulas'];
-}
-
-export interface JobSummarySet {
-  completed: JobSummary[];
-  failed: JobSummary[];
-}
diff --git a/x-pack/plugins/reporting/common/types/url.ts b/packages/kbn-reporting/common/url.ts
similarity index 81%
rename from x-pack/plugins/reporting/common/types/url.ts
rename to packages/kbn-reporting/common/url.ts
index 2445e210b89b7e..14772b3a612aa3 100644
--- a/x-pack/plugins/reporting/common/types/url.ts
+++ b/packages/kbn-reporting/common/url.ts
@@ -1,12 +1,13 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { SerializableRecord } from '@kbn/utility-types';
-import type { JobId } from './base';
+import type { JobId } from './types';
 
 type DownloadLink = string;
 export type DownloadReportFn = (jobId: JobId) => DownloadLink;
diff --git a/packages/kbn-reporting/export_types/csv/README.md b/packages/kbn-reporting/export_types/csv/README.md
new file mode 100644
index 00000000000000..633acff0996144
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/README.md
@@ -0,0 +1,4 @@
+@kbn/reporting-export-types-csv 
+
+This package originally was part of the reporting plugin. It is now extracted into its own package that includes the csv export classes that are then used in the reporting plugin. 
+
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.test.ts b/packages/kbn-reporting/export_types/csv/csv_searchsource.test.ts
similarity index 78%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.test.ts
rename to packages/kbn-reporting/export_types/csv/csv_searchsource.test.ts
index 6596fc41d66d83..f48c25695405ec 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.test.ts
+++ b/packages/kbn-reporting/export_types/csv/csv_searchsource.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 jest.mock('@kbn/generate-csv', () => ({
@@ -19,23 +20,27 @@ jest.mock('@kbn/generate-csv', () => ({
 import nodeCrypto from '@elastic/node-crypto';
 import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { Writable } from 'stream';
-import { ReportingCore } from '../..';
 import { CancellationToken } from '@kbn/reporting-common';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
-import { CsvSearchSourceExportType } from './csv_searchsource';
 import { discoverPluginMock } from '@kbn/discover-plugin/server/mocks';
+import { createFieldFormatsStartMock } from '@kbn/field-formats-plugin/server/mocks';
 import { dataPluginMock } from '@kbn/data-plugin/server/mocks';
-import { createMockScreenshottingStart } from '@kbn/screenshotting-plugin/server/mock';
+import { setFieldFormats } from '@kbn/reporting-server';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+
+import { CsvSearchSourceExportType } from '.';
 
 const mockLogger = loggingSystemMock.createLogger();
 const encryptionKey = 'tetkey';
 const headers = { sid: 'cooltestheaders' };
 let encryptedHeaders: string;
-let mockReportingCore: ReportingCore;
 let stream: jest.Mocked<Writable>;
 let mockCsvSearchSourceExportType: CsvSearchSourceExportType;
 
 beforeAll(async () => {
+  // use fieldFormats plugin for csv formats
+  // normally, this is done in the Reporting plugin
+  setFieldFormats(createFieldFormatsStartMock());
+
   const crypto = nodeCrypto({ encryptionKey });
 
   encryptedHeaders = await crypto.encrypt(headers);
@@ -52,8 +57,6 @@ beforeAll(async () => {
   const mockCoreStart = coreMock.createStart();
   const context = coreMock.createPluginInitializerContext(configType);
 
-  mockReportingCore = await createMockReportingCore(configType);
-
   mockCsvSearchSourceExportType = new CsvSearchSourceExportType(
     mockCoreSetup,
     configType,
@@ -71,8 +74,6 @@ beforeAll(async () => {
     uiSettings: mockCoreStart.uiSettings,
     discover: discoverPluginMock.createStartContract(),
     data: dataPluginMock.createStartContract(),
-    screenshotting: createMockScreenshottingStart(),
-    reporting: mockReportingCore.getContract(),
   });
 });
 
@@ -96,9 +97,9 @@ test('gets the csv content from job parameters', async () => {
   );
 
   expect(payload).toMatchInlineSnapshot(`
-      Object {
-        "content_type": "text/csv",
-        "size": 123,
-      }
-    `);
+        Object {
+          "content_type": "text/csv",
+          "size": 123,
+        }
+      `);
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.ts b/packages/kbn-reporting/export_types/csv/csv_searchsource.ts
similarity index 79%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.ts
rename to packages/kbn-reporting/export_types/csv/csv_searchsource.ts
index 3847c9b45c197f..40634952721378 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/csv_searchsource.ts
+++ b/packages/kbn-reporting/export_types/csv/csv_searchsource.ts
@@ -1,33 +1,43 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { DataPluginStart } from '@kbn/data-plugin/server/plugin';
-import { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
-import { CsvGenerator } from '@kbn/generate-csv';
-import { CancellationToken } from '@kbn/reporting-common';
 import { Writable } from 'stream';
+
+import type { DataPluginStart } from '@kbn/data-plugin/server/plugin';
+import type { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
+import { CsvGenerator } from '@kbn/generate-csv';
 import {
-  CSV_JOB_TYPE,
+  CancellationToken,
   LICENSE_TYPE_BASIC,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
-} from '../../../common/constants';
-import { getFieldFormats } from '../../services';
-import { ExportType, BaseExportTypeSetupDeps, BaseExportTypeStartDeps } from '../common';
-import { decryptJobHeaders } from '../common/decrypt_job_headers';
-import { JobParamsCSV, TaskPayloadCSV } from './types';
+} from '@kbn/reporting-common';
+import {
+  CSV_JOB_TYPE,
+  CSV_REPORT_TYPE,
+  JobParamsCSV,
+  TaskPayloadCSV,
+} from '@kbn/reporting-export-types-csv-common';
+import {
+  BaseExportTypeSetupDeps,
+  BaseExportTypeStartDeps,
+  ExportType,
+  decryptJobHeaders,
+  getFieldFormats,
+} from '@kbn/reporting-server';
 
 type CsvSearchSourceExportTypeSetupDeps = BaseExportTypeSetupDeps;
 interface CsvSearchSourceExportTypeStartDeps extends BaseExportTypeStartDeps {
-  discover: DiscoverServerPluginStart;
   data: DataPluginStart;
+  discover: DiscoverServerPluginStart;
 }
 
 export class CsvSearchSourceExportType extends ExportType<
@@ -36,7 +46,7 @@ export class CsvSearchSourceExportType extends ExportType<
   CsvSearchSourceExportTypeSetupDeps,
   CsvSearchSourceExportTypeStartDeps
 > {
-  id = 'csv_searchsource';
+  id = CSV_REPORT_TYPE;
   name = CSV_JOB_TYPE;
   jobType = CSV_JOB_TYPE;
   jobContentEncoding = 'base64' as const;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/csv_searchsource_immediate.ts b/packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts
similarity index 86%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/csv_searchsource_immediate.ts
rename to packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts
index 2a53d138bfd92b..ed690935d45829 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/csv_searchsource_immediate.ts
+++ b/packages/kbn-reporting/export_types/csv/csv_searchsource_immediate.ts
@@ -1,33 +1,35 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
+import { Writable } from 'stream';
+
 import { KibanaRequest } from '@kbn/core-http-server';
 import { DataPluginStart } from '@kbn/data-plugin/server/plugin';
 import { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
 import { CsvGenerator } from '@kbn/generate-csv';
-import { CancellationToken, TaskRunResult } from '@kbn/reporting-common';
-import { Writable } from 'stream';
 import {
-  ExportType,
-  BaseExportTypeSetupDeps,
-  BaseExportTypeStartDeps,
-} from '../common/export_type';
-import {
-  CSV_SEARCHSOURCE_IMMEDIATE_TYPE,
+  CancellationToken,
   LICENSE_TYPE_BASIC,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
-} from '../../../common/constants';
-import { getFieldFormats } from '../../services';
-import { ReportingRequestHandlerContext } from '../../types';
-import { JobParamsDownloadCSV } from './types';
+} from '@kbn/reporting-common';
+import type { TaskRunResult } from '@kbn/reporting-common/types';
+import {
+  CSV_SEARCHSOURCE_IMMEDIATE_TYPE,
+  JobParamsDownloadCSV,
+} from '@kbn/reporting-export-types-csv-common';
+import type { BaseExportTypeSetupDeps, BaseExportTypeStartDeps } from '@kbn/reporting-server';
+import { ExportType, getFieldFormats } from '@kbn/reporting-server';
+
+import { ReportingRequestHandlerContext } from './types';
 
 type CsvSearchSourceImmediateExportTypeSetupDeps = BaseExportTypeSetupDeps;
 interface CsvSearchSourceImmediateExportTypeStartDeps extends BaseExportTypeStartDeps {
diff --git a/x-pack/plugins/reporting/server/export_types/csv_v2/csv_v2.ts b/packages/kbn-reporting/export_types/csv/csv_v2.ts
similarity index 83%
rename from x-pack/plugins/reporting/server/export_types/csv_v2/csv_v2.ts
rename to packages/kbn-reporting/export_types/csv/csv_v2.ts
index 921c0724d84393..9ef87011ba6dc7 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_v2/csv_v2.ts
+++ b/packages/kbn-reporting/export_types/csv/csv_v2.ts
@@ -1,33 +1,44 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import Boom from '@hapi/boom';
-import { KibanaRequest } from '@kbn/core/server';
-import { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
-import { DataPluginStart } from '@kbn/data-plugin/server/plugin';
-import { CsvGenerator } from '@kbn/generate-csv';
 import { Writable } from 'stream';
-import { CancellationToken } from '@kbn/reporting-common';
-import { JobParamsCsvFromSavedObject, TaskPayloadCsvFromSavedObject } from '../../../common/types';
+
+import type { KibanaRequest } from '@kbn/core/server';
+import type { DataPluginStart } from '@kbn/data-plugin/server/plugin';
+import type { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
+import { CsvGenerator } from '@kbn/generate-csv';
 import {
-  CSV_REPORT_TYPE_V2,
+  CancellationToken,
   LICENSE_TYPE_BASIC,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
-} from '../../../common/constants';
-import { ExportType, BaseExportTypeSetupDeps, BaseExportTypeStartDeps } from '../common';
-import { ReportingRequestHandlerContext } from '../../types';
-import { getFieldFormats } from '../../services';
-import { decryptJobHeaders } from '../common/decrypt_job_headers';
+} from '@kbn/reporting-common';
+import {
+  CSV_REPORT_TYPE_V2,
+  JobParamsCsvFromSavedObject,
+  TaskPayloadCsvFromSavedObject,
+} from '@kbn/reporting-export-types-csv-common';
+import {
+  ExportType,
+  decryptJobHeaders,
+  getFieldFormats,
+  type BaseExportTypeSetupDeps,
+  type BaseExportTypeStartDeps,
+} from '@kbn/reporting-server';
+
+import { ReportingRequestHandlerContext } from './types';
 
 type CsvV2ExportTypeSetupDeps = BaseExportTypeSetupDeps;
+
 export interface CsvV2ExportTypeStartDeps extends BaseExportTypeStartDeps {
   discover: DiscoverServerPluginStart;
   data: DataPluginStart;
@@ -55,8 +66,7 @@ export class CsvV2ExportType extends ExportType<
 
   constructor(...args: ConstructorParameters<typeof ExportType>) {
     super(...args);
-    const logger = args[2];
-    this.logger = logger.get('csv-export-v2');
+    this.logger = this.logger.get('csv-export-v2');
   }
 
   public createJob = async (
diff --git a/packages/kbn-reporting/export_types/csv/index.ts b/packages/kbn-reporting/export_types/csv/index.ts
new file mode 100644
index 00000000000000..a5cddaebe48214
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { CsvSearchSourceExportType } from './csv_searchsource';
+export { CsvV2ExportType } from './csv_v2';
+export { CsvSearchSourceImmediateExportType } from './csv_searchsource_immediate';
diff --git a/packages/kbn-reporting/export_types/csv/jest.config.js b/packages/kbn-reporting/export_types/csv/jest.config.js
new file mode 100644
index 00000000000000..3f14bdeaba3186
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/export_types/csv'],
+};
diff --git a/packages/kbn-reporting/export_types/csv/kibana.jsonc b/packages/kbn-reporting/export_types/csv/kibana.jsonc
new file mode 100644
index 00000000000000..e638d40ede567f
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+    "type": "shared-server",
+    "id": "@kbn/reporting-export-types-csv",
+    "owner": "@elastic/appex-sharedux"
+  }
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/csv/package.json b/packages/kbn-reporting/export_types/csv/package.json
new file mode 100644
index 00000000000000..81e9a4d1c41728
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "@kbn/reporting-export-types-csv",
+    "private": true,
+    "version": "1.0.0",
+    "license": "SSPL-1.0 OR Elastic License 2.0"
+  }
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/csv/tsconfig.json b/packages/kbn-reporting/export_types/csv/tsconfig.json
new file mode 100644
index 00000000000000..ba5f294cfa935b
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/tsconfig.json
@@ -0,0 +1,31 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/reporting-common",
+    "@kbn/discover-plugin",
+    "@kbn/data-plugin",
+    "@kbn/generate-csv",
+    "@kbn/core-http-server",
+    "@kbn/reporting-server",
+    "@kbn/reporting-export-types-csv-common",
+    "@kbn/reporting-mocks-server",
+    "@kbn/core-http-request-handler-context-server",
+    "@kbn/field-formats-plugin",
+  ]
+}
diff --git a/packages/kbn-reporting/export_types/csv/types.ts b/packages/kbn-reporting/export_types/csv/types.ts
new file mode 100644
index 00000000000000..7d06b67f61381d
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv/types.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { CustomRequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+import { ReportingServerPluginSetup } from '@kbn/reporting-server';
+
+/**
+ * Needed because of CsvSearchSourceImmediateExportType
+ * @internal
+ */
+export type ReportingRequestHandlerContext = CustomRequestHandlerContext<{
+  reporting: ReportingServerPluginSetup | null;
+}>;
diff --git a/packages/kbn-reporting/export_types/csv_common/README.md b/packages/kbn-reporting/export_types/csv_common/README.md
new file mode 100644
index 00000000000000..c74e390257a699
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv_common/README.md
@@ -0,0 +1,3 @@
+# @kbn/reporting-export-types-csv-common
+
+Empty package generated by @kbn/generate
diff --git a/src/plugins/embeddable/public/services.ts b/packages/kbn-reporting/export_types/csv_common/constants.ts
similarity index 63%
rename from src/plugins/embeddable/public/services.ts
rename to packages/kbn-reporting/export_types/csv_common/constants.ts
index 60c4b813119600..d6db2a8c635e20 100644
--- a/src/plugins/embeddable/public/services.ts
+++ b/packages/kbn-reporting/export_types/csv_common/constants.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { ThemeServiceSetup } from '@kbn/core/public';
-import { createGetterSetter } from '@kbn/kibana-utils-plugin/public';
+export const CSV_JOB_TYPE = 'csv_searchsource';
+export const CSV_REPORT_TYPE = 'csv_searchsource';
 
-export const [getTheme, setTheme] = createGetterSetter<ThemeServiceSetup>('Theme');
+export const CSV_JOB_TYPE_V2 = 'csv_v2';
+export const CSV_REPORT_TYPE_V2 = 'csv_v2';
diff --git a/packages/kbn-reporting/export_types/csv_common/index.ts b/packages/kbn-reporting/export_types/csv_common/index.ts
new file mode 100644
index 00000000000000..d15efb06e36828
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv_common/index.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { SerializedSearchSourceFields } from '@kbn/data-plugin/public';
+import type {
+  BaseParams,
+  BaseParamsV2,
+  BasePayload,
+  BasePayloadV2,
+} from '@kbn/reporting-common/types';
+
+export * from './constants';
+
+export interface JobParamsDownloadCSV {
+  browserTimezone: string;
+  title: string;
+  searchSource: SerializedSearchSourceFields;
+  columns?: string[];
+}
+
+interface BaseParamsCSV {
+  searchSource: SerializedSearchSourceFields;
+  columns?: string[];
+}
+
+export type JobParamsCSV = BaseParamsCSV & BaseParams;
+export type TaskPayloadCSV = BaseParamsCSV & BasePayload;
+
+interface CsvFromSavedObjectBase {
+  objectType: 'search';
+}
+
+/**
+ * Makes title optional, as it can be derived from the saved search object
+ */
+export type JobParamsCsvFromSavedObject = CsvFromSavedObjectBase &
+  Omit<BaseParamsV2, 'title'> & { title?: string };
+
+export type TaskPayloadCsvFromSavedObject = CsvFromSavedObjectBase & BasePayloadV2;
+
+export const CSV_REPORTING_ACTION = 'downloadCsvReport';
+
+export const CSV_SEARCHSOURCE_IMMEDIATE_TYPE = 'csv_searchsource_immediate';
+
+// This is deprecated because it lacks support for runtime fields
+// but the extension points are still needed for pre-existing scripted automation, until 8.0
+export const CSV_REPORT_TYPE_DEPRECATED = 'CSV';
+export const CSV_JOB_TYPE_DEPRECATED = 'csv';
diff --git a/packages/kbn-reporting/export_types/csv_common/kibana.jsonc b/packages/kbn-reporting/export_types/csv_common/kibana.jsonc
new file mode 100644
index 00000000000000..10e347c55ab5e7
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv_common/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/reporting-export-types-csv-common",
+  "owner": "@elastic/appex-sharedux"
+}
diff --git a/packages/kbn-reporting/export_types/csv_common/package.json b/packages/kbn-reporting/export_types/csv_common/package.json
new file mode 100644
index 00000000000000..c1785bca2b2085
--- /dev/null
+++ b/packages/kbn-reporting/export_types/csv_common/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/reporting-export-types-csv-common",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/packages/kbn-generate-csv-types/tsconfig.json b/packages/kbn-reporting/export_types/csv_common/tsconfig.json
similarity index 75%
rename from packages/kbn-generate-csv-types/tsconfig.json
rename to packages/kbn-reporting/export_types/csv_common/tsconfig.json
index a6242129ed177b..27592ed3e537f8 100644
--- a/packages/kbn-generate-csv-types/tsconfig.json
+++ b/packages/kbn-reporting/export_types/csv_common/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.base.json",
+  "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "target/types",
     "types": [
@@ -14,7 +14,7 @@
     "target/**/*"
   ],
   "kbn_references": [
-    "@kbn/config-schema",
     "@kbn/data-plugin",
+    "@kbn/reporting-common",
   ]
 }
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts b/packages/kbn-reporting/export_types/pdf/generate_pdf.ts
similarity index 67%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
rename to packages/kbn-reporting/export_types/pdf/generate_pdf.ts
index e5c19292ab73d6..5703e16e48abc1 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
+++ b/packages/kbn-reporting/export_types/pdf/generate_pdf.ts
@@ -1,29 +1,29 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import * as Rx from 'rxjs';
+import { Observable } from 'rxjs';
 import { mergeMap, tap } from 'rxjs/operators';
-import { PdfScreenshotResult } from '@kbn/screenshotting-plugin/server';
-import { PdfScreenshotOptions } from '../../../types';
-import type { PdfMetrics } from '../../../../common/types';
-import { getTracker } from '../../common/pdf_tracker';
+
+import type { PdfScreenshotOptions, PdfScreenshotResult } from '@kbn/screenshotting-plugin/server';
+import { getTracker } from './pdf_tracker';
 
 interface PdfResult {
   buffer: Uint8Array | null;
-  metrics?: PdfMetrics;
+  metrics?: PdfScreenshotResult['metrics'];
   warnings: string[];
 }
 
-type GetScreenshotsFn = (options: PdfScreenshotOptions) => Rx.Observable<PdfScreenshotResult>;
+type GetScreenshotsFn = (options: PdfScreenshotOptions) => Observable<PdfScreenshotResult>;
 
 export function generatePdfObservable(
   getScreenshots: GetScreenshotsFn,
   options: PdfScreenshotOptions
-): Rx.Observable<PdfResult> {
+): Observable<PdfResult> {
   const tracker = getTracker();
   tracker.startScreenshots();
 
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts b/packages/kbn-reporting/export_types/pdf/generate_pdf_v2.ts
similarity index 60%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts
rename to packages/kbn-reporting/export_types/pdf/generate_pdf_v2.ts
index 7ab96553f3cd8b..54489c6258bd8d 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts
+++ b/packages/kbn-reporting/export_types/pdf/generate_pdf_v2.ts
@@ -1,37 +1,38 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import * as Rx from 'rxjs';
+import { Observable } from 'rxjs';
 import { mergeMap, tap } from 'rxjs/operators';
-import { PdfScreenshotResult } from '@kbn/screenshotting-plugin/server';
-import { TaskPayloadPDFV2 } from '../../../../common/types/export_types/printable_pdf_v2';
-import { ReportingServerInfo } from '../../../core';
-import { ReportingConfigType } from '../../../config';
-import type { LocatorParams, PdfMetrics, UrlOrUrlLocatorTuple } from '../../../../common/types';
-import type { PdfScreenshotOptions } from '../../../types';
-import { getFullRedirectAppUrl } from '../../common/v2/get_full_redirect_app_url';
-import { getTracker } from '../../common/pdf_tracker';
+
+import type { LocatorParams, ReportingServerInfo } from '@kbn/reporting-common/types';
+import type { TaskPayloadPDFV2 } from '@kbn/reporting-export-types-pdf-common';
+import type { PdfScreenshotOptions, PdfScreenshotResult } from '@kbn/screenshotting-plugin/server';
+import type { UrlOrUrlWithContext } from '@kbn/screenshotting-plugin/server/screenshots';
+import { type ReportingConfigType, getFullRedirectAppUrl } from '@kbn/reporting-server';
+
+import { getTracker } from './pdf_tracker';
 
 interface PdfResult {
   buffer: Uint8Array | null;
-  metrics?: PdfMetrics;
+  metrics?: PdfScreenshotResult['metrics'];
   warnings: string[];
 }
 
-type GetScreenshotsFn = (options: PdfScreenshotOptions) => Rx.Observable<PdfScreenshotResult>;
+type GetScreenshotsFn = (options: PdfScreenshotOptions) => Observable<PdfScreenshotResult>;
 
-export function generatePdfObservable(
+export function generatePdfObservableV2(
   config: ReportingConfigType,
   serverInfo: ReportingServerInfo,
   getScreenshots: GetScreenshotsFn,
   job: TaskPayloadPDFV2,
   locatorParams: LocatorParams[],
   options: Omit<PdfScreenshotOptions, 'urls'>
-): Rx.Observable<PdfResult> {
+): Observable<PdfResult> {
   const tracker = getTracker();
   tracker.startScreenshots();
 
@@ -41,7 +42,8 @@ export function generatePdfObservable(
   const urls = locatorParams.map((locator) => [
     getFullRedirectAppUrl(config, serverInfo, job.spaceId, job.forceNow),
     locator,
-  ]) as UrlOrUrlLocatorTuple[];
+  ]) as unknown as UrlOrUrlWithContext[];
+
   const screenshots$ = getScreenshots({ ...options, urls }).pipe(
     tap(({ metrics }) => {
       if (metrics.cpu) {
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_absolute_url.test.ts b/packages/kbn-reporting/export_types/pdf/get_absolute_url.test.ts
similarity index 93%
rename from x-pack/plugins/reporting/server/export_types/common/get_absolute_url.test.ts
rename to packages/kbn-reporting/export_types/pdf/get_absolute_url.test.ts
index 9126660c9446ac..8531bf241b268b 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_absolute_url.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_absolute_url.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { getAbsoluteUrlFactory } from './get_absolute_url';
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_absolute_url.ts b/packages/kbn-reporting/export_types/pdf/get_absolute_url.ts
similarity index 77%
rename from x-pack/plugins/reporting/server/export_types/common/get_absolute_url.ts
rename to packages/kbn-reporting/export_types/pdf/get_absolute_url.ts
index 9f2645fd676132..0077b43d817cf7 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_absolute_url.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_absolute_url.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import url from 'url';
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts b/packages/kbn-reporting/export_types/pdf/get_custom_logo.test.ts
similarity index 84%
rename from x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
rename to packages/kbn-reporting/export_types/pdf/get_custom_logo.test.ts
index 5782bf71c65b19..2fe93289414e47 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_custom_logo.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { coreMock, httpServerMock } from '@kbn/core/server/mocks';
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts b/packages/kbn-reporting/export_types/pdf/get_custom_logo.ts
similarity index 74%
rename from x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts
rename to packages/kbn-reporting/export_types/pdf/get_custom_logo.ts
index a27c93c538b6fa..3229a7bd2422be 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_custom_logo.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_custom_logo.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { Headers, IUiSettingsClient } from '@kbn/core/server';
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts b/packages/kbn-reporting/export_types/pdf/get_full_urls.test.ts
similarity index 91%
rename from x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
rename to packages/kbn-reporting/export_types/pdf/get_full_urls.test.ts
index 4621758e47a0e3..46a4293a26b377 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_full_urls.test.ts
@@ -1,17 +1,19 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { ReportingServerInfo } from '../../core';
-import { TaskPayloadPDF } from '../printable_pdf/types';
+import type { ReportingServerInfo } from '@kbn/reporting-common/types';
+import type { TaskPayloadPDF } from '@kbn/reporting-export-types-pdf-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+
 import { getFullUrls } from './get_full_urls';
-import { ReportingConfigType } from '../../config';
 
 const getMockJob = (base: object) => base as TaskPayloadPDF;
-const mockConfig = { kibanaServer: {} } as unknown as ReportingConfigType;
+const mockConfig = createMockConfigSchema();
 const mockServerInfo: ReportingServerInfo = {
   hostname: 'localhost',
   protocol: 'http',
diff --git a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts b/packages/kbn-reporting/export_types/pdf/get_full_urls.ts
similarity index 85%
rename from x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts
rename to packages/kbn-reporting/export_types/pdf/get_full_urls.ts
index 05b74d43c1bf43..a744295cbd0b4c 100644
--- a/x-pack/plugins/reporting/server/export_types/common/get_full_urls.ts
+++ b/packages/kbn-reporting/export_types/pdf/get_full_urls.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import {
@@ -11,9 +12,11 @@ import {
   UrlWithParsedQuery,
   UrlWithStringQuery,
 } from 'url';
-import { ReportingConfigType } from '../../config';
-import { ReportingServerInfo } from '../../core';
-import { TaskPayloadPDF } from '../printable_pdf/types';
+
+import type { ReportingServerInfo } from '@kbn/reporting-common/types';
+import type { TaskPayloadPDF } from '@kbn/reporting-export-types-pdf-common';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+
 import { getAbsoluteUrlFactory } from './get_absolute_url';
 import { validateUrls } from './validate_urls';
 
@@ -44,7 +47,7 @@ export function getFullUrls(
   validateUrls(relativeUrls);
 
   const urls = relativeUrls.map((relativeUrl) => {
-    const parsedRelative: UrlWithStringQuery = urlParse(relativeUrl); // FIXME: '(urlStr: string): UrlWithStringQuery' is deprecated
+    const parsedRelative: UrlWithStringQuery = urlParse(relativeUrl);
     const jobUrl = getAbsoluteUrl({
       path: parsedRelative.pathname === null ? undefined : parsedRelative.pathname,
       hash: parsedRelative.hash === null ? undefined : parsedRelative.hash,
diff --git a/packages/kbn-reporting/export_types/pdf/index.ts b/packages/kbn-reporting/export_types/pdf/index.ts
new file mode 100644
index 00000000000000..e4ce328f9026e5
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { PdfExportType } from './printable_pdf_v2';
+export { PdfV1ExportType } from './printable_pdf';
diff --git a/packages/kbn-reporting/export_types/pdf/jest.config.js b/packages/kbn-reporting/export_types/pdf/jest.config.js
new file mode 100644
index 00000000000000..eb1d1bff052d01
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/export_types/pdf'],
+};
diff --git a/packages/kbn-reporting/export_types/pdf/kibana.jsonc b/packages/kbn-reporting/export_types/pdf/kibana.jsonc
new file mode 100644
index 00000000000000..1cc83f4395e21e
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+    "type": "shared-server",
+    "id": "@kbn/reporting-export-types-pdf",
+    "owner": "@elastic/appex-sharedux"
+  }
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/pdf/package.json b/packages/kbn-reporting/export_types/pdf/package.json
new file mode 100644
index 00000000000000..d894a03ff7b56a
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "@kbn/reporting-export-types-pdf",
+    "private": true,
+    "version": "1.0.0",
+    "license": "SSPL-1.0 OR Elastic License 2.0"
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/reporting/server/export_types/common/pdf_tracker.ts b/packages/kbn-reporting/export_types/pdf/pdf_tracker.ts
similarity index 85%
rename from x-pack/plugins/reporting/server/export_types/common/pdf_tracker.ts
rename to packages/kbn-reporting/export_types/pdf/pdf_tracker.ts
index 80d1776f994f38..0af96118d993b8 100644
--- a/x-pack/plugins/reporting/server/export_types/common/pdf_tracker.ts
+++ b/packages/kbn-reporting/export_types/pdf/pdf_tracker.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import apm from 'elastic-apm-node';
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.test.ts b/packages/kbn-reporting/export_types/pdf/printable_pdf.test.ts
similarity index 76%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.test.ts
rename to packages/kbn-reporting/export_types/pdf/printable_pdf.test.ts
index 32e0bc3e9b9218..9ca0fa34effcdd 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/printable_pdf.test.ts
@@ -1,31 +1,31 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import * as Rx from 'rxjs';
-import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
+import { of } from 'rxjs';
 import { Writable } from 'stream';
+
+import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { CancellationToken } from '@kbn/reporting-common';
-import { generatePdfObservable } from './lib/generate_pdf';
-import { cryptoFactory } from '../../lib/crypto';
-import { TaskPayloadPDF } from './types';
-import { PdfV1ExportType } from './printable_pdf';
+import { TaskPayloadPDF } from '@kbn/reporting-export-types-pdf-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import { cryptoFactory } from '@kbn/reporting-server';
 import { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
 
-jest.mock('./lib/generate_pdf');
+import { PdfV1ExportType } from '.';
+import { generatePdfObservable } from './generate_pdf';
+
+jest.mock('./generate_pdf');
 
 let content: string;
 let mockPdfExportType: PdfV1ExportType;
 let stream: jest.Mocked<Writable>;
 
-const cancellationToken = {
-  on: jest.fn(),
-} as unknown as CancellationToken;
-
+const cancellationToken = new CancellationToken();
 const mockLogger = loggingSystemMock.createLogger();
 
 const mockEncryptionKey = 'testencryptionkey';
@@ -44,7 +44,6 @@ beforeEach(async () => {
 
   const mockCoreSetup = coreMock.createSetup();
   const mockCoreStart = coreMock.createStart();
-  const mockReportingCore = await createMockReportingCore(createMockConfigSchema());
 
   mockPdfExportType = new PdfV1ExportType(mockCoreSetup, configType, mockLogger, context);
 
@@ -56,7 +55,6 @@ beforeEach(async () => {
     savedObjects: mockCoreStart.savedObjects,
     uiSettings: mockCoreStart.uiSettings,
     screenshotting: {} as unknown as ScreenshottingStart,
-    reporting: mockReportingCore.getContract(),
   });
 });
 
@@ -64,7 +62,7 @@ afterEach(() => (generatePdfObservable as jest.Mock).mockReset());
 
 test(`passes browserTimezone to generatePdf`, async () => {
   const encryptedHeaders = await encryptHeaders({});
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from('') }));
+  (generatePdfObservable as jest.Mock).mockReturnValue(of({ buffer: Buffer.from('') }));
 
   const browserTimezone = 'UTC';
   await mockPdfExportType.runTask(
@@ -87,7 +85,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
 test(`returns content_type of application/pdf`, async () => {
   const encryptedHeaders = await encryptHeaders({});
 
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from('') }));
+  (generatePdfObservable as jest.Mock).mockReturnValue(of({ buffer: Buffer.from('') }));
 
   const { content_type: contentType } = await mockPdfExportType.runTask(
     'pdfJobId',
@@ -100,7 +98,7 @@ test(`returns content_type of application/pdf`, async () => {
 
 test(`returns content of generatePdf getBuffer base64 encoded`, async () => {
   const testContent = 'test content';
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from(testContent) }));
+  (generatePdfObservable as jest.Mock).mockReturnValue(of({ buffer: Buffer.from(testContent) }));
 
   const encryptedHeaders = await encryptHeaders({});
   await mockPdfExportType.runTask(
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.ts b/packages/kbn-reporting/export_types/pdf/printable_pdf.ts
similarity index 73%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.ts
rename to packages/kbn-reporting/export_types/pdf/printable_pdf.ts
index 85e656642eb623..6c8ce2a5b1d0d0 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/printable_pdf.ts
+++ b/packages/kbn-reporting/export_types/pdf/printable_pdf.ts
@@ -1,30 +1,42 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { LicenseType } from '@kbn/licensing-plugin/server';
-import { CancellationToken, TaskRunResult } from '@kbn/reporting-common';
-import { Writable } from 'stream';
 import apm from 'elastic-apm-node';
+import { Observable, fromEventPattern, lastValueFrom, of, throwError } from 'rxjs';
 import { catchError, map, mergeMap, takeUntil, tap } from 'rxjs/operators';
-import { fromEventPattern, lastValueFrom, Observable, of, throwError } from 'rxjs';
-import { JobParamsPDFDeprecated } from '../../../common/types';
+import { Writable } from 'stream';
+
+import type { LicenseType } from '@kbn/licensing-plugin/server';
 import {
+  CancellationToken,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
-  PDF_JOB_TYPE,
   REPORTING_TRANSACTION_TYPE,
-} from '../../../common/constants';
-import { decryptJobHeaders, ExportType, getCustomLogo, getFullUrls, validateUrls } from '../common';
-import { TaskPayloadPDF } from './types';
-import { generatePdfObservable } from './lib/generate_pdf';
+} from '@kbn/reporting-common';
+import { TaskRunResult } from '@kbn/reporting-common/types';
+import {
+  JobParamsPDFDeprecated,
+  PDF_JOB_TYPE,
+  TaskPayloadPDF,
+} from '@kbn/reporting-export-types-pdf-common';
+import { ExportType, decryptJobHeaders } from '@kbn/reporting-server';
+
+import { generatePdfObservable } from './generate_pdf';
+import { validateUrls } from './validate_urls';
+import { getCustomLogo } from './get_custom_logo';
+import { getFullUrls } from './get_full_urls';
 
+/**
+ * @deprecated
+ */
 export class PdfV1ExportType extends ExportType<JobParamsPDFDeprecated, TaskPayloadPDF> {
   id = 'printablePdf';
   name = 'PDF';
@@ -83,9 +95,19 @@ export class PdfV1ExportType extends ExportType<JobParamsPDFDeprecated, TaskPayl
         apmGetAssets?.end();
 
         apmGeneratePdf = apmTrans.startSpan('generate-pdf-pipeline', 'execute');
-        //  make a new function that will call reporting.getScreenshots
-        const snapshotFn = () =>
-          this.startDeps.reporting.getScreenshots!({
+
+        return generatePdfObservable(
+          () =>
+            this.startDeps.screenshotting!.getScreenshots({
+              format: 'pdf',
+              title,
+              logo,
+              urls,
+              browserTimezone,
+              headers,
+              layout,
+            }),
+          {
             format: 'pdf',
             title,
             logo,
@@ -93,16 +115,8 @@ export class PdfV1ExportType extends ExportType<JobParamsPDFDeprecated, TaskPayl
             browserTimezone,
             headers,
             layout,
-          });
-        return generatePdfObservable(snapshotFn, {
-          format: 'pdf',
-          title,
-          logo,
-          urls,
-          browserTimezone,
-          headers,
-          layout,
-        });
+          }
+        );
       }),
       tap(({ buffer }) => {
         apmGeneratePdf?.end();
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.test.ts b/packages/kbn-reporting/export_types/pdf/printable_pdf_v2.test.ts
similarity index 74%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.test.ts
rename to packages/kbn-reporting/export_types/pdf/printable_pdf_v2.test.ts
index fd6e6ace45d8f8..4e4f0c14911301 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/printable_pdf_v2.test.ts
@@ -1,32 +1,32 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-jest.mock('./lib/generate_pdf');
+import { of } from 'rxjs';
+import type { Writable } from 'stream';
 
 import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { CancellationToken } from '@kbn/reporting-common';
+import type { LocatorParams } from '@kbn/reporting-common/types';
+import type { TaskPayloadPDFV2 } from '@kbn/reporting-export-types-pdf-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import { cryptoFactory } from '@kbn/reporting-server';
 import type { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
-import * as Rx from 'rxjs';
-import type { Writable } from 'stream';
+
 import { PdfExportType } from '.';
-import type { LocatorParams } from '../../../common';
-import type { TaskPayloadPDFV2 } from '../../../common/types/export_types/printable_pdf_v2';
-import { cryptoFactory } from '../../lib';
-import { generatePdfObservable } from './lib/generate_pdf';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
+import { generatePdfObservableV2 } from './generate_pdf_v2';
+
+jest.mock('./generate_pdf_v2');
 
 let content: string;
 let mockPdfExportType: PdfExportType;
 let stream: jest.Mocked<Writable>;
 
-const cancellationToken = {
-  on: jest.fn(),
-} as unknown as CancellationToken;
-
+const cancellationToken = new CancellationToken();
 const mockLogger = loggingSystemMock.createLogger();
 
 const mockEncryptionKey = 'testencryptionkey';
@@ -50,8 +50,6 @@ beforeEach(async () => {
 
   const mockCoreSetup = coreMock.createSetup();
   const mockCoreStart = coreMock.createStart();
-  const mockReportingCore = await createMockReportingCore(createMockConfigSchema());
-
   mockPdfExportType = new PdfExportType(mockCoreSetup, configType, mockLogger, context);
 
   mockPdfExportType.setup({
@@ -62,15 +60,14 @@ beforeEach(async () => {
     savedObjects: mockCoreStart.savedObjects,
     uiSettings: mockCoreStart.uiSettings,
     screenshotting: {} as unknown as ScreenshottingStart,
-    reporting: mockReportingCore.getContract(),
   });
 });
 
-afterEach(() => (generatePdfObservable as jest.Mock).mockReset());
+afterEach(() => (generatePdfObservableV2 as jest.Mock).mockReset());
 
 test(`passes browserTimezone to generatePdf`, async () => {
   const encryptedHeaders = await encryptHeaders({});
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of(Buffer.from('')));
+  (generatePdfObservableV2 as jest.Mock).mockReturnValue(of(Buffer.from('')));
 
   const browserTimezone = 'UTC';
   await mockPdfExportType.runTask(
@@ -86,7 +83,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
     stream
   );
 
-  expect(generatePdfObservable).toHaveBeenCalledWith(
+  expect(generatePdfObservableV2).toHaveBeenCalledWith(
     expect.anything(),
     expect.anything(),
     expect.anything(),
@@ -99,7 +96,7 @@ test(`passes browserTimezone to generatePdf`, async () => {
 test(`returns content_type of application/pdf`, async () => {
   const encryptedHeaders = await encryptHeaders({});
 
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from('') }));
+  (generatePdfObservableV2 as jest.Mock).mockReturnValue(of({ buffer: Buffer.from('') }));
 
   const { content_type: contentType } = await mockPdfExportType.runTask(
     'pdfJobId',
@@ -112,7 +109,7 @@ test(`returns content_type of application/pdf`, async () => {
 
 test(`returns content of generatePdf getBuffer base64 encoded`, async () => {
   const testContent = 'test content';
-  (generatePdfObservable as jest.Mock).mockReturnValue(Rx.of({ buffer: Buffer.from(testContent) }));
+  (generatePdfObservableV2 as jest.Mock).mockReturnValue(of({ buffer: Buffer.from(testContent) }));
 
   const encryptedHeaders = await encryptHeaders({});
   await mockPdfExportType.runTask(
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.ts b/packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts
similarity index 77%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.ts
rename to packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts
index 862d5908ddb3ce..cc975c536803df 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/printable_pdf_v2.ts
+++ b/packages/kbn-reporting/export_types/pdf/printable_pdf_v2.ts
@@ -1,31 +1,38 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { Headers } from '@kbn/core/server';
-import { CancellationToken, TaskRunResult } from '@kbn/reporting-common';
 import apm from 'elastic-apm-node';
 import * as Rx from 'rxjs';
-import { catchError, map, mergeMap, takeUntil, tap } from 'rxjs';
+import { catchError, map, mergeMap, of, takeUntil, tap } from 'rxjs';
 import { Writable } from 'stream';
+
+import { Headers } from '@kbn/core/server';
 import {
+  CancellationToken,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
+  REPORTING_REDIRECT_LOCATOR_STORE_KEY,
+  REPORTING_TRANSACTION_TYPE,
+} from '@kbn/reporting-common';
+import type { TaskRunResult, UrlOrUrlLocatorTuple } from '@kbn/reporting-common/types';
+import {
+  JobParamsPDFV2,
   PDF_JOB_TYPE_V2,
   PDF_REPORT_TYPE_V2,
-  REPORTING_TRANSACTION_TYPE,
-} from '../../../common/constants';
-import { JobParamsPDFV2, UrlOrUrlLocatorTuple } from '../../../common/types';
-import { TaskPayloadPDFV2 } from '../../../common/types/export_types/printable_pdf_v2';
-import { decryptJobHeaders, ExportType, getCustomLogo } from '../common';
-import { getFullRedirectAppUrl } from '../common/v2/get_full_redirect_app_url';
-import { generatePdfObservable } from './lib/generate_pdf';
+  TaskPayloadPDFV2,
+} from '@kbn/reporting-export-types-pdf-common';
+import { decryptJobHeaders, getFullRedirectAppUrl, ExportType } from '@kbn/reporting-server';
+
+import { generatePdfObservableV2 } from './generate_pdf_v2';
+import { getCustomLogo } from './get_custom_logo';
 
 export class PdfExportType extends ExportType<JobParamsPDFV2, TaskPayloadPDFV2> {
   id = PDF_REPORT_TYPE_V2;
@@ -79,7 +86,7 @@ export class PdfExportType extends ExportType<JobParamsPDFV2, TaskPayloadPDFV2>
     let apmGeneratePdf: { end: () => void } | null | undefined;
     const { encryptionKey } = this.config;
 
-    const process$: Rx.Observable<TaskRunResult> = Rx.of(1).pipe(
+    const process$: Rx.Observable<TaskRunResult> = of(1).pipe(
       mergeMap(() => decryptJobHeaders(encryptionKey, payload.headers, jobLogger)),
       mergeMap(async (headers: Headers) => {
         const fakeRequest = this.getFakeRequest(headers, payload.spaceId, jobLogger);
@@ -98,24 +105,29 @@ export class PdfExportType extends ExportType<JobParamsPDFV2, TaskPayloadPDFV2>
               payload.forceNow
             ),
             locator,
-          ]) as unknown as UrlOrUrlLocatorTuple[];
+          ]);
         }
 
         apmGetAssets?.end();
 
         apmGeneratePdf = apmTrans.startSpan('generate-pdf-pipeline', 'execute');
-        return generatePdfObservable(
+
+        return generatePdfObservableV2(
           this.config,
           this.getServerInfo(),
           () =>
-            this.startDeps.reporting.getScreenshots!({
+            this.startDeps.screenshotting!.getScreenshots({
               format: 'pdf',
               title,
               logo,
               browserTimezone,
               headers,
               layout,
-              urls,
+              urls: urls.map((url) =>
+                typeof url === 'string'
+                  ? url
+                  : [url[0], { [REPORTING_REDIRECT_LOCATOR_STORE_KEY]: url[1] }]
+              ),
             }),
           payload,
           locatorParams,
diff --git a/packages/kbn-reporting/export_types/pdf/tsconfig.json b/packages/kbn-reporting/export_types/pdf/tsconfig.json
new file mode 100644
index 00000000000000..9f778e9cef3bf1
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf/tsconfig.json
@@ -0,0 +1,26 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/core",
+    "@kbn/reporting-common",
+    "@kbn/screenshotting-plugin",
+    "@kbn/reporting-server",
+    "@kbn/licensing-plugin",
+    "@kbn/reporting-export-types-pdf-common",
+    "@kbn/reporting-mocks-server",
+  ]
+}
diff --git a/x-pack/plugins/reporting/server/export_types/common/validate_urls.test.ts b/packages/kbn-reporting/export_types/pdf/validate_urls.test.ts
similarity index 94%
rename from x-pack/plugins/reporting/server/export_types/common/validate_urls.test.ts
rename to packages/kbn-reporting/export_types/pdf/validate_urls.test.ts
index c945802b8342bd..65d95ddd4ed79a 100644
--- a/x-pack/plugins/reporting/server/export_types/common/validate_urls.test.ts
+++ b/packages/kbn-reporting/export_types/pdf/validate_urls.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { validateUrls } from './validate_urls';
diff --git a/x-pack/plugins/reporting/server/export_types/common/validate_urls.ts b/packages/kbn-reporting/export_types/pdf/validate_urls.ts
similarity index 85%
rename from x-pack/plugins/reporting/server/export_types/common/validate_urls.ts
rename to packages/kbn-reporting/export_types/pdf/validate_urls.ts
index e6d392c0bb55c9..e3edb26444043b 100644
--- a/x-pack/plugins/reporting/server/export_types/common/validate_urls.ts
+++ b/packages/kbn-reporting/export_types/pdf/validate_urls.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { parse } from 'url';
diff --git a/packages/kbn-reporting/export_types/pdf_common/README.md b/packages/kbn-reporting/export_types/pdf_common/README.md
new file mode 100644
index 00000000000000..24fe1383b42f03
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/README.md
@@ -0,0 +1,3 @@
+# @kbn/reporting-export-types-pdf-common
+
+Empty package generated by @kbn/generate
diff --git a/packages/kbn-reporting/export_types/pdf_common/constants.ts b/packages/kbn-reporting/export_types/pdf_common/constants.ts
new file mode 100644
index 00000000000000..a91a3da8602d1c
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/constants.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const PDF_JOB_TYPE = 'printable_pdf';
+export const PDF_JOB_TYPE_V2 = 'printable_pdf_v2';
+
+export const PDF_REPORT_TYPE = 'printablePdf';
+export const PDF_REPORT_TYPE_V2 = 'printablePdfV2';
diff --git a/packages/kbn-reporting/export_types/pdf_common/index.ts b/packages/kbn-reporting/export_types/pdf_common/index.ts
new file mode 100644
index 00000000000000..f1ff9a0d02ecf2
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/index.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { BaseParams, BasePayload, LocatorParams } from '@kbn/reporting-common/types';
+import { LayoutParams } from '@kbn/screenshotting-plugin/common';
+
+export * from './constants';
+
+/**
+ * Structure of stored job data provided by create_job
+ */
+export interface TaskPayloadPDF extends BasePayload {
+  layout: LayoutParams;
+  forceNow?: string;
+  objects: Array<{ relativeUrl: string }>;
+}
+
+interface BaseParamsPDFV2 {
+  layout: LayoutParams;
+
+  /**
+   * This value is used to re-create the same visual state as when the report was requested as well as navigate to the correct page.
+   */
+  locatorParams: LocatorParams[];
+}
+
+// Job params: structure of incoming user request data, after being parsed from RISON
+export type JobParamsPDFV2 = BaseParamsPDFV2 & BaseParams;
+
+/**
+ * Public-facing interface
+ * Apps should use this interface to build job params.
+ * browserTimezone and version is provided by Reporting
+ * @public
+ */
+export type JobAppParamsPDFV2 = Omit<JobParamsPDFV2, 'browserTimezone' | 'version'>;
+
+// Job payload: structure of stored job data provided by create_job
+export interface TaskPayloadPDFV2 extends BasePayload, BaseParamsPDFV2 {
+  layout: LayoutParams;
+  /**
+   * The value of forceNow is injected server-side every time a given report is generated.
+   */
+  forceNow: string;
+}
+
+/**
+ * @deprecated
+ */
+interface BaseParamsPDF {
+  layout: LayoutParams;
+  relativeUrls: string[];
+  isDeprecated?: boolean;
+}
+
+/**
+ * @deprecated
+ */
+export type JobParamsPDFDeprecated = BaseParamsPDF & BaseParams;
diff --git a/packages/kbn-reporting/export_types/pdf_common/kibana.jsonc b/packages/kbn-reporting/export_types/pdf_common/kibana.jsonc
new file mode 100644
index 00000000000000..a9aecce082861b
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/reporting-export-types-pdf-common",
+  "owner": "@elastic/appex-sharedux"
+}
diff --git a/packages/kbn-reporting/export_types/pdf_common/package.json b/packages/kbn-reporting/export_types/pdf_common/package.json
new file mode 100644
index 00000000000000..1d0dc201e4ea8e
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/reporting-export-types-pdf-common",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/pdf_common/tsconfig.json b/packages/kbn-reporting/export_types/pdf_common/tsconfig.json
new file mode 100644
index 00000000000000..cb0a7b461eda8a
--- /dev/null
+++ b/packages/kbn-reporting/export_types/pdf_common/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/screenshotting-plugin",
+    "@kbn/reporting-common",
+  ]
+}
diff --git a/x-pack/plugins/reporting/server/export_types/common/generate_png.ts b/packages/kbn-reporting/export_types/png/generate_png.ts
similarity index 74%
rename from x-pack/plugins/reporting/server/export_types/common/generate_png.ts
rename to packages/kbn-reporting/export_types/png/generate_png.ts
index 7bd03c7bffdcd1..d0ce9b97916908 100644
--- a/x-pack/plugins/reporting/server/export_types/common/generate_png.ts
+++ b/packages/kbn-reporting/export_types/png/generate_png.ts
@@ -1,32 +1,32 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import apm from 'elastic-apm-node';
-import type { Logger } from '@kbn/core/server';
-import * as Rx from 'rxjs';
+import { Observable } from 'rxjs';
 import { finalize, map, tap } from 'rxjs/operators';
-import { PngScreenshotResult } from '@kbn/screenshotting-plugin/server';
-import { REPORTING_TRANSACTION_TYPE } from '../../../common/constants';
-import type { PngMetrics } from '../../../common/types';
-import type { PngScreenshotOptions } from '../../types';
+
+import type { Logger } from '@kbn/logging';
+import { REPORTING_TRANSACTION_TYPE } from '@kbn/reporting-common/constants';
+import type { PngScreenshotOptions, PngScreenshotResult } from '@kbn/screenshotting-plugin/server';
 
 interface PngResult {
   buffer: Buffer;
-  metrics?: PngMetrics;
+  metrics?: PngScreenshotResult['metrics'];
   warnings: string[];
 }
 
-type GetScreenshotsFn = (options: PngScreenshotOptions) => Rx.Observable<PngScreenshotResult>;
+type GetScreenshotsFn = (options: PngScreenshotOptions) => Observable<PngScreenshotResult>;
 
 export function generatePngObservable(
   getScreenshots: GetScreenshotsFn,
   logger: Logger,
   options: Omit<PngScreenshotOptions, 'format'>
-): Rx.Observable<PngResult> {
+): Observable<PngResult> {
   const apmTrans = apm.startTransaction('generate-png', REPORTING_TRANSACTION_TYPE);
   if (!options.layout?.dimensions) {
     throw new Error(`LayoutParams.Dimensions is undefined.`);
diff --git a/src/plugins/kibana_react/public/toolbar_button/index.ts b/packages/kbn-reporting/export_types/png/index.ts
similarity index 89%
rename from src/plugins/kibana_react/public/toolbar_button/index.ts
rename to packages/kbn-reporting/export_types/png/index.ts
index af21f700901b9e..551255cb5d112c 100644
--- a/src/plugins/kibana_react/public/toolbar_button/index.ts
+++ b/packages/kbn-reporting/export_types/png/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export * from './toolbar_button';
+export { PngExportType } from './png_v2';
diff --git a/packages/kbn-reporting/export_types/png/jest.config.js b/packages/kbn-reporting/export_types/png/jest.config.js
new file mode 100644
index 00000000000000..467708b5bfe9f7
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/export_types/png'],
+};
diff --git a/packages/kbn-reporting/export_types/png/kibana.jsonc b/packages/kbn-reporting/export_types/png/kibana.jsonc
new file mode 100644
index 00000000000000..b8923806260fb6
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+    "type": "shared-server",
+    "id": "@kbn/reporting-export-types-png",
+    "owner": "@elastic/appex-sharedux"
+  }
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/png/package.json b/packages/kbn-reporting/export_types/png/package.json
new file mode 100644
index 00000000000000..1983ed65439442
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "@kbn/reporting-export-types-png",
+    "private": true,
+    "version": "1.0.0",
+    "license": "SSPL-1.0 OR Elastic License 2.0"
+  }
\ No newline at end of file
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/png_v2.test.ts b/packages/kbn-reporting/export_types/png/png_v2.test.ts
similarity index 76%
rename from x-pack/plugins/reporting/server/export_types/png_v2/png_v2.test.ts
rename to packages/kbn-reporting/export_types/png/png_v2.test.ts
index 8b142b7ba765a6..a6cc8b1891eef3 100644
--- a/x-pack/plugins/reporting/server/export_types/png_v2/png_v2.test.ts
+++ b/packages/kbn-reporting/export_types/png/png_v2.test.ts
@@ -1,34 +1,32 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import * as Rx from 'rxjs';
-import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { Writable } from 'stream';
+
+import { coreMock, elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { CancellationToken } from '@kbn/reporting-common';
-import { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
-import { ReportingCore } from '../..';
-import { LocatorParams } from '../../../common/types';
-import { cryptoFactory } from '../../lib';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
-import { generatePngObservable } from '../common';
-import { TaskPayloadPNGV2 } from './types';
-import { PngExportType } from './png_v2';
+import type { LocatorParams } from '@kbn/reporting-common/types';
+import type { TaskPayloadPNGV2 } from '@kbn/reporting-export-types-png-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import { cryptoFactory } from '@kbn/reporting-server';
+import type { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
 
-jest.mock('../common/generate_png');
+import { PngExportType } from '.';
+import { generatePngObservable } from './generate_png';
+
+jest.mock('./generate_png');
 
 let content: string;
-let mockReportingCore: ReportingCore;
 let mockPngExportType: PngExportType;
 let stream: jest.Mocked<Writable>;
 
-const cancellationToken = {
-  on: jest.fn(),
-} as unknown as CancellationToken;
-
+const cancellationToken = new CancellationToken();
 const mockLogger = loggingSystemMock.createLogger();
 
 const mockEncryptionKey = 'abcabcsecuresecret';
@@ -51,7 +49,6 @@ beforeEach(async () => {
     },
   });
 
-  mockReportingCore = await createMockReportingCore(configType);
   const context = coreMock.createPluginInitializerContext(configType);
 
   const mockCoreSetup = coreMock.createSetup();
@@ -66,7 +63,6 @@ beforeEach(async () => {
     uiSettings: mockCoreStart.uiSettings,
     screenshotting: {} as unknown as ScreenshottingStart,
     esClient: elasticsearchServiceMock.createClusterClient(),
-    reporting: mockReportingCore.getContract(),
   });
 });
 
@@ -81,7 +77,7 @@ test(`passes browserTimezone to generatePng`, async () => {
     'pngJobId',
     getBasePayload({
       forceNow: 'test',
-      locatorParams: [{ version: 'test', id: 'test', params: {} }] as LocatorParams[],
+      locatorParams: [],
       browserTimezone,
       headers: encryptedHeaders,
     }),
@@ -93,14 +89,9 @@ test(`passes browserTimezone to generatePng`, async () => {
     expect.anything(),
     expect.anything(),
     expect.objectContaining({
-      urls: [
-        [
-          'http://localhost:80/mock-server-basepath/app/reportingRedirect?forceNow=test',
-          { id: 'test', params: {}, version: 'test' },
-        ],
-      ],
       browserTimezone: 'UTC',
       headers: {},
+      layout: { id: 'preserve_layout' },
     })
   );
 });
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/png_v2.ts b/packages/kbn-reporting/export_types/png/png_v2.ts
similarity index 79%
rename from x-pack/plugins/reporting/server/export_types/png_v2/png_v2.ts
rename to packages/kbn-reporting/export_types/png/png_v2.ts
index 6afac5dacb4cb9..15f0c26d459325 100644
--- a/x-pack/plugins/reporting/server/export_types/png_v2/png_v2.ts
+++ b/packages/kbn-reporting/export_types/png/png_v2.ts
@@ -1,13 +1,12 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
+
 import apm from 'elastic-apm-node';
-import { LicenseType } from '@kbn/licensing-plugin/server';
-import { CancellationToken, TaskRunResult } from '@kbn/reporting-common';
-import { Writable } from 'stream';
 import {
   finalize,
   fromEventPattern,
@@ -19,21 +18,29 @@ import {
   takeUntil,
   tap,
 } from 'rxjs';
-import { SerializableRecord } from '@kbn/utility-types';
-import { LocatorParams } from '../../../common';
+import { Writable } from 'stream';
+
+import type { LicenseType } from '@kbn/licensing-plugin/server';
 import {
+  CancellationToken,
   LICENSE_TYPE_CLOUD_STANDARD,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
   LICENSE_TYPE_PLATINUM,
   LICENSE_TYPE_TRIAL,
+  REPORTING_REDIRECT_LOCATOR_STORE_KEY,
+  REPORTING_TRANSACTION_TYPE,
+} from '@kbn/reporting-common';
+import type { TaskRunResult } from '@kbn/reporting-common/types';
+import {
+  JobParamsPNGV2,
   PNG_JOB_TYPE_V2,
   PNG_REPORT_TYPE_V2,
-  REPORTING_TRANSACTION_TYPE,
-} from '../../../common/constants';
-import { decryptJobHeaders, ExportType, generatePngObservable } from '../common';
-import { JobParamsPNGV2, TaskPayloadPNGV2 } from './types';
-import { getFullRedirectAppUrl } from '../common/v2/get_full_redirect_app_url';
+  TaskPayloadPNGV2,
+} from '@kbn/reporting-export-types-png-common';
+import { decryptJobHeaders, getFullRedirectAppUrl, ExportType } from '@kbn/reporting-server';
+
+import { generatePngObservable } from './generate_png';
 
 export class PngExportType extends ExportType<JobParamsPNGV2, TaskPayloadPNGV2> {
   id = PNG_REPORT_TYPE_V2;
@@ -61,7 +68,7 @@ export class PngExportType extends ExportType<JobParamsPNGV2, TaskPayloadPNGV2>
   public createJob = async ({ locatorParams, ...jobParams }: JobParamsPNGV2) => {
     return {
       ...jobParams,
-      locatorParams: [locatorParams] as unknown as LocatorParams<SerializableRecord>,
+      locatorParams: [locatorParams],
       isDeprecated: false,
       browserTimezone: jobParams.browserTimezone,
       forceNow: new Date().toISOString(),
@@ -104,18 +111,17 @@ export class PngExportType extends ExportType<JobParamsPNGV2, TaskPayloadPNGV2>
 
         return generatePngObservable(
           () =>
-            this.startDeps.reporting.getScreenshots!({
+            this.startDeps.screenshotting!.getScreenshots({
               format: 'png',
               headers,
               layout: { ...payload.layout, id: 'preserve_layout' },
-              urls: [[url, locatorParams]],
+              urls: [[url, { [REPORTING_REDIRECT_LOCATOR_STORE_KEY]: locatorParams }]],
             }),
           jobLogger,
           {
             headers,
             browserTimezone: payload.browserTimezone,
             layout: { ...payload.layout, id: 'preserve_layout' },
-            urls: [[url, locatorParams]],
           }
         );
       }),
diff --git a/packages/kbn-reporting/export_types/png/tsconfig.json b/packages/kbn-reporting/export_types/png/tsconfig.json
new file mode 100644
index 00000000000000..bac09188079b58
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png/tsconfig.json
@@ -0,0 +1,28 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/reporting-common",
+    "@kbn/licensing-plugin",
+    "@kbn/screenshotting-plugin",
+    "@kbn/reporting-server",
+    "@kbn/reporting-export-types-png-common",
+    "@kbn/core",
+    "@kbn/reporting-mocks-server",
+    "@kbn/logging",
+  ]
+}
diff --git a/packages/kbn-reporting/export_types/png_common/README.md b/packages/kbn-reporting/export_types/png_common/README.md
new file mode 100644
index 00000000000000..c88edfc9cf8f08
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png_common/README.md
@@ -0,0 +1,3 @@
+# @kbn/reporting-export-types-png-common
+
+Empty package generated by @kbn/generate
diff --git a/packages/kbn-reporting/export_types/png_common/constants.ts b/packages/kbn-reporting/export_types/png_common/constants.ts
new file mode 100644
index 00000000000000..b19732cd417ce8
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png_common/constants.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const PNG_REPORT_TYPE = 'PNG';
+export const PNG_REPORT_TYPE_V2 = 'pngV2';
+
+export const PNG_JOB_TYPE = 'PNG';
+export const PNG_JOB_TYPE_V2 = 'PNGV2';
diff --git a/x-pack/plugins/reporting/common/types/export_types/png_v2.ts b/packages/kbn-reporting/export_types/png_common/index.ts
similarity index 53%
rename from x-pack/plugins/reporting/common/types/export_types/png_v2.ts
rename to packages/kbn-reporting/export_types/png_common/index.ts
index ff3ff5a692edb2..4b2b381fbc059d 100644
--- a/x-pack/plugins/reporting/common/types/export_types/png_v2.ts
+++ b/packages/kbn-reporting/export_types/png_common/index.ts
@@ -1,15 +1,27 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import type { LayoutParams } from '@kbn/screenshotting-plugin/common';
-import type { LocatorParams } from '../url';
-import type { BaseParams, BasePayload } from '../base';
+import type { BaseParams, BasePayload, LocatorParams } from '@kbn/reporting-common/types';
+import { LayoutParams } from '@kbn/screenshotting-plugin/common';
+
+export * from './constants';
+
+interface BaseParamsPNG {
+  layout: LayoutParams;
+  forceNow?: string;
+  relativeUrl: string;
+}
+
+export type JobParamsPNGDeprecated = BaseParamsPNG & BaseParams;
+
+// Job payload: structure of stored job data provided by create_job
+export type TaskPayloadPNG = BaseParamsPNG & BasePayload;
 
-// Job params: structure of incoming user request data
 export interface JobParamsPNGV2 extends BaseParams {
   layout: LayoutParams;
   /**
diff --git a/packages/kbn-reporting/export_types/png_common/kibana.jsonc b/packages/kbn-reporting/export_types/png_common/kibana.jsonc
new file mode 100644
index 00000000000000..0c0b7259864ce7
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png_common/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/reporting-export-types-png-common",
+  "owner": "@elastic/appex-sharedux"
+}
diff --git a/packages/kbn-reporting/export_types/png_common/package.json b/packages/kbn-reporting/export_types/png_common/package.json
new file mode 100644
index 00000000000000..4c25b1d74e04b9
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png_common/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/reporting-export-types-png-common",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/packages/kbn-reporting/export_types/png_common/tsconfig.json b/packages/kbn-reporting/export_types/png_common/tsconfig.json
new file mode 100644
index 00000000000000..cb0a7b461eda8a
--- /dev/null
+++ b/packages/kbn-reporting/export_types/png_common/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/screenshotting-plugin",
+    "@kbn/reporting-common",
+  ]
+}
diff --git a/packages/kbn-reporting/mocks_server/README.md b/packages/kbn-reporting/mocks_server/README.md
new file mode 100644
index 00000000000000..b77e23746b551c
--- /dev/null
+++ b/packages/kbn-reporting/mocks_server/README.md
@@ -0,0 +1,3 @@
+# @kbn/reporting-mocks-server
+
+Empty package generated by @kbn/generate
diff --git a/packages/kbn-reporting/mocks_server/index.ts b/packages/kbn-reporting/mocks_server/index.ts
new file mode 100644
index 00000000000000..8367754a97f34d
--- /dev/null
+++ b/packages/kbn-reporting/mocks_server/index.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { DeepPartial } from 'utility-types';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+
+export const createMockConfigSchema = (
+  overrides: DeepPartial<ReportingConfigType> = {}
+): ReportingConfigType => {
+  // deeply merge the defaults and the provided partial schema
+  return {
+    index: '.reporting',
+    encryptionKey: 'cool-encryption-key-where-did-you-find-it',
+    ...overrides,
+    kibanaServer: {
+      hostname: 'localhost',
+      ...overrides.kibanaServer,
+    },
+    queue: {
+      indexInterval: 'week',
+      pollEnabled: true,
+      pollInterval: 3000,
+      timeout: 120000,
+      ...overrides.queue,
+    },
+    csv: {
+      scroll: { size: 500, duration: '30s' },
+      ...overrides.csv,
+    },
+    roles: {
+      enabled: false,
+      ...overrides.roles,
+    },
+    capture: { maxAttempts: 1 },
+    export_types: {
+      pdf: { enabled: true },
+      png: { enabled: true },
+      csv: { enabled: true },
+      ...overrides.export_types,
+    },
+    statefulSettings: { enabled: true },
+  } as ReportingConfigType;
+};
diff --git a/packages/kbn-reporting/mocks_server/jest.config.js b/packages/kbn-reporting/mocks_server/jest.config.js
new file mode 100644
index 00000000000000..ce39471ef378ad
--- /dev/null
+++ b/packages/kbn-reporting/mocks_server/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/mocks_server'],
+};
diff --git a/packages/kbn-generate-csv-types/kibana.jsonc b/packages/kbn-reporting/mocks_server/kibana.jsonc
similarity index 63%
rename from packages/kbn-generate-csv-types/kibana.jsonc
rename to packages/kbn-reporting/mocks_server/kibana.jsonc
index 349c85eff25584..e9c9707b67a2a4 100644
--- a/packages/kbn-generate-csv-types/kibana.jsonc
+++ b/packages/kbn-reporting/mocks_server/kibana.jsonc
@@ -1,5 +1,5 @@
 {
   "type": "shared-common",
-  "id": "@kbn/generate-csv-types",
+  "id": "@kbn/reporting-mocks-server",
   "owner": "@elastic/appex-sharedux"
 }
diff --git a/packages/kbn-reporting/mocks_server/package.json b/packages/kbn-reporting/mocks_server/package.json
new file mode 100644
index 00000000000000..88b3ac47155693
--- /dev/null
+++ b/packages/kbn-reporting/mocks_server/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/reporting-mocks-server",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/packages/kbn-reporting/mocks_server/tsconfig.json b/packages/kbn-reporting/mocks_server/tsconfig.json
new file mode 100644
index 00000000000000..ef36887c668e23
--- /dev/null
+++ b/packages/kbn-reporting/mocks_server/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/reporting-server",
+  ]
+}
diff --git a/packages/kbn-reporting/public/README.md b/packages/kbn-reporting/public/README.md
new file mode 100644
index 00000000000000..76d4926820b7f8
--- /dev/null
+++ b/packages/kbn-reporting/public/README.md
@@ -0,0 +1,3 @@
+# @kbn/reporting-public
+
+Empty package generated by @kbn/generate
diff --git a/packages/kbn-reporting/public/index.ts b/packages/kbn-reporting/public/index.ts
new file mode 100644
index 00000000000000..7168d6768c5a2c
--- /dev/null
+++ b/packages/kbn-reporting/public/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type { ClientConfigType } from './types';
diff --git a/packages/kbn-reporting/public/jest.config.js b/packages/kbn-reporting/public/jest.config.js
new file mode 100644
index 00000000000000..9b1a02aee8ea62
--- /dev/null
+++ b/packages/kbn-reporting/public/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/public'],
+};
diff --git a/packages/kbn-reporting/public/kibana.jsonc b/packages/kbn-reporting/public/kibana.jsonc
new file mode 100644
index 00000000000000..c813e18f70e8ed
--- /dev/null
+++ b/packages/kbn-reporting/public/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-browser",
+  "id": "@kbn/reporting-public",
+  "owner": "@elastic/appex-sharedux"
+}
diff --git a/packages/kbn-generate-csv-types/package.json b/packages/kbn-reporting/public/package.json
similarity index 70%
rename from packages/kbn-generate-csv-types/package.json
rename to packages/kbn-reporting/public/package.json
index 7c34b87f1524a4..b9a4abf894c64c 100644
--- a/packages/kbn-generate-csv-types/package.json
+++ b/packages/kbn-reporting/public/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@kbn/generate-csv-types",
+  "name": "@kbn/reporting-public",
   "private": true,
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0"
diff --git a/packages/kbn-reporting/public/tsconfig.json b/packages/kbn-reporting/public/tsconfig.json
new file mode 100644
index 00000000000000..6d27b06d5f8ba8
--- /dev/null
+++ b/packages/kbn-reporting/public/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": []
+}
diff --git a/packages/kbn-reporting/public/types.ts b/packages/kbn-reporting/public/types.ts
new file mode 100644
index 00000000000000..34aa52544ca76c
--- /dev/null
+++ b/packages/kbn-reporting/public/types.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export interface ClientConfigType {
+  poll: { jobsRefresh: { interval: number; intervalErrorMultiplier: number } };
+  roles: { enabled: boolean };
+  export_types: { pdf: { enabled: boolean }; png: { enabled: boolean }; csv: { enabled: boolean } };
+  statefulSettings: { enabled: boolean };
+}
diff --git a/x-pack/plugins/reporting/server/config/__snapshots__/schema.test.ts.snap b/packages/kbn-reporting/server/__snapshots__/config_schema.test.ts.snap
similarity index 100%
rename from x-pack/plugins/reporting/server/config/__snapshots__/schema.test.ts.snap
rename to packages/kbn-reporting/server/__snapshots__/config_schema.test.ts.snap
diff --git a/x-pack/plugins/reporting/server/config/schema.test.ts b/packages/kbn-reporting/server/config_schema.test.ts
similarity index 94%
rename from x-pack/plugins/reporting/server/config/schema.test.ts
rename to packages/kbn-reporting/server/config_schema.test.ts
index f30be71db09ea1..069218e9880191 100644
--- a/x-pack/plugins/reporting/server/config/schema.test.ts
+++ b/packages/kbn-reporting/server/config_schema.test.ts
@@ -1,11 +1,12 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { ConfigSchema } from './schema';
+import { ConfigSchema } from './config_schema';
 
 describe('Reporting Config Schema', () => {
   it(`context {"dev":false,"dist":false} produces correct config`, () => {
diff --git a/x-pack/plugins/reporting/server/config/schema.ts b/packages/kbn-reporting/server/config_schema.ts
similarity index 94%
rename from x-pack/plugins/reporting/server/config/schema.ts
rename to packages/kbn-reporting/server/config_schema.ts
index ff0cda89a693b7..3aab7be6e660c4 100644
--- a/x-pack/plugins/reporting/server/config/schema.ts
+++ b/packages/kbn-reporting/server/config_schema.ts
@@ -1,11 +1,12 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { ByteSizeValue, offeringBasedSchema, schema, TypeOf } from '@kbn/config-schema';
+import { ByteSizeValue, offeringBasedSchema, schema } from '@kbn/config-schema';
 import ipaddr from 'ipaddr.js';
 import { sum } from 'lodash';
 import moment from 'moment';
@@ -147,5 +148,3 @@ export const ConfigSchema = schema.object({
   export_types: ExportTypeSchema,
   statefulSettings: SettingsSchema,
 });
-
-export type ReportingConfigType = TypeOf<typeof ConfigSchema>;
diff --git a/x-pack/plugins/reporting/server/lib/crypto.ts b/packages/kbn-reporting/server/crypto.ts
similarity index 68%
rename from x-pack/plugins/reporting/server/lib/crypto.ts
rename to packages/kbn-reporting/server/crypto.ts
index 40a2298eb0fdc8..fd812f98685967 100644
--- a/x-pack/plugins/reporting/server/lib/crypto.ts
+++ b/packages/kbn-reporting/server/crypto.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import nodeCrypto from '@elastic/node-crypto';
diff --git a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.test.ts b/packages/kbn-reporting/server/decrypt_job_headers.test.ts
similarity index 84%
rename from x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.test.ts
rename to packages/kbn-reporting/server/decrypt_job_headers.test.ts
index a65be580adca31..b4515e29d1efa3 100644
--- a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.test.ts
+++ b/packages/kbn-reporting/server/decrypt_job_headers.test.ts
@@ -1,13 +1,13 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { loggingSystemMock } from '@kbn/core/server/mocks';
-import { cryptoFactory } from '../../lib';
-import { decryptJobHeaders } from '.';
+import { cryptoFactory, decryptJobHeaders } from '.';
 
 const logger = loggingSystemMock.createLogger();
 
diff --git a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts b/packages/kbn-reporting/server/decrypt_job_headers.ts
similarity index 76%
rename from x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts
rename to packages/kbn-reporting/server/decrypt_job_headers.ts
index 13b8b4804e6fb8..35c31e2a10dad4 100644
--- a/x-pack/plugins/reporting/server/export_types/common/decrypt_job_headers.ts
+++ b/packages/kbn-reporting/server/decrypt_job_headers.ts
@@ -1,13 +1,14 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { i18n } from '@kbn/i18n';
 import type { Logger } from '@kbn/core/server';
-import { cryptoFactory } from '../../lib';
+import { cryptoFactory } from './crypto';
 
 export const decryptJobHeaders = async (
   encryptionKey: string | undefined,
@@ -17,7 +18,7 @@ export const decryptJobHeaders = async (
   try {
     if (typeof headers !== 'string') {
       throw new Error(
-        i18n.translate('xpack.reporting.exportTypes.common.missingJobHeadersErrorMessage', {
+        i18n.translate('reporting.commonExportTypesHelpers.missingJobHeadersErrorMessage', {
           defaultMessage: 'Job headers are missing',
         })
       );
@@ -30,7 +31,7 @@ export const decryptJobHeaders = async (
 
     throw new Error(
       i18n.translate(
-        'xpack.reporting.exportTypes.common.failedToDecryptReportJobDataErrorMessage',
+        'reporting.commonExportTypesHelpers.failedToDecryptReportJobDataErrorMessage',
         {
           defaultMessage:
             'Failed to decrypt report job data. Please ensure that {encryptionKey} is set and re-generate this report. {err}',
diff --git a/x-pack/plugins/reporting/server/export_types/common/export_type.ts b/packages/kbn-reporting/server/export_type.ts
similarity index 68%
rename from x-pack/plugins/reporting/server/export_types/common/export_type.ts
rename to packages/kbn-reporting/server/export_type.ts
index 96240863122d0a..7765fe6dd7e261 100644
--- a/x-pack/plugins/reporting/server/export_types/common/export_type.ts
+++ b/packages/kbn-reporting/server/export_type.ts
@@ -1,32 +1,34 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import {
-  IBasePath,
-  Headers,
-  Logger,
-  CoreKibanaRequest,
-  CoreSetup,
+import type { IClusterClient } from '@kbn/core-elasticsearch-server';
+import { CoreKibanaRequest } from '@kbn/core-http-router-server-internal';
+import type {
   FakeRawRequest,
+  Headers,
   HttpServiceSetup,
+  IBasePath,
   KibanaRequest,
-  PluginInitializerContext,
-  SavedObjectsClientContract,
-  SavedObjectsServiceStart,
-  UiSettingsServiceStart,
-  IClusterClient,
-} from '@kbn/core/server';
-import { LicenseType } from '@kbn/licensing-plugin/common/types';
-import { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
+} from '@kbn/core-http-server';
+import type { CoreSetup } from '@kbn/core-lifecycle-server';
+import type { PluginInitializerContext } from '@kbn/core-plugins-server';
+import type { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
+import type { SavedObjectsServiceStart } from '@kbn/core-saved-objects-server';
+import type { UiSettingsServiceStart } from '@kbn/core-ui-settings-server';
+import type { LicenseType } from '@kbn/licensing-plugin/common/types';
+import type { Logger } from '@kbn/logging';
+import type { ReportingServerInfo } from '@kbn/reporting-common/types';
+import type { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common';
-import { SpacesPluginSetup } from '@kbn/spaces-plugin/server';
-import { ReportingConfigType } from '../../config';
-import { ReportingServerInfo } from '../../core';
-import { CreateJobFn, ReportingStart, RunTaskFn } from '../../types';
+import type { SpacesPluginSetup } from '@kbn/spaces-plugin/server';
+
+import type { CreateJobFn, RunTaskFn } from './types';
+import type { ReportingConfigType } from '.';
 
 export interface BaseExportTypeSetupDeps {
   basePath: Pick<IBasePath, 'set'>;
@@ -38,7 +40,6 @@ export interface BaseExportTypeStartDeps {
   uiSettings: UiSettingsServiceStart;
   esClient: IClusterClient;
   screenshotting?: ScreenshottingStart;
-  reporting: ReportingStart;
 }
 
 export abstract class ExportType<
@@ -84,6 +85,20 @@ export abstract class ExportType<
     return savedObjects.getScopedClient(request) as SavedObjectsClientContract;
   }
 
+  private getSpaceId(request: KibanaRequest, logger = this.logger): string | undefined {
+    const spacesService = this.setupDeps.spaces?.spacesService;
+    if (spacesService) {
+      const spaceId = spacesService?.getSpaceId(request);
+
+      if (spaceId !== DEFAULT_SPACE_ID) {
+        logger.info(`Request uses Space ID: ${spaceId}`);
+        return spaceId;
+      } else {
+        logger.debug(`Request uses default Space`);
+      }
+    }
+  }
+
   // needed to be protected vs private for the csv search source immediate export type
   protected getUiSettingsServiceFactory(savedObjectsClient: SavedObjectsClientContract) {
     const { uiSettings: uiSettingsService } = this.startDeps;
@@ -93,7 +108,7 @@ export abstract class ExportType<
 
   protected async getUiSettingsClient(request: KibanaRequest, logger = this.logger) {
     const spacesService = this.setupDeps.spaces?.spacesService;
-    const spaceId = this.startDeps.reporting.getSpaceId(request, logger);
+    const spaceId = this.getSpaceId(request, logger);
 
     if (spacesService && spaceId) {
       logger.info(`Creating UI Settings Client for space: ${spaceId}`);
diff --git a/x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.test.ts b/packages/kbn-reporting/server/get_full_redirect_app_url.test.ts
similarity index 80%
rename from x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.test.ts
rename to packages/kbn-reporting/server/get_full_redirect_app_url.test.ts
index a37da0f0eb45da..637bed536859cb 100644
--- a/x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.test.ts
+++ b/packages/kbn-reporting/server/get_full_redirect_app_url.test.ts
@@ -1,11 +1,12 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import { ReportingConfigType } from '../../../config';
+import type { ReportingConfigType } from '.';
 import { getFullRedirectAppUrl } from './get_full_redirect_app_url';
 
 describe('getFullRedirectAppUrl', () => {
diff --git a/x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.ts b/packages/kbn-reporting/server/get_full_redirect_app_url.ts
similarity index 66%
rename from x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.ts
rename to packages/kbn-reporting/server/get_full_redirect_app_url.ts
index 9191e886b8f68a..e09f7b8ceed9d2 100644
--- a/x-pack/plugins/reporting/server/export_types/common/v2/get_full_redirect_app_url.ts
+++ b/packages/kbn-reporting/server/get_full_redirect_app_url.ts
@@ -1,15 +1,16 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { format } from 'url';
-import { ReportingServerInfo } from '../../../core';
-import { ReportingConfigType } from '../../../config';
-import { buildKibanaPath } from '../../../../common/build_kibana_path';
-import { getRedirectAppPath } from '../../../../common/constants';
+
+import { buildKibanaPath, getRedirectAppPath } from '@kbn/reporting-common';
+import type { ReportingServerInfo } from '@kbn/reporting-common/types';
+import type { ReportingConfigType } from '.';
 
 export function getFullRedirectAppUrl(
   config: ReportingConfigType,
diff --git a/packages/kbn-reporting/server/index.ts b/packages/kbn-reporting/server/index.ts
new file mode 100644
index 00000000000000..08240bc28fe0a2
--- /dev/null
+++ b/packages/kbn-reporting/server/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { cryptoFactory } from './crypto';
+export { decryptJobHeaders } from './decrypt_job_headers';
+export { ExportType } from './export_type';
+export { getFullRedirectAppUrl } from './get_full_redirect_app_url';
+export { getFieldFormats, setFieldFormats } from './services';
+
+export type { BaseExportTypeSetupDeps, BaseExportTypeStartDeps } from './export_type';
+export { ConfigSchema } from './config_schema';
+
+export * from './types';
diff --git a/packages/kbn-reporting/server/jest.config.js b/packages/kbn-reporting/server/jest.config.js
new file mode 100644
index 00000000000000..9b805e9133994a
--- /dev/null
+++ b/packages/kbn-reporting/server/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/packages/kbn-reporting/server'],
+};
diff --git a/packages/kbn-reporting/server/kibana.jsonc b/packages/kbn-reporting/server/kibana.jsonc
new file mode 100644
index 00000000000000..a2440596bd9dd2
--- /dev/null
+++ b/packages/kbn-reporting/server/kibana.jsonc
@@ -0,0 +1,10 @@
+{
+    "type": "shared-server",
+    "id": "@kbn/reporting-server",
+    "owner": "@elastic/appex-sharedux",
+    "plugin": {
+      "server": true,
+      "browser": false,
+    }
+  }
+
diff --git a/packages/kbn-reporting/server/package.json b/packages/kbn-reporting/server/package.json
new file mode 100644
index 00000000000000..0db86c14c13909
--- /dev/null
+++ b/packages/kbn-reporting/server/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "@kbn/reporting-server",
+    "private": true,
+    "version": "1.0.0",
+    "license": "SSPL-1.0 OR Elastic License 2.0"
+  }
\ No newline at end of file
diff --git a/packages/kbn-reporting/server/services.ts b/packages/kbn-reporting/server/services.ts
new file mode 100644
index 00000000000000..ea1f47c01b4eda
--- /dev/null
+++ b/packages/kbn-reporting/server/services.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { FieldFormatsStart } from '@kbn/field-formats-plugin/server';
+import { createGetterSetter } from '@kbn/kibana-utils-plugin/common';
+
+export const [getFieldFormats, setFieldFormats] =
+  createGetterSetter<FieldFormatsStart>('FieldFormats');
diff --git a/packages/kbn-reporting/server/tsconfig.json b/packages/kbn-reporting/server/tsconfig.json
new file mode 100644
index 00000000000000..7981ce1c3f9950
--- /dev/null
+++ b/packages/kbn-reporting/server/tsconfig.json
@@ -0,0 +1,38 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/i18n",
+    "@kbn/screenshotting-plugin",
+    "@kbn/field-formats-plugin",
+    "@kbn/kibana-utils-plugin",
+    "@kbn/logging",
+    "@kbn/core",
+    "@kbn/reporting-common",
+    "@kbn/core-http-server",
+    "@kbn/core-lifecycle-server",
+    "@kbn/core-plugins-server",
+    "@kbn/core-saved-objects-api-server",
+    "@kbn/core-saved-objects-server",
+    "@kbn/core-ui-settings-server",
+    "@kbn/licensing-plugin",
+    "@kbn/spaces-plugin",
+    "@kbn/core-elasticsearch-server",
+    "@kbn/core-http-router-server-internal",
+    "@kbn/core-http-request-handler-context-server",
+    "@kbn/config-schema",
+  ]
+}
diff --git a/packages/kbn-reporting/server/types.ts b/packages/kbn-reporting/server/types.ts
new file mode 100644
index 00000000000000..94ad1e34a19d3c
--- /dev/null
+++ b/packages/kbn-reporting/server/types.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Writable } from 'stream';
+
+import type { TypeOf } from '@kbn/config-schema';
+import type { CustomRequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+import type { KibanaRequest } from '@kbn/core-http-server';
+import type { CancellationToken } from '@kbn/reporting-common';
+import type { BaseParams, BasePayload, TaskRunResult } from '@kbn/reporting-common/types';
+
+import { ConfigSchema } from './config_schema';
+import type { ExportType } from './export_type';
+
+export interface ReportingServerPluginSetup {
+  registerExportTypes: (item: ExportType) => void;
+  /**
+   * Used to inform plugins if Reporting config is compatible with UI Capabilities / Application Sub-Feature Controls
+   */
+  usesUiCapabilities: () => boolean;
+}
+
+// standard type for create job function of any ExportType implementation
+export type CreateJobFn<JobParamsType = BaseParams, JobPayloadType = BasePayload> = (
+  jobParams: JobParamsType,
+  context: CustomRequestHandlerContext<{
+    reporting: ReportingServerPluginSetup | null;
+  }>,
+  req: KibanaRequest
+) => Promise<Omit<JobPayloadType, 'headers' | 'spaceId'>>;
+
+// standard type for run task function of any ExportType implementation
+export type RunTaskFn<TaskPayloadType = BasePayload> = (
+  jobId: string,
+  payload: TaskPayloadType,
+  cancellationToken: CancellationToken,
+  stream: Writable
+) => Promise<TaskRunResult>;
+
+export interface TimeRangeParams {
+  min?: Date | string | number | null;
+  max?: Date | string | number | null;
+}
+
+export type ReportingConfigType = TypeOf<typeof ConfigSchema>;
diff --git a/packages/kbn-search-api-panels/components/select_client.tsx b/packages/kbn-search-api-panels/components/select_client.tsx
index 4b8d1547d35c5b..8328a32bca75b6 100644
--- a/packages/kbn-search-api-panels/components/select_client.tsx
+++ b/packages/kbn-search-api-panels/components/select_client.tsx
@@ -29,6 +29,7 @@ export interface SelectClientPanelProps {
   http: HttpStart;
   isPanelLeft?: boolean;
   overviewPanelProps?: Partial<EuiPanelProps>;
+  callout?: React.ReactNode;
 }
 
 export const SelectClientPanel: React.FC<SelectClientPanelProps> = ({
@@ -37,6 +38,7 @@ export const SelectClientPanel: React.FC<SelectClientPanelProps> = ({
   http,
   isPanelLeft = true,
   overviewPanelProps,
+  callout,
 }) => {
   const panelContent = (
     <>
@@ -56,28 +58,30 @@ export const SelectClientPanel: React.FC<SelectClientPanelProps> = ({
         {children}
       </EuiFlexGroup>
       <EuiSpacer size="l" />
-      <EuiCallOut
-        title={i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.title', {
-          defaultMessage: 'Try it now in Console',
-        })}
-        size="m"
-        iconType="iInCircle"
-      >
-        <p>
-          {i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.description', {
-            defaultMessage:
-              'With Console, you can get started right away with our REST APIs. No installation required.',
+      {callout || (
+        <EuiCallOut
+          title={i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.title', {
+            defaultMessage: 'Try it now in Console',
           })}
+          size="m"
+          iconType="iInCircle"
+        >
+          <p>
+            {i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.description', {
+              defaultMessage:
+                'With Console, you can get started right away with our REST APIs. No installation required.',
+            })}
 
-          <span>
-            <EuiLink target="_blank" href={http.basePath.prepend(`/app/dev_tools#/console`)}>
-              {i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.link', {
-                defaultMessage: 'Try Console now',
-              })}
-            </EuiLink>
-          </span>
-        </p>
-      </EuiCallOut>
+            <span>
+              <EuiLink target="_blank" href={http.basePath.prepend(`/app/dev_tools#/console`)}>
+                {i18n.translate('searchApiPanels.welcomeBanner.selectClient.callout.link', {
+                  defaultMessage: 'Try Console now',
+                })}
+              </EuiLink>
+            </span>
+          </p>
+        </EuiCallOut>
+      )}
     </>
   );
   return (
diff --git a/packages/kbn-search-connectors/components/sync_jobs/__snapshots__/pipeline_panel.test.tsx.snap b/packages/kbn-search-connectors/components/sync_jobs/__snapshots__/pipeline_panel.test.tsx.snap
index 6781298c2aaa6d..cddd85fc851b90 100644
--- a/packages/kbn-search-connectors/components/sync_jobs/__snapshots__/pipeline_panel.test.tsx.snap
+++ b/packages/kbn-search-connectors/components/sync_jobs/__snapshots__/pipeline_panel.test.tsx.snap
@@ -33,7 +33,7 @@ exports[`PipelinePanel renders 1`] = `
         },
         Object {
           "setting": "Machine learning inference",
-          "value": false,
+          "value": true,
         },
       ]
     }
diff --git a/packages/kbn-search-connectors/components/sync_jobs/pipeline_panel.test.tsx b/packages/kbn-search-connectors/components/sync_jobs/pipeline_panel.test.tsx
index b65769f3372a72..8d8145d1c5ecd9 100644
--- a/packages/kbn-search-connectors/components/sync_jobs/pipeline_panel.test.tsx
+++ b/packages/kbn-search-connectors/components/sync_jobs/pipeline_panel.test.tsx
@@ -17,7 +17,7 @@ describe('PipelinePanel', () => {
     extract_binary_content: true,
     name: 'name',
     reduce_whitespace: true,
-    run_ml_inference: false,
+    run_ml_inference: true,
   };
   it('renders', () => {
     const wrapper = shallow(<PipelinePanel pipeline={pipeline} />);
diff --git a/packages/kbn-std/src/iteration/map.ts b/packages/kbn-std/src/iteration/map.ts
index 44765d69e1bd0d..a65951cc14db5d 100644
--- a/packages/kbn-std/src/iteration/map.ts
+++ b/packages/kbn-std/src/iteration/map.ts
@@ -58,5 +58,8 @@ export async function asyncMapWithLimit<T1, T2>(
 
   return results
     .sort(([a], [b]) => a - b)
-    .reduce((acc: T2[], [, result]) => acc.concat(result), []);
+    .reduce((acc: T2[], [, result]) => {
+      acc.push(...result);
+      return acc;
+    }, []);
 }
diff --git a/packages/kbn-telemetry-tools/src/tools/serializer.ts b/packages/kbn-telemetry-tools/src/tools/serializer.ts
index a33d2d78e4137a..4501477ed7d7e2 100644
--- a/packages/kbn-telemetry-tools/src/tools/serializer.ts
+++ b/packages/kbn-telemetry-tools/src/tools/serializer.ts
@@ -102,7 +102,7 @@ export function getConstraints(node: ts.Node, program: ts.Program): any {
     return node.text;
   }
 
-  if (ts.isImportSpecifier(node)) {
+  if (ts.isImportSpecifier(node) || ts.isExportSpecifier(node)) {
     const source = node.getSourceFile();
     const importedModuleName = getModuleSpecifier(node);
 
@@ -178,7 +178,10 @@ export function getDescriptor(node: ts.Node, program: ts.Program): Descriptor |
       const constraints = getConstraints(constraint, program);
       const constraintsArray = Array.isArray(constraints) ? constraints : [constraints];
       if (typeof constraintsArray[0] === 'string') {
-        return constraintsArray.reduce((acc, c) => ({ ...acc, [c]: descriptor }), {});
+        return constraintsArray.reduce((acc, c) => {
+          (acc as Record<string, unknown>)[c] = descriptor;
+          return acc;
+        }, {});
       }
     }
     return { '@@INDEX@@': descriptor };
diff --git a/packages/kbn-test/src/kbn_client/kbn_client_ui_settings.ts b/packages/kbn-test/src/kbn_client/kbn_client_ui_settings.ts
index 8b9277fdab8b99..599184b30a4612 100644
--- a/packages/kbn-test/src/kbn_client/kbn_client_ui_settings.ts
+++ b/packages/kbn-test/src/kbn_client/kbn_client_ui_settings.ts
@@ -10,7 +10,7 @@ import { ToolingLog } from '@kbn/tooling-log';
 
 import { KbnClientRequester, pathWithSpace } from './kbn_client_requester';
 
-export type UiSettingValues = Record<string, string | number | boolean>;
+export type UiSettingValues = Record<string, string | number | boolean | string[]>;
 interface UiSettingsApiResponse {
   settings: {
     [key: string]: {
diff --git a/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx b/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx
index 6f244647922eff..4114ab021bf71a 100644
--- a/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx
+++ b/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx
@@ -1180,7 +1180,7 @@ Rounds down a date to the closest interval.
 
 \`\`\`
 FROM employees
-| EVAL year_hired = DATE_TRUNC(hire_date, 1 year)
+| EVAL year_hired = DATE_TRUNC(1 year, hire_date)
 | STATS count(emp_no) BY year_hired
 | SORT year_hired
 \`\`\`
diff --git a/packages/kbn-unified-data-table/src/hooks/use_row_heights_options.ts b/packages/kbn-unified-data-table/src/hooks/use_row_heights_options.ts
index 3df1a31aaa9d3b..542641e2ece7ab 100644
--- a/packages/kbn-unified-data-table/src/hooks/use_row_heights_options.ts
+++ b/packages/kbn-unified-data-table/src/hooks/use_row_heights_options.ts
@@ -85,6 +85,10 @@ export const useRowHeightsOptions = ({
       defaultHeight,
       lineHeight: rowLineHeight,
       onChange: ({ defaultHeight: newRowHeight }: EuiDataGridRowHeightsOptions) => {
+        if (newRowHeight === defaultHeight && typeof rowHeightState === 'undefined') {
+          // ignore, no changes required
+          return;
+        }
         const newSerializedRowHeight = serializeRowHeight(
           // pressing "Reset to default" triggers onChange with the same value
           newRowHeight === defaultHeight ? configRowHeight : newRowHeight
diff --git a/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.test.tsx b/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.test.tsx
index 7ff5c9b3f19b6a..f49a7ef95ed6db 100644
--- a/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.test.tsx
+++ b/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.test.tsx
@@ -93,7 +93,7 @@ describe('copyValueToClipboard', () => {
       columnDisplayName: 'text_message',
     });
 
-    expect(result).toBe('"text_message"');
+    expect(result).toBe('text_message');
     expect(execCommandMock).toHaveBeenCalledWith('copy');
     expect(servicesMock.toastNotifications.addInfo).toHaveBeenCalledWith({
       title: 'Copied to clipboard',
diff --git a/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.ts b/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.ts
index 2e9620b42728b4..2fc0606624a0b6 100644
--- a/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.ts
+++ b/packages/kbn-unified-data-table/src/utils/copy_value_to_clipboard.ts
@@ -131,9 +131,7 @@ export const copyColumnNameToClipboard = ({
   columnDisplayName: string;
   toastNotifications: ToastsStart;
 }): string | null => {
-  const nameFormattedResult = convertNameToString(columnDisplayName);
-  const textToCopy = nameFormattedResult.formattedString;
-  const copied = copyToClipboard(textToCopy);
+  const copied = copyToClipboard(columnDisplayName);
 
   if (!copied) {
     toastNotifications.addWarning({
@@ -147,16 +145,9 @@ export const copyColumnNameToClipboard = ({
     defaultMessage: 'Copied to clipboard',
   });
 
-  if (nameFormattedResult.withFormula) {
-    toastNotifications.addWarning({
-      title: toastTitle,
-      text: WARNING_FOR_FORMULAS,
-    });
-  } else {
-    toastNotifications.addInfo({
-      title: toastTitle,
-    });
-  }
+  toastNotifications.addInfo({
+    title: toastTitle,
+  });
 
-  return textToCopy;
+  return columnDisplayName;
 };
diff --git a/packages/kbn-unified-field-list/src/components/field_popover/field_popover.scss b/packages/kbn-unified-field-list/src/components/field_popover/field_popover.scss
index 8e5a7d5963a8b5..b8fe997d01c132 100644
--- a/packages/kbn-unified-field-list/src/components/field_popover/field_popover.scss
+++ b/packages/kbn-unified-field-list/src/components/field_popover/field_popover.scss
@@ -3,5 +3,5 @@
 
 .unifiedFieldList__fieldPopover__fieldPopoverPanel {
   min-width: $euiSizeXXL * 6.5 !important; /* 1 */
-  max-width: $euiSizeXXL * 7.5 !important;
+  max-width: $euiSizeXXL * 10 !important;
 }
diff --git a/packages/kbn-unified-field-list/src/components/field_stats/field_top_values_bucket.tsx b/packages/kbn-unified-field-list/src/components/field_stats/field_top_values_bucket.tsx
index ccae2a3dfffc14..f296fe74906eb5 100755
--- a/packages/kbn-unified-field-list/src/components/field_stats/field_top_values_bucket.tsx
+++ b/packages/kbn-unified-field-list/src/components/field_stats/field_top_values_bucket.tsx
@@ -13,6 +13,7 @@ import {
   EuiFlexItem,
   EuiProgress,
   EuiText,
+  EuiTextBlockTruncate,
   EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
@@ -84,14 +85,18 @@ const FieldTopValuesBucket: React.FC<FieldTopValuesBucketProps> = ({
         <EuiFlexGroup alignItems="stretch" gutterSize="s" responsive={false}>
           <EuiFlexItem
             grow={true}
-            className="eui-textTruncate"
             data-test-subj={`${dataTestSubject}-topValues-formattedFieldValue`}
+            css={css`
+              overflow-wrap: break-word;
+            `}
           >
             {(formattedFieldValue?.length ?? 0) > 0 ? (
               <EuiToolTip content={formattedFieldValue} delay="long">
-                <EuiText size="xs" className="eui-textTruncate" color={'subdued'} {...textProps}>
-                  {formattedFieldValue}
-                </EuiText>
+                <EuiTextBlockTruncate lines={3}>
+                  <EuiText size="xs" color={'subdued'} {...textProps}>
+                    {formattedFieldValue}
+                  </EuiText>
+                </EuiTextBlockTruncate>
               </EuiToolTip>
             ) : (
               <EuiText size="xs">
diff --git a/packages/kbn-unsaved-changes-badge/README.md b/packages/kbn-unsaved-changes-badge/README.md
new file mode 100644
index 00000000000000..3bdcd84425e535
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/README.md
@@ -0,0 +1,8 @@
+# @kbn/unsaved-changes-badge
+
+A yellow "Unsaved changes" badge which can be found for example on Discover page.
+It supports callbacks to save or revert the changes.
+
+To integrate it into TopNav component, consider using `getTopNavUnsavedChangesBadge(...)` util and pass the result to `badges` prop of the top nav.
+
+There is also a standalone component `<UnsavedChangesBadge .../>`.
diff --git a/packages/kbn-unsaved-changes-badge/index.ts b/packages/kbn-unsaved-changes-badge/index.ts
new file mode 100644
index 00000000000000..928e9129ef7ca3
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export {
+  UnsavedChangesBadge,
+  type UnsavedChangesBadgeProps,
+} from './src/components/unsaved_changes_badge';
+
+export {
+  getTopNavUnsavedChangesBadge,
+  type TopNavUnsavedChangesBadgeParams,
+} from './src/utils/get_top_nav_unsaved_changes_badge';
diff --git a/packages/kbn-unsaved-changes-badge/jest.config.js b/packages/kbn-unsaved-changes-badge/jest.config.js
new file mode 100644
index 00000000000000..9c8319e692f9e0
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-unsaved-changes-badge'],
+};
diff --git a/packages/kbn-unsaved-changes-badge/kibana.jsonc b/packages/kbn-unsaved-changes-badge/kibana.jsonc
new file mode 100644
index 00000000000000..0f64c4d4143fd3
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/unsaved-changes-badge",
+  "owner": "@elastic/kibana-data-discovery"
+}
diff --git a/packages/kbn-unsaved-changes-badge/package.json b/packages/kbn-unsaved-changes-badge/package.json
new file mode 100644
index 00000000000000..c9e7aaf964bf02
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "@kbn/unsaved-changes-badge",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0",
+  "sideEffects": [
+    "*.css",
+    "*.scss"
+  ]
+}
\ No newline at end of file
diff --git a/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/__snapshots__/unsaved_changes_badge.test.tsx.snap b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/__snapshots__/unsaved_changes_badge.test.tsx.snap
new file mode 100644
index 00000000000000..441d85d917ef3a
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/__snapshots__/unsaved_changes_badge.test.tsx.snap
@@ -0,0 +1,95 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`<UnsavedChangesBadge /> should show all menu items 1`] = `
+<div>
+  <div
+    class="euiPopover emotion-euiPopover"
+    id="unsavedChangesPopover_generated-id"
+  >
+    <div
+      class="euiPopover__anchor css-16vtueo-render"
+    >
+      <button
+        aria-label="View available actions"
+        class="euiBadge emotion-euiBadge-warning-clickable"
+        data-test-subj="unsavedChangesBadge"
+        title="test"
+      >
+        <span
+          class="euiBadge__content emotion-euiBadge__content"
+        >
+          <span
+            class="euiBadge__text emotion-euiBadge__text-clickable"
+          >
+            test
+          </span>
+          <span
+            class="euiBadge__icon emotion-euiBadge__icon-right"
+            color="inherit"
+            data-euiicon-type="arrowDown"
+          />
+        </span>
+      </button>
+    </div>
+  </div>
+</div>
+`;
+
+exports[`<UnsavedChangesBadge /> should show all menu items 2`] = `
+<div
+  class="euiContextMenuPanel emotion-euiContextMenuPanel"
+  data-test-subj="unsavedChangesBadgeMenuPanel"
+  tabindex="-1"
+>
+  <div>
+    <button
+      class="euiContextMenuItem emotion-euiContextMenuItem-s-center"
+      data-test-subj="saveUnsavedChangesButton"
+      type="button"
+    >
+      <span
+        class="euiContextMenu__icon emotion-euiContextMenu__icon"
+        color="inherit"
+        data-euiicon-type="save"
+      />
+      <span
+        class="euiContextMenuItem__text emotion-euiContextMenuItem__text-s"
+      >
+        Save
+      </span>
+    </button>
+    <button
+      class="euiContextMenuItem emotion-euiContextMenuItem-s-center"
+      data-test-subj="saveUnsavedChangesAsButton"
+      type="button"
+    >
+      <span
+        class="euiContextMenu__icon emotion-euiContextMenu__icon"
+        color="inherit"
+        data-euiicon-type="save"
+      />
+      <span
+        class="euiContextMenuItem__text emotion-euiContextMenuItem__text-s"
+      >
+        Save as
+      </span>
+    </button>
+    <button
+      class="euiContextMenuItem emotion-euiContextMenuItem-s-center"
+      data-test-subj="revertUnsavedChangesButton"
+      type="button"
+    >
+      <span
+        class="euiContextMenu__icon emotion-euiContextMenu__icon"
+        color="inherit"
+        data-euiicon-type="editorUndo"
+      />
+      <span
+        class="euiContextMenuItem__text emotion-euiContextMenuItem__text-s"
+      >
+        Revert changes
+      </span>
+    </button>
+  </div>
+</div>
+`;
diff --git a/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/index.ts b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/index.ts
new file mode 100644
index 00000000000000..0d7afa38c7d217
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { UnsavedChangesBadge, type UnsavedChangesBadgeProps } from './unsaved_changes_badge';
diff --git a/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.test.tsx b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.test.tsx
new file mode 100644
index 00000000000000..4ba81214ed27eb
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.test.tsx
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { render, act, screen, waitFor } from '@testing-library/react';
+import { UnsavedChangesBadge } from './unsaved_changes_badge';
+
+describe('<UnsavedChangesBadge />', () => {
+  test('should render correctly', async () => {
+    const onRevert = jest.fn();
+    const { getByTestId, queryByTestId } = render(
+      <UnsavedChangesBadge badgeText="test" onRevert={onRevert} />
+    );
+    expect(getByTestId('unsavedChangesBadge')).toBeInTheDocument();
+
+    getByTestId('unsavedChangesBadge').click();
+    await waitFor(() => {
+      return Boolean(queryByTestId('unsavedChangesBadgeMenuPanel'));
+    });
+    expect(queryByTestId('revertUnsavedChangesButton')).toBeInTheDocument();
+    expect(queryByTestId('saveUnsavedChangesButton')).not.toBeInTheDocument();
+    expect(queryByTestId('saveUnsavedChangesAsButton')).not.toBeInTheDocument();
+
+    expect(onRevert).not.toHaveBeenCalled();
+
+    act(() => {
+      getByTestId('revertUnsavedChangesButton').click();
+    });
+    expect(onRevert).toHaveBeenCalled();
+  });
+
+  test('should show all menu items', async () => {
+    const onRevert = jest.fn().mockResolvedValue(true);
+    const onSave = jest.fn().mockResolvedValue(true);
+    const onSaveAs = jest.fn().mockResolvedValue(true);
+    const { getByTestId, queryByTestId, container } = render(
+      <UnsavedChangesBadge
+        badgeText="test"
+        onRevert={onRevert}
+        onSave={onSave}
+        onSaveAs={onSaveAs}
+      />
+    );
+
+    expect(container).toMatchSnapshot();
+
+    getByTestId('unsavedChangesBadge').click();
+    await waitFor(() => {
+      return Boolean(queryByTestId('unsavedChangesBadgeMenuPanel'));
+    });
+    expect(queryByTestId('revertUnsavedChangesButton')).toBeInTheDocument();
+    expect(queryByTestId('saveUnsavedChangesButton')).toBeInTheDocument();
+    expect(queryByTestId('saveUnsavedChangesAsButton')).toBeInTheDocument();
+
+    expect(screen.getByTestId('unsavedChangesBadgeMenuPanel')).toMatchSnapshot();
+  });
+
+  test('should call callbacks', async () => {
+    const onRevert = jest.fn().mockResolvedValue(true);
+    const onSave = jest.fn().mockResolvedValue(true);
+    const onSaveAs = jest.fn().mockResolvedValue(true);
+    const { getByTestId, queryByTestId } = render(
+      <UnsavedChangesBadge
+        badgeText="test"
+        onRevert={onRevert}
+        onSave={onSave}
+        onSaveAs={onSaveAs}
+      />
+    );
+    act(() => {
+      getByTestId('unsavedChangesBadge').click();
+    });
+    await waitFor(() => {
+      return Boolean(queryByTestId('unsavedChangesBadgeMenuPanel'));
+    });
+
+    expect(onSave).not.toHaveBeenCalled();
+
+    act(() => {
+      getByTestId('saveUnsavedChangesButton').click();
+    });
+    expect(onSave).toHaveBeenCalled();
+  });
+});
diff --git a/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx
new file mode 100644
index 00000000000000..a022214f0df797
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/components/unsaved_changes_badge/unsaved_changes_badge.tsx
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useState } from 'react';
+import useMountedState from 'react-use/lib/useMountedState';
+import {
+  EuiBadge,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiPopover,
+  useGeneratedHtmlId,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+enum ProcessingType {
+  reverting = 'reverting',
+  saving = 'saving',
+  savingAs = 'savingAs',
+}
+
+/**
+ * Props for UnsavedChangesBadge
+ */
+export interface UnsavedChangesBadgeProps {
+  onRevert: () => Promise<unknown>;
+  onSave?: () => Promise<unknown>;
+  onSaveAs?: () => Promise<unknown>;
+  badgeText: string;
+}
+
+/**
+ * Badge component. It opens a menu panel with actions once pressed.
+ * @param badgeText
+ * @param onRevert
+ * @param onSave
+ * @param onSaveAs
+ * @constructor
+ */
+export const UnsavedChangesBadge: React.FC<UnsavedChangesBadgeProps> = ({
+  badgeText,
+  onRevert,
+  onSave,
+  onSaveAs,
+}) => {
+  const isMounted = useMountedState();
+  const [processingType, setProcessingType] = useState<ProcessingType | null>(null);
+  const [isPopoverOpen, setPopover] = useState(false);
+  const contextMenuPopoverId = useGeneratedHtmlId({
+    prefix: 'unsavedChangesPopover',
+  });
+
+  const togglePopover = () => {
+    setPopover((value) => !value);
+  };
+
+  const closePopover = () => {
+    setPopover(false);
+  };
+
+  const completeMenuItemAction = () => {
+    if (isMounted()) {
+      setProcessingType(null);
+      closePopover();
+    }
+  };
+
+  const handleMenuItem = async (type: ProcessingType, action: () => Promise<unknown>) => {
+    try {
+      setProcessingType(type);
+      await action();
+    } finally {
+      completeMenuItemAction();
+    }
+  };
+
+  const disabled = Boolean(processingType);
+  const isSaving = processingType === ProcessingType.saving;
+  const isSavingAs = processingType === ProcessingType.savingAs;
+  const isReverting = processingType === ProcessingType.reverting;
+
+  const items = [
+    ...(onSave
+      ? [
+          <EuiContextMenuItem
+            data-test-subj="saveUnsavedChangesButton"
+            key="save"
+            icon="save"
+            disabled={disabled}
+            onClick={async () => {
+              await handleMenuItem(ProcessingType.saving, onSave);
+            }}
+          >
+            {isSaving
+              ? i18n.translate('unsavedChangesBadge.contextMenu.savingChangesButtonStatus', {
+                  defaultMessage: 'Saving...',
+                })
+              : i18n.translate('unsavedChangesBadge.contextMenu.saveChangesButton', {
+                  defaultMessage: 'Save',
+                })}
+          </EuiContextMenuItem>,
+        ]
+      : []),
+    ...(onSaveAs
+      ? [
+          <EuiContextMenuItem
+            data-test-subj="saveUnsavedChangesAsButton"
+            key="saveAs"
+            icon="save"
+            disabled={disabled}
+            onClick={async () => {
+              await handleMenuItem(ProcessingType.savingAs, onSaveAs);
+            }}
+          >
+            {isSavingAs
+              ? i18n.translate('unsavedChangesBadge.contextMenu.savingChangesAsButtonStatus', {
+                  defaultMessage: 'Saving as...',
+                })
+              : i18n.translate('unsavedChangesBadge.contextMenu.saveChangesAsButton', {
+                  defaultMessage: 'Save as',
+                })}
+          </EuiContextMenuItem>,
+        ]
+      : []),
+    <EuiContextMenuItem
+      data-test-subj="revertUnsavedChangesButton"
+      key="revert"
+      icon="editorUndo"
+      disabled={disabled}
+      onClick={async () => {
+        await handleMenuItem(ProcessingType.reverting, onRevert);
+      }}
+    >
+      {isReverting
+        ? i18n.translate('unsavedChangesBadge.contextMenu.revertingChangesButtonStatus', {
+            defaultMessage: 'Reverting changes...',
+          })
+        : i18n.translate('unsavedChangesBadge.contextMenu.revertChangesButton', {
+            defaultMessage: 'Revert changes',
+          })}
+    </EuiContextMenuItem>,
+  ];
+
+  const button = (
+    <EuiBadge
+      data-test-subj="unsavedChangesBadge"
+      color="warning"
+      iconType="arrowDown"
+      iconSide="right"
+      onClick={togglePopover}
+      onClickAriaLabel={i18n.translate('unsavedChangesBadge.contextMenu.openButton', {
+        defaultMessage: 'View available actions',
+      })}
+    >
+      {badgeText}
+    </EuiBadge>
+  );
+
+  return (
+    <EuiPopover
+      id={contextMenuPopoverId}
+      button={button}
+      isOpen={isPopoverOpen}
+      closePopover={closePopover}
+      panelPaddingSize="none"
+      anchorPosition="downLeft"
+    >
+      <EuiContextMenuPanel size="s" items={items} data-test-subj="unsavedChangesBadgeMenuPanel" />
+    </EuiPopover>
+  );
+};
diff --git a/packages/kbn-unsaved-changes-badge/src/utils/__snapshots__/get_top_nav_unsaved_changes_badge.test.tsx.snap b/packages/kbn-unsaved-changes-badge/src/utils/__snapshots__/get_top_nav_unsaved_changes_badge.test.tsx.snap
new file mode 100644
index 00000000000000..eafe487e0265c1
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/utils/__snapshots__/get_top_nav_unsaved_changes_badge.test.tsx.snap
@@ -0,0 +1,63 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`getTopNavUnsavedChangesBadge() should work correctly 1`] = `
+<div>
+  <div
+    class="euiPopover emotion-euiPopover"
+    id="unsavedChangesPopover_generated-id"
+  >
+    <div
+      class="euiPopover__anchor css-16vtueo-render"
+    >
+      <button
+        aria-label="View available actions"
+        class="euiBadge emotion-euiBadge-warning-clickable"
+        data-test-subj="unsavedChangesBadge"
+        title="Unsaved changes"
+      >
+        <span
+          class="euiBadge__content emotion-euiBadge__content"
+        >
+          <span
+            class="euiBadge__text emotion-euiBadge__text-clickable"
+          >
+            Unsaved changes
+          </span>
+          <span
+            class="euiBadge__icon emotion-euiBadge__icon-right"
+            color="inherit"
+            data-euiicon-type="arrowDown"
+          />
+        </span>
+      </button>
+    </div>
+  </div>
+</div>
+`;
+
+exports[`getTopNavUnsavedChangesBadge() should work correctly 2`] = `
+<div
+  class="euiContextMenuPanel emotion-euiContextMenuPanel"
+  data-test-subj="unsavedChangesBadgeMenuPanel"
+  tabindex="-1"
+>
+  <div>
+    <button
+      class="euiContextMenuItem emotion-euiContextMenuItem-s-center"
+      data-test-subj="revertUnsavedChangesButton"
+      type="button"
+    >
+      <span
+        class="euiContextMenu__icon emotion-euiContextMenu__icon"
+        color="inherit"
+        data-euiicon-type="editorUndo"
+      />
+      <span
+        class="euiContextMenuItem__text emotion-euiContextMenuItem__text-s"
+      >
+        Revert changes
+      </span>
+    </button>
+  </div>
+</div>
+`;
diff --git a/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.test.tsx b/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.test.tsx
new file mode 100644
index 00000000000000..f60b92fec51769
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.test.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { render, waitFor, screen } from '@testing-library/react';
+import { getTopNavUnsavedChangesBadge } from './get_top_nav_unsaved_changes_badge';
+
+describe('getTopNavUnsavedChangesBadge()', () => {
+  test('should work correctly', async () => {
+    const onRevert = jest.fn().mockResolvedValue(true);
+    const badge = getTopNavUnsavedChangesBadge({ onRevert });
+    const { container, getByTestId, queryByTestId } = render(
+      badge.renderCustomBadge!({ badgeText: badge.badgeText })
+    );
+    expect(container).toMatchSnapshot();
+
+    getByTestId('unsavedChangesBadge').click();
+    await waitFor(() => {
+      return Boolean(queryByTestId('revertUnsavedChangesButton'));
+    });
+
+    expect(screen.getByTestId('unsavedChangesBadgeMenuPanel')).toMatchSnapshot();
+  });
+});
diff --git a/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx b/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx
new file mode 100644
index 00000000000000..af7cf915bb103a
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/src/utils/get_top_nav_unsaved_changes_badge.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import type { TopNavMenuBadgeProps } from '@kbn/navigation-plugin/public';
+import {
+  UnsavedChangesBadge,
+  type UnsavedChangesBadgeProps,
+} from '../components/unsaved_changes_badge';
+
+/**
+ * Params for getTopNavUnsavedChangesBadge
+ */
+export interface TopNavUnsavedChangesBadgeParams {
+  onRevert: UnsavedChangesBadgeProps['onRevert'];
+  onSave?: UnsavedChangesBadgeProps['onSave'];
+  onSaveAs?: UnsavedChangesBadgeProps['onSaveAs'];
+}
+
+/**
+ * Returns a badge object suitable for the top nav `badges` prop
+ * @param onRevert
+ * @param onSave
+ * @param onSaveAs
+ */
+export const getTopNavUnsavedChangesBadge = ({
+  onRevert,
+  onSave,
+  onSaveAs,
+}: TopNavUnsavedChangesBadgeParams): TopNavMenuBadgeProps => {
+  return {
+    badgeText: i18n.translate('unsavedChangesBadge.unsavedChangesTitle', {
+      defaultMessage: 'Unsaved changes',
+    }),
+    renderCustomBadge: ({ badgeText }) => (
+      <UnsavedChangesBadge
+        badgeText={badgeText}
+        onRevert={onRevert}
+        onSave={onSave}
+        onSaveAs={onSaveAs}
+      />
+    ),
+  };
+};
diff --git a/packages/kbn-unsaved-changes-badge/tsconfig.json b/packages/kbn-unsaved-changes-badge/tsconfig.json
new file mode 100644
index 00000000000000..1c80dd5dae6382
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types"
+  },
+  "include": ["*.ts", "src/**/*", "__mocks__/**/*.ts"],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/i18n",
+    "@kbn/navigation-plugin",
+  ]
+}
diff --git a/packages/kbn-unsaved-changes-badge/types.ts b/packages/kbn-unsaved-changes-badge/types.ts
new file mode 100644
index 00000000000000..a2697b8ae7717b
--- /dev/null
+++ b/packages/kbn-unsaved-changes-badge/types.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type { UnsavedChangesBadgeProps } from './src/components/unsaved_changes_badge';
+export type { TopNavUnsavedChangesBadgeParams } from './src/utils/get_top_nav_unsaved_changes_badge';
diff --git a/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx b/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
index 4827bb2fd628c3..5b6022d5cb4541 100644
--- a/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
+++ b/packages/kbn-visualization-ui-components/components/field_picker/field_picker.tsx
@@ -7,14 +7,11 @@
  */
 
 import './field_picker.scss';
-import React, { useRef } from 'react';
+import React from 'react';
 import { i18n } from '@kbn/i18n';
-import useEffectOnce from 'react-use/lib/useEffectOnce';
-import { EuiComboBox, EuiComboBoxProps, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiComboBox, EuiComboBoxProps } from '@elastic/eui';
 import { FieldIcon } from '@kbn/field-utils/src/components/field_icon';
 import classNames from 'classnames';
-import type { DataType } from './types';
-import { TruncatedLabel } from './truncated_label';
 import type { FieldOptionValue, FieldOption } from './types';
 
 export interface FieldPickerProps<T extends FieldOptionValue>
@@ -27,9 +24,8 @@ export interface FieldPickerProps<T extends FieldOptionValue>
   'data-test-subj'?: string;
 }
 
-const DEFAULT_COMBOBOX_WIDTH = 305;
-const COMBOBOX_PADDINGS = 90;
-const DEFAULT_FONT = '14px Inter';
+const MIDDLE_TRUNCATION_PROPS = { truncation: 'middle' as const };
+const SINGLE_SELECTION_AS_TEXT_PROPS = { asPlainText: true };
 
 export function FieldPicker<T extends FieldOptionValue = FieldOptionValue>({
   selectedOptions,
@@ -40,95 +36,86 @@ export function FieldPicker<T extends FieldOptionValue = FieldOptionValue>({
   ['data-test-subj']: dataTestSub,
   ...rest
 }: FieldPickerProps<T>) {
+  let theLongestLabel = '';
   const styledOptions = options?.map(({ compatible, exists, ...otherAttr }) => {
     if (otherAttr.options) {
       return {
         ...otherAttr,
-        options: otherAttr.options.map(({ exists: fieldOptionExists, ...fieldOption }) => ({
-          ...fieldOption,
-          className: classNames({
-            'lnFieldPicker__option--incompatible': !fieldOption.compatible,
-            'lnFieldPicker__option--nonExistant': !fieldOptionExists,
-          }),
-        })),
+        options: otherAttr.options.map(({ exists: fieldOptionExists, ...fieldOption }) => {
+          if (fieldOption.label.length > theLongestLabel.length) {
+            theLongestLabel = fieldOption.label;
+          }
+          return {
+            ...fieldOption,
+            prepend: fieldOption.value.dataType ? (
+              <FieldIcon
+                type={fieldOption.value.dataType}
+                fill="none"
+                className="eui-alignMiddle"
+              />
+            ) : null,
+            className: classNames({
+              'lnFieldPicker__option--incompatible': !fieldOption.compatible,
+              'lnFieldPicker__option--nonExistant': !fieldOptionExists,
+            }),
+          };
+        }),
       };
     }
     return {
       ...otherAttr,
       compatible,
+      prepend: otherAttr.value.dataType ? (
+        <FieldIcon type={otherAttr.value.dataType} fill="none" className="eui-alignMiddle" />
+      ) : null,
       className: classNames({
         'lnFieldPicker__option--incompatible': !compatible,
         'lnFieldPicker__option--nonExistant': !exists,
       }),
     };
   });
-  const comboBoxRef = useRef<HTMLInputElement>(null);
-  const [labelProps, setLabelProps] = React.useState<{
-    width: number;
-    font: string;
-  }>({
-    width: DEFAULT_COMBOBOX_WIDTH - COMBOBOX_PADDINGS,
-    font: DEFAULT_FONT,
-  });
-
-  const computeStyles = (_e: UIEvent | undefined, shouldRecomputeAll = false) => {
-    if (comboBoxRef.current) {
-      const current = {
-        ...labelProps,
-        width: comboBoxRef.current?.clientWidth - COMBOBOX_PADDINGS,
-      };
-      if (shouldRecomputeAll) {
-        current.font = window.getComputedStyle(comboBoxRef.current).font;
-      }
-      setLabelProps(current);
-    }
-  };
-
-  useEffectOnce(() => {
-    if (comboBoxRef.current) {
-      computeStyles(undefined, true);
-    }
-    window.addEventListener('resize', computeStyles);
-  });
 
+  const panelMinWidth = getPanelMinWidth(theLongestLabel.length);
   return (
-    <div ref={comboBoxRef}>
-      <EuiComboBox
-        fullWidth
-        compressed
-        isClearable={false}
-        data-test-subj={dataTestSub ?? 'indexPattern-dimension-field'}
-        placeholder={i18n.translate('visualizationUiComponents.fieldPicker.fieldPlaceholder', {
-          defaultMessage: 'Select a field',
-        })}
-        options={styledOptions}
-        isInvalid={fieldIsInvalid}
-        selectedOptions={selectedOptions}
-        singleSelection={{ asPlainText: true }}
-        onChange={(choices) => {
-          if (choices.length === 0) {
-            onDelete?.();
-            return;
-          }
-          onChoose(choices[0].value);
-        }}
-        renderOption={(option, searchValue) => {
-          return (
-            <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
-              <EuiFlexItem grow={null}>
-                <FieldIcon
-                  type={(option.value as unknown as { dataType: DataType }).dataType}
-                  fill="none"
-                />
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <TruncatedLabel {...labelProps} label={option.label} search={searchValue} />
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          );
-        }}
-        {...rest}
-      />
-    </div>
+    <EuiComboBox
+      fullWidth
+      compressed
+      isClearable={false}
+      data-test-subj={dataTestSub ?? 'indexPattern-dimension-field'}
+      placeholder={i18n.translate('visualizationUiComponents.fieldPicker.fieldPlaceholder', {
+        defaultMessage: 'Select a field',
+      })}
+      options={styledOptions}
+      isInvalid={fieldIsInvalid}
+      selectedOptions={selectedOptions}
+      singleSelection={SINGLE_SELECTION_AS_TEXT_PROPS}
+      truncationProps={MIDDLE_TRUNCATION_PROPS}
+      inputPopoverProps={{ panelMinWidth }}
+      onChange={(choices) => {
+        if (choices.length === 0) {
+          onDelete?.();
+          return;
+        }
+        onChoose(choices[0].value);
+      }}
+      {...rest}
+    />
   );
 }
+
+const MINIMUM_POPOVER_WIDTH = 300;
+const MINIMUM_POPOVER_WIDTH_CHAR_COUNT = 28;
+const AVERAGE_CHAR_WIDTH = 7;
+const MAXIMUM_POPOVER_WIDTH_CHAR_COUNT = 60;
+const MAXIMUM_POPOVER_WIDTH = 550; // fitting 60 characters
+
+function getPanelMinWidth(labelLength: number) {
+  if (labelLength > MAXIMUM_POPOVER_WIDTH_CHAR_COUNT) {
+    return MAXIMUM_POPOVER_WIDTH;
+  }
+  if (labelLength > MINIMUM_POPOVER_WIDTH_CHAR_COUNT) {
+    const overflownChars = labelLength - MINIMUM_POPOVER_WIDTH_CHAR_COUNT;
+    return MINIMUM_POPOVER_WIDTH + overflownChars * AVERAGE_CHAR_WIDTH;
+  }
+  return MINIMUM_POPOVER_WIDTH;
+}
diff --git a/packages/kbn-visualization-ui-components/components/field_picker/index.ts b/packages/kbn-visualization-ui-components/components/field_picker/index.ts
index 96f53e2bfc74a8..e21e97911ecbd2 100644
--- a/packages/kbn-visualization-ui-components/components/field_picker/index.ts
+++ b/packages/kbn-visualization-ui-components/components/field_picker/index.ts
@@ -7,5 +7,4 @@
  */
 
 export { FieldPicker } from './field_picker';
-export { TruncatedLabel } from './truncated_label';
 export type { FieldOptionValue, FieldOption, DataType } from './types';
diff --git a/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.test.tsx b/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.test.tsx
deleted file mode 100644
index fb9b7581bbdc61..00000000000000
--- a/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.test.tsx
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-import { TruncatedLabel } from './truncated_label';
-
-describe('truncated_label', () => {
-  const defaultProps = {
-    font: '14px Inter',
-    // jest-canvas-mock mocks measureText as the number of string characters, thats why the width is so low
-    width: 30,
-    search: '',
-    label: 'example_field',
-  };
-  it('displays passed label if shorter than passed labelLength', () => {
-    const wrapper = mount(<TruncatedLabel {...defaultProps} />);
-    expect(wrapper.text()).toEqual('example_field');
-  });
-  it('middle truncates label', () => {
-    const wrapper = mount(
-      <TruncatedLabel {...defaultProps} label="example_space.example_field.subcategory.subfield" />
-    );
-    expect(wrapper.text()).toEqual('example_….subcategory.subfield');
-  });
-  describe('with search value passed', () => {
-    it('constructs truncated label when searching for the string of index = 0', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search="example_space"
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('example_space.example_field.s…');
-      expect(wrapper.find('mark').text()).toEqual('example_space');
-    });
-    it('constructs truncated label when searching for the string in the middle', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'ample_field'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…ample_field.subcategory.subf…');
-      expect(wrapper.find('mark').text()).toEqual('ample_field');
-    });
-    it('constructs truncated label when searching for the string at the end of the label', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'subf'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…le_field.subcategory.subfield');
-      expect(wrapper.find('mark').text()).toEqual('subf');
-    });
-
-    it('constructs truncated label when searching for the string longer than the truncated width and highlights the whole content', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'ample_space.example_field.subcategory.subfie'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…ample_space.example_field.su…');
-      expect(wrapper.find('mark').text()).toEqual('…ample_space.example_field.su…');
-    });
-  });
-});
diff --git a/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.tsx b/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.tsx
deleted file mode 100644
index 4715e25acaf05a..00000000000000
--- a/packages/kbn-visualization-ui-components/components/field_picker/truncated_label.tsx
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { useMemo } from 'react';
-import { EuiMark, EuiHighlight } from '@elastic/eui';
-
-const createContext = () =>
-  document.createElement('canvas').getContext('2d') as CanvasRenderingContext2D;
-
-// extracted from getTextWidth for performance
-const context = createContext();
-
-const getTextWidth = (text: string, font: string) => {
-  const ctx = context ?? createContext();
-  ctx.font = font;
-  const metrics = ctx.measureText(text);
-  return metrics.width;
-};
-
-const truncateLabel = (
-  width: number,
-  font: string,
-  label: string,
-  approximateLength: number,
-  labelFn: (label: string, length: number) => string
-) => {
-  let output = labelFn(label, approximateLength);
-  while (getTextWidth(output, font) > width) {
-    approximateLength = approximateLength - 1;
-    output = labelFn(label, approximateLength);
-  }
-  return output;
-};
-
-export const TruncatedLabel = React.memo(function TruncatedLabel({
-  label,
-  width,
-  search,
-  font,
-}: {
-  label: string;
-  search: string;
-  width: number;
-  font: string;
-}) {
-  const textWidth = useMemo(() => getTextWidth(label, font), [label, font]);
-
-  if (textWidth < width) {
-    return <EuiHighlight search={search}>{label}</EuiHighlight>;
-  }
-
-  const searchPosition = label.indexOf(search);
-  const approximateLen = Math.round((width * label.length) / textWidth);
-  const separator = `…`;
-  let separatorsLength = separator.length;
-  let labelFn;
-
-  if (!search || searchPosition === -1) {
-    labelFn = (text: string, length: number) =>
-      `${text.substr(0, 8)}${separator}${text.substr(text.length - (length - 8))}`;
-  } else if (searchPosition === 0) {
-    // search phrase at the beginning
-    labelFn = (text: string, length: number) => `${text.substr(0, length)}${separator}`;
-  } else if (approximateLen > label.length - searchPosition) {
-    // search phrase close to the end or at the end
-    labelFn = (text: string, length: number) => `${separator}${text.substr(text.length - length)}`;
-  } else {
-    // search phrase is in the middle
-    labelFn = (text: string, length: number) =>
-      `${separator}${text.substr(searchPosition, length)}${separator}`;
-    separatorsLength = 2 * separator.length;
-  }
-
-  const outputLabel = truncateLabel(width, font, label, approximateLen, labelFn);
-
-  return search.length < outputLabel.length - separatorsLength ? (
-    <EuiHighlight search={search}>{outputLabel}</EuiHighlight>
-  ) : (
-    <EuiMark>{outputLabel}</EuiMark>
-  );
-});
diff --git a/packages/kbn-visualization-ui-components/index.ts b/packages/kbn-visualization-ui-components/index.ts
index 8b9f29fec31a17..16c51f96a869b4 100644
--- a/packages/kbn-visualization-ui-components/index.ts
+++ b/packages/kbn-visualization-ui-components/index.ts
@@ -8,7 +8,6 @@
 
 export {
   FieldPicker,
-  TruncatedLabel,
   NameInput,
   DebouncedInput,
   useDebouncedValue,
diff --git a/packages/shared-ux/button_toolbar/src/buttons/add_from_library/add_from_library.tsx b/packages/shared-ux/button_toolbar/src/buttons/add_from_library/add_from_library.tsx
index da1d3b8fc87116..b021acd6d5d2a7 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/add_from_library/add_from_library.tsx
+++ b/packages/shared-ux/button_toolbar/src/buttons/add_from_library/add_from_library.tsx
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { ToolbarButton, ToolbarButtonProps } from '../toolbar_button';
 
-export type Props = Omit<ToolbarButtonProps, 'iconType' | 'label' | 'type'>;
+export type Props = Omit<ToolbarButtonProps<'standard'>, 'iconType' | 'label' | 'type'>;
 
 const label = {
   getLibraryButtonLabel: () =>
diff --git a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap
index 05065612bb411c..68576d81711a81 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap
+++ b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap
@@ -1,6 +1,22 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`<ToolbarButton /> is rendered - default 1`] = `
+exports[`<ToolbarButton /> iconButton is rendered - default 1`] = `
+<button
+  as="iconButton"
+  class="euiButtonIcon emotion-EuiButtonIcon"
+  intl="[object Object]"
+  type="button"
+>
+  <span
+    aria-hidden="true"
+    class="euiButtonIcon__icon"
+    color="inherit"
+    data-euiicon-type="launch"
+  />
+</button>
+`;
+
+exports[`<ToolbarButton /> standard is rendered - default 1`] = `
 <button
   class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-EuiButton"
   intl="[object Object]"
@@ -14,13 +30,17 @@ exports[`<ToolbarButton /> is rendered - default 1`] = `
     >
       Create chart
     </span>
+    <span
+      color="inherit"
+      data-euiicon-type="arrowDown"
+    />
   </span>
 </button>
 `;
 
-exports[`<ToolbarButton /> is rendered - primary 1`] = `
+exports[`<ToolbarButton /> standard is rendered - primary 1`] = `
 <button
-  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-fill-primary"
+  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-EuiButton"
   intl="[object Object]"
   type="button"
 >
@@ -32,6 +52,32 @@ exports[`<ToolbarButton /> is rendered - primary 1`] = `
     >
       Create chart
     </span>
+    <span
+      color="inherit"
+      data-euiicon-type="arrowDown"
+    />
+  </span>
+</button>
+`;
+
+exports[`<ToolbarButton /> standard is rendered - text wth icon 1`] = `
+<button
+  class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-EuiButton"
+  intl="[object Object]"
+  type="button"
+>
+  <span
+    class="emotion-euiButtonDisplayContent"
+  >
+    <span
+      color="inherit"
+      data-euiicon-type="plusInCircle"
+    />
+    <span
+      class="eui-textTruncate"
+    >
+      Create chart
+    </span>
   </span>
 </button>
 `;
diff --git a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.stories.tsx b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.stories.tsx
index 580d894ecd0429..909ae1cd2845e0 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.stories.tsx
+++ b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.stories.tsx
@@ -21,6 +21,13 @@ export default {
 };
 
 const argTypes = {
+  buttonStyle: {
+    defaultValue: 'standard',
+    control: {
+      type: 'radio',
+      options: ['standard', 'iconButton'],
+    },
+  },
   buttonType: {
     defaultValue: 'empty',
     control: {
@@ -39,9 +46,15 @@ const argTypes = {
 
 type Params = Record<keyof typeof argTypes, any>;
 
-export const ToolbarButton = ({ buttonType, iconSide }: Params) => {
+export const ToolbarButton = ({ buttonStyle, buttonType, iconSide }: Params) => {
   return (
-    <Component label="Toolbar button" iconType="lensApp" type={buttonType} iconSide={iconSide} />
+    <Component
+      as={buttonStyle}
+      label="Toolbar button"
+      iconType="lensApp"
+      type={buttonType}
+      iconSide={iconSide}
+    />
   );
 };
 
diff --git a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.styles.ts b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.styles.ts
index 162e81bb4efcbf..510bedf9fafbb9 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.styles.ts
+++ b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.styles.ts
@@ -8,12 +8,39 @@
 
 import { UseEuiTheme } from '@elastic/eui';
 
+export const fontWeightDefinitions = (euiTheme: UseEuiTheme['euiTheme']) => ({
+  bold: euiTheme.font.weight.bold,
+  normal: euiTheme.font.weight.regular,
+});
+
 export const ToolbarButtonStyles = ({ euiTheme }: UseEuiTheme) => {
   return {
+    default: {
+      // style declaration carried over from https://github.com/elastic/kibana/blob/v8.10.4/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
+      // informed by issue https://github.com/elastic/eui/issues/4730
+      borderStyle: 'solid',
+      border: euiTheme.border.thin,
+      borderColor: euiTheme.border.color,
+    },
     emptyButton: {
       backgroundColor: euiTheme.colors.emptyShade,
-      border: `${euiTheme.border.thin} !important`,
+      border: `${euiTheme.border.thin}`,
       color: `${euiTheme.colors.text}`,
     },
+    buttonPositions: {
+      left: {
+        borderTopRightRadius: 0,
+        borderBottomRightRadius: 0,
+      },
+      right: {
+        borderTopLeftRadius: 0,
+        borderBottomLeftRadius: 0,
+        borderLeft: 'none',
+      },
+      center: {
+        borderRadius: 0,
+        borderLeft: 'none',
+      },
+    },
   };
 };
diff --git a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.test.tsx b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.test.tsx
index 74b5fde37f5ff0..6761f4272079d1 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.test.tsx
+++ b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.test.tsx
@@ -12,22 +12,47 @@ import { mountWithIntl } from '@kbn/test-jest-helpers';
 import { ToolbarButton } from './toolbar_button';
 
 describe('<ToolbarButton />', () => {
-  test('is rendered - default', () => {
-    const component = mountWithIntl(<ToolbarButton label="Create chart" onClick={() => 'click'} />);
-    expect(component.render()).toMatchSnapshot();
-  });
+  describe('standard', () => {
+    test('is rendered - default', () => {
+      const component = mountWithIntl(
+        <ToolbarButton label="Create chart" onClick={() => 'click'} />
+      );
+      expect(component.render()).toMatchSnapshot();
+    });
+
+    test('is rendered - primary', () => {
+      const component = mountWithIntl(
+        <ToolbarButton type="primary" label="Create chart" onClick={() => 'click'} />
+      );
+      expect(component.render()).toMatchSnapshot();
+    });
+
+    test('is rendered - text wth icon', () => {
+      const component = mountWithIntl(
+        <ToolbarButton
+          type="primary"
+          iconType="plusInCircle"
+          label="Create chart"
+          onClick={() => 'click'}
+        />
+      );
+      expect(component.render()).toMatchSnapshot();
+    });
 
-  test('is rendered - primary', () => {
-    const component = mountWithIntl(
-      <ToolbarButton type="primary" label="Create chart" onClick={() => 'click'} />
-    );
-    expect(component.render()).toMatchSnapshot();
+    test('accepts an onClick handler', () => {
+      const mockHandler = jest.fn();
+      const component = mountWithIntl(<ToolbarButton label="Create chart" onClick={mockHandler} />);
+      component.find('button').simulate('click');
+      expect(mockHandler).toHaveBeenCalled();
+    });
   });
 
-  test('accepts an onClick handler', () => {
-    const mockHandler = jest.fn();
-    const component = mountWithIntl(<ToolbarButton label="Create chart" onClick={mockHandler} />);
-    component.find('button').simulate('click');
-    expect(mockHandler).toHaveBeenCalled();
+  describe('iconButton', () => {
+    test('is rendered - default', () => {
+      const component = mountWithIntl(
+        <ToolbarButton as="iconButton" iconType="launch" onClick={jest.fn()} />
+      );
+      expect(component.render()).toMatchSnapshot();
+    });
   });
 });
diff --git a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx
index 76adb41e237bd6..84039857d0891e 100644
--- a/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx
+++ b/packages/shared-ux/button_toolbar/src/buttons/toolbar_button/toolbar_button.tsx
@@ -7,48 +7,177 @@
  */
 
 import React from 'react';
-import { EuiButton, useEuiTheme } from '@elastic/eui';
+import { EuiButton, EuiButtonIcon, useEuiTheme, IconType } from '@elastic/eui';
 import { EuiButtonPropsForButton } from '@elastic/eui/src/components/button/button';
 
-import { ToolbarButtonStyles } from './toolbar_button.styles';
+import { ToolbarButtonStyles, fontWeightDefinitions } from './toolbar_button.styles';
 
 type ToolbarButtonTypes = 'primary' | 'empty';
 
-/**
- * Props for `PrimaryButton`.
- */
-export interface Props
+type ToolbarButtonFontWeights = 'normal' | 'bold';
+
+type ButtonPositions = 'left' | 'right' | 'center' | 'none';
+
+type ButtonRenderStyle = 'standard' | 'iconButton';
+
+interface ToolbarButtonCommonProps
   extends Pick<
     EuiButtonPropsForButton,
-    'onClick' | 'iconType' | 'iconSide' | 'size' | 'data-test-subj' | 'isDisabled'
+    'onClick' | 'iconType' | 'size' | 'data-test-subj' | 'isDisabled'
   > {
-  label: string;
+  /**
+   * Render style of the toolbar button
+   */
+  as?: ButtonRenderStyle;
   type?: ToolbarButtonTypes;
+  /**
+   * Adjusts the borders for groupings
+   */
+  groupPosition?: ButtonPositions;
 }
 
-export const ToolbarButton: React.FunctionComponent<Props> = ({
+type ToolbarStandardButton = Pick<EuiButtonPropsForButton, 'fullWidth' | 'isLoading' | 'iconSide'> &
+  Omit<ToolbarButtonCommonProps, 'label'> & {
+    as?: Extract<ButtonRenderStyle, 'standard'>;
+    /**
+     * Display text for toolbar button
+     */
+    label: React.ReactNode;
+    /**
+     * Determines if the button will have a down arrow or not
+     */
+    hasArrow?: boolean;
+    /**
+     * Determines prominence
+     */
+    fontWeight?: ToolbarButtonFontWeights;
+  };
+
+type ToolbarIconButton = ToolbarButtonCommonProps & {
+  as: Extract<ButtonRenderStyle, 'iconButton'>;
+  iconType: IconType;
+  label?: string;
+};
+
+/**
+ * Props for `PrimaryButton`.
+ */
+export type Props<T extends ButtonRenderStyle> = T extends Extract<ButtonRenderStyle, 'iconButton'>
+  ? ToolbarIconButton
+  : ToolbarStandardButton;
+
+const isIconButton = (
+  props: ToolbarStandardButton | ToolbarIconButton
+): props is ToolbarIconButton => {
+  return (props as ToolbarIconButton).as === 'iconButton';
+};
+
+const computeToolbarButtonCommonCSSProps = (
+  euiTheme: ReturnType<typeof useEuiTheme>,
+  {
+    type,
+    isDisabled,
+    groupPosition,
+  }: Pick<Props<ButtonRenderStyle>, 'type' | 'isDisabled' | 'groupPosition'>
+) => {
+  const toolButtonStyles = ToolbarButtonStyles(euiTheme);
+
+  const groupPositionStyles =
+    groupPosition && groupPosition !== 'none'
+      ? toolButtonStyles.buttonPositions[groupPosition]
+      : {};
+
+  const defaultStyles = {
+    ...toolButtonStyles.default,
+    ...groupPositionStyles,
+  };
+
+  return isDisabled
+    ? defaultStyles
+    : {
+        ...defaultStyles,
+        ...(type === 'primary' ? {} : toolButtonStyles.emptyButton),
+      };
+};
+
+const ToolbarStandardButton = ({
+  hasArrow = true,
+  fontWeight = 'normal',
+  type,
   label,
-  type = 'empty',
-  iconSide = 'left',
-  size = 'm',
+  iconSide,
+  iconType,
+  fullWidth,
   isDisabled,
+  groupPosition,
   ...rest
-}) => {
+}: Omit<ToolbarStandardButton, 'as'>) => {
   const euiTheme = useEuiTheme();
-  const toolbarButtonStyleProps: EuiButtonPropsForButton = !isDisabled
-    ? type === 'primary'
-      ? { color: 'primary', fill: true }
-      : { color: 'text', css: ToolbarButtonStyles(euiTheme).emptyButton }
-    : {};
+  const cssProps = {
+    ...computeToolbarButtonCommonCSSProps(euiTheme, { type, isDisabled, groupPosition }),
+    fontWeight: fontWeightDefinitions(euiTheme.euiTheme)[fontWeight],
+  };
+
+  const toolbarButtonStyleProps: EuiButtonPropsForButton = isDisabled
+    ? {}
+    : type === 'primary'
+    ? { color: 'primary', fill: true }
+    : { color: 'text' };
+
+  const icon = iconType ?? (hasArrow ? 'arrowDown' : '');
 
   return (
     <EuiButton
-      size={size}
+      size={rest.size}
       isDisabled={isDisabled}
+      css={cssProps}
+      iconType={icon}
+      iconSide={iconType ? iconSide : 'right'}
+      fullWidth={fullWidth}
+      contentProps={fullWidth ? { style: { justifyContent: 'space-between' } } : {}}
       {...toolbarButtonStyleProps}
-      {...{ iconSide, ...rest }}
+      {...rest}
     >
       {label}
     </EuiButton>
   );
 };
+
+const ToolbarIconButton = ({
+  size,
+  type,
+  label,
+  isDisabled,
+  groupPosition,
+  ...rest
+}: Omit<ToolbarIconButton, 'as'>) => {
+  const euiTheme = useEuiTheme();
+  const cssProps = computeToolbarButtonCommonCSSProps(euiTheme, {
+    type,
+    isDisabled,
+    groupPosition,
+  });
+
+  return (
+    <EuiButtonIcon
+      {...rest}
+      disabled={isDisabled}
+      aria-label={label}
+      size={size}
+      iconSize={size}
+      css={cssProps}
+      display={type === 'primary' ? 'fill' : 'base'}
+      color={type === 'primary' ? 'primary' : 'text'}
+    />
+  );
+};
+
+export function ToolbarButton<T extends ButtonRenderStyle>(props: Props<T>) {
+  const { type = 'empty', size = 'm' } = props;
+
+  if (isIconButton(props)) {
+    return <ToolbarIconButton {...props} size={size} type={type} />;
+  }
+
+  return <ToolbarStandardButton {...props} size={size} type={type} />;
+}
diff --git a/packages/shared-ux/button_toolbar/src/popover/popover.test.tsx b/packages/shared-ux/button_toolbar/src/popover/popover.test.tsx
index b03cb9e63d4609..dfaba0f816e7ec 100644
--- a/packages/shared-ux/button_toolbar/src/popover/popover.test.tsx
+++ b/packages/shared-ux/button_toolbar/src/popover/popover.test.tsx
@@ -37,7 +37,7 @@ describe('<ToolbarPopover />', () => {
     expect(button.prop('color')).toBe('text');
     expect(button.prop('css')).toMatchObject({
       backgroundColor: '#FFF',
-      border: '1px solid #D3DAE6 !important',
+      border: '1px solid #D3DAE6',
       color: '#343741',
     });
   });
diff --git a/packages/shared-ux/button_toolbar/src/popover/popover.tsx b/packages/shared-ux/button_toolbar/src/popover/popover.tsx
index 25dff5c52250f7..c7af471b6eb483 100644
--- a/packages/shared-ux/button_toolbar/src/popover/popover.tsx
+++ b/packages/shared-ux/button_toolbar/src/popover/popover.tsx
@@ -12,7 +12,10 @@ import { Props as EuiPopoverProps } from '@elastic/eui/src/components/popover/po
 
 import { ToolbarButtonProps, ToolbarButton } from '../buttons';
 
-type AllowedButtonProps = Omit<ToolbarButtonProps, 'iconSide' | 'onClick' | 'fill'>;
+type AllowedButtonProps = Omit<
+  ToolbarButtonProps<'standard'>,
+  'iconSide' | 'onClick' | 'fill' | 'label'
+>;
 type AllowedPopoverProps = Omit<
   EuiPopoverProps,
   'button' | 'isOpen' | 'closePopover' | 'anchorPosition'
@@ -24,6 +27,7 @@ type AllowedPopoverProps = Omit<
 export type Props = AllowedButtonProps &
   AllowedPopoverProps & {
     children: (arg: { closePopover: () => void }) => React.ReactNode;
+    label: NonNullable<ToolbarButtonProps<'standard'>['label']>;
   };
 
 /**
diff --git a/packages/shared-ux/button_toolbar/src/toolbar/__snapshots__/toolbar.test.tsx.snap b/packages/shared-ux/button_toolbar/src/toolbar/__snapshots__/toolbar.test.tsx.snap
index 44b910bf017e72..32844b4bef9c67 100644
--- a/packages/shared-ux/button_toolbar/src/toolbar/__snapshots__/toolbar.test.tsx.snap
+++ b/packages/shared-ux/button_toolbar/src/toolbar/__snapshots__/toolbar.test.tsx.snap
@@ -8,7 +8,7 @@ exports[`<Toolbar /> is rendered 1`] = `
     class="euiFlexItem emotion-euiFlexItem-growZero"
   >
     <button
-      class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-fill-primary"
+      class="euiButton emotion-euiButtonDisplay-m-defaultMinWidth-EuiButton"
       type="button"
     >
       <span
@@ -19,6 +19,10 @@ exports[`<Toolbar /> is rendered 1`] = `
         >
           Create chart
         </span>
+        <span
+          color="inherit"
+          data-euiicon-type="arrowDown"
+        />
       </span>
     </button>
   </div>
diff --git a/packages/shared-ux/card/no_data/impl/src/__snapshots__/no_data_card.test.tsx.snap b/packages/shared-ux/card/no_data/impl/src/__snapshots__/no_data_card.test.tsx.snap
index 9c91d99f1dc14e..474abd65a59912 100644
--- a/packages/shared-ux/card/no_data/impl/src/__snapshots__/no_data_card.test.tsx.snap
+++ b/packages/shared-ux/card/no_data/impl/src/__snapshots__/no_data_card.test.tsx.snap
@@ -3,6 +3,7 @@
 exports[`NoDataCard props button 1`] = `
 <div
   css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+  data-test-subj="kbnRedirectAppLink"
 >
   <div
     class="euiPanel euiPanel--plain euiPanel--paddingLarge euiCard emotion-euiPanel-grow-m-l-plain-hasShadow-isClickable-EuiCard"
@@ -83,6 +84,7 @@ exports[`NoDataCard props button 1`] = `
 exports[`NoDataCard props extends EuiCardProps 1`] = `
 <div
   css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+  data-test-subj="kbnRedirectAppLink"
 >
   <div
     class="euiPanel euiPanel--plain euiPanel--paddingLarge euiCard custom_class emotion-euiPanel-grow-m-l-plain-hasShadow-isClickable-EuiCard"
@@ -163,6 +165,7 @@ exports[`NoDataCard props extends EuiCardProps 1`] = `
 exports[`NoDataCard props href 1`] = `
 <div
   css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+  data-test-subj="kbnRedirectAppLink"
 >
   <div
     class="euiPanel euiPanel--plain euiPanel--paddingLarge euiCard emotion-euiPanel-grow-m-l-plain-hasShadow-isClickable-EuiCard"
@@ -243,6 +246,7 @@ exports[`NoDataCard props href 1`] = `
 exports[`NoDataCard props no access to Fleet 1`] = `
 <div
   css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+  data-test-subj="kbnRedirectAppLink"
 >
   <div
     class="euiPanel euiPanel--subdued euiPanel--paddingLarge euiCard emotion-euiPanel-grow-m-l-subdued-EuiCard"
@@ -308,6 +312,7 @@ exports[`NoDataCard props no access to Fleet 1`] = `
 exports[`NoDataCard renders 1`] = `
 <div
   css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+  data-test-subj="kbnRedirectAppLink"
 >
   <div
     class="euiPanel euiPanel--plain euiPanel--paddingLarge euiCard emotion-euiPanel-grow-m-l-plain-hasShadow-isClickable-EuiCard"
diff --git a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.component.tsx b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.component.tsx
index 9148a0b60acf72..96e80af2465117 100644
--- a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.component.tsx
+++ b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.component.tsx
@@ -45,7 +45,12 @@ export const RedirectAppLinks: FC<RedirectAppLinksComponentProps> = ({
 
   return (
     // eslint-disable-next-line jsx-a11y/click-events-have-key-events
-    <div onClick={handleClick} ref={containerRef} css={redirectAppLinksStyles}>
+    <div
+      onClick={handleClick}
+      ref={containerRef}
+      css={redirectAppLinksStyles}
+      data-test-subj="kbnRedirectAppLink"
+    >
       {children}
     </div>
   );
diff --git a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.stories.tsx b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.stories.tsx
index 43f907c32fc18e..cec520990edc33 100644
--- a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.stories.tsx
+++ b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.stories.tsx
@@ -29,31 +29,33 @@ const mock = new RedirectAppLinksStorybookMock();
 
 export const RedirectAppLinks = () => {
   return (
-    <>
-      <Component {...mock.getProps()}>
-        <EuiFlexGroup>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              data-test-subj="storybookButton"
-              iconType="plusInCircle"
-              href="/some-test-url"
-            >
-              Button with URL
-            </EuiButton>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              data-test-subj="storybookButton"
-              iconType="plusInCircle"
-              onClick={action('onClick')}
-            >
-              Button without URL
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </Component>
-      <EuiFlexGroup>
-        <EuiFlexItem grow={false}>
+    <EuiFlexGroup direction="column">
+      <EuiFlexItem>
+        <Component {...mock.getProps()}>
+          <EuiFlexGroup>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                data-test-subj="storybookButton"
+                iconType="plusInCircle"
+                href="/some-test-url"
+              >
+                Button with URL
+              </EuiButton>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                data-test-subj="storybookButton"
+                iconType="plusInCircle"
+                onClick={action('onClick')}
+              >
+                Button without URL
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </Component>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <div>
           <EuiButton
             data-test-subj="storybookButton"
             iconType="plusInCircle"
@@ -61,9 +63,9 @@ export const RedirectAppLinks = () => {
           >
             Button outside RedirectAppLinks
           </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </>
+        </div>
+      </EuiFlexItem>
+    </EuiFlexGroup>
   );
 };
 
diff --git a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.styles.ts b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.styles.ts
index d479cc97a78c1d..6ce56cb4aa67f1 100644
--- a/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.styles.ts
+++ b/packages/shared-ux/link/redirect_app/impl/src/redirect_app_links.styles.ts
@@ -9,6 +9,9 @@
 import { css } from '@emotion/react';
 
 export const redirectAppLinksStyles = css({
-  display: 'flex',
+  display: 'inherit',
+  height: 'inherit',
+  width: 'inherit',
   flex: '1',
+  flexFlow: 'column nowrap',
 });
diff --git a/src/cli/serve/integration_tests/serverless_config_flag.test.ts b/src/cli/serve/integration_tests/serverless_config_flag.test.ts
index 9d20722ecbfc5a..77c15f832081a5 100644
--- a/src/cli/serve/integration_tests/serverless_config_flag.test.ts
+++ b/src/cli/serve/integration_tests/serverless_config_flag.test.ts
@@ -15,7 +15,10 @@ import { filter, firstValueFrom, from, concatMap } from 'rxjs';
 import { REPO_ROOT } from '@kbn/repo-info';
 import { getConfigDirectory } from '@kbn/utils';
 
-describe('cli serverless project type', () => {
+// Failing: See https://github.com/elastic/kibana/issues/163257
+// Failing: See https://github.com/elastic/kibana/issues/163258
+// Failing: See https://github.com/elastic/kibana/issues/163259
+describe.skip('cli serverless project type', () => {
   let child: ChildProcessWithoutNullStreams | undefined;
 
   afterEach(() => {
diff --git a/src/core/public/index.ts b/src/core/public/index.ts
index b874a937257b21..6b29603dd63f65 100644
--- a/src/core/public/index.ts
+++ b/src/core/public/index.ts
@@ -187,6 +187,7 @@ export type {
   HttpResponse,
   HttpHandler,
   IBasePath,
+  IStaticAssets,
   IAnonymousPaths,
   IExternalUrl,
   IHttpInterceptController,
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index 30562d389ac416..3e63315e6d8fa5 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -184,6 +184,7 @@ export type {
   ICspConfig,
   IExternalUrlConfig,
   IBasePath,
+  IStaticAssets,
   SessionStorage,
   SessionStorageCookieOptions,
   SessionCookieValidationResult,
diff --git a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
index 5aab1412e92731..be5e3331da7d39 100644
--- a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
@@ -125,9 +125,9 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "monitoring-telemetry": "5d91bf75787d9d4dd2fae954d0b3f76d33d2e559",
         "observability-onboarding-state": "b16064c516aac64ae699c737d7d10b6e199bfded",
         "osquery-manager-usage-metric": "983bcbc3b7dda0aad29b20907db233abba709bcc",
-        "osquery-pack": "6ab4358ca4304a12dcfc1777c8135b75cffb4397",
-        "osquery-pack-asset": "b14101d3172c4b60eb5404696881ce5275c84152",
-        "osquery-saved-query": "44f1161e165defe3f9b6ad643c68c542a765fcdb",
+        "osquery-pack": "702e86b1a936153b39f65b0781bdc136e186e123",
+        "osquery-pack-asset": "cd140bc2e4b092e93692b587bf6e38051ef94c75",
+        "osquery-saved-query": "6095e288750aa3164dfe186c74bc5195c2bf2bd4",
         "policy-settings-protection-updates-note": "33924bb246f9e5bcb876109cc83e3c7a28308352",
         "query": "21cbbaa09abb679078145ce90087b1e88b7eae95",
         "risk-engine-configuration": "b105d4a3c6adce40708d729d12e5ef3c8fbd9508",
@@ -142,7 +142,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "siem-ui-timeline": "d3de8ff3617be8f2a799d66b1471b9be6124bf40",
         "siem-ui-timeline-note": "0a32fb776907f596bedca292b8c646496ae9c57b",
         "siem-ui-timeline-pinned-event": "082daa3ce647b33873f6abccf340bdfa32057c8d",
-        "slo": "2048ab6791df2e1ae0936f29c20765cb8d2fcfaa",
+        "slo": "9a9995e4572de1839651c43b5fc4dc8276bb5815",
         "space": "8de4ec513e9bbc6b2f1d635161d850be7747d38e",
         "spaces-usage-stats": "3abca98713c52af8b30300e386c7779b3025a20e",
         "synthetics-monitor": "33ddc4b8979f378edf58bcc7ba13c5c5b572f42d",
diff --git a/src/core/server/integration_tests/elasticsearch/error_logging.test.ts b/src/core/server/integration_tests/elasticsearch/error_logging.test.ts
new file mode 100644
index 00000000000000..8cd4f5ae411343
--- /dev/null
+++ b/src/core/server/integration_tests/elasticsearch/error_logging.test.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  createTestServers,
+  type TestElasticsearchUtils,
+  type TestKibanaUtils,
+} from '@kbn/core-test-helpers-kbn-server';
+
+describe('Error logging', () => {
+  describe('ES client errors', () => {
+    let mockConsoleLog: jest.SpyInstance;
+    let esServer: TestElasticsearchUtils;
+    let kibanaServer: TestKibanaUtils;
+
+    beforeAll(async () => {
+      mockConsoleLog = jest.spyOn(global.console, 'log');
+
+      const { startES, startKibana } = createTestServers({
+        adjustTimeout: jest.setTimeout,
+        settings: {
+          kbn: {
+            logging: {
+              appenders: {
+                'console-json': {
+                  type: 'console',
+                  layout: {
+                    type: 'json',
+                  },
+                },
+              },
+              loggers: [{ name: 'console-json', appenders: ['console-json'], level: 'debug' }],
+            },
+          },
+        },
+      });
+
+      esServer = await startES();
+      kibanaServer = await startKibana();
+    });
+
+    beforeEach(() => {
+      mockConsoleLog.mockClear();
+    });
+
+    afterAll(async () => {
+      mockConsoleLog.mockRestore();
+      await kibanaServer.stop();
+      await esServer.stop();
+    });
+
+    it('logs errors following the expected pattern for the json layout', async () => {
+      const esClient = kibanaServer.coreStart.elasticsearch.client.asInternalUser;
+      const logger = kibanaServer.root.logger.get('console-json');
+
+      try {
+        await esClient.search({
+          index: '.kibana',
+          // @ts-expect-error yes this is invalid
+          query: { someInvalidQuery: { foo: 'bar' } },
+        });
+        expect('should have thrown').toEqual('but it did not');
+      } catch (e) {
+        logger.info('logging elasticsearch error', e);
+
+        const calls = mockConsoleLog.mock.calls;
+        const ourCall = calls
+          .map((call) => call[0])
+          .find((call) => call.includes('logging elasticsearch error'));
+
+        expect(JSON.parse(ourCall)).toEqual({
+          '@timestamp': expect.any(String),
+          ecs: {
+            version: expect.any(String),
+          },
+          log: {
+            level: 'INFO',
+            logger: 'console-json',
+          },
+          message: 'logging elasticsearch error',
+          name: 'ResponseError',
+          process: {
+            pid: expect.any(Number),
+          },
+        });
+      }
+    });
+  });
+});
diff --git a/src/core/server/integration_tests/elasticsearch/errors.test.ts b/src/core/server/integration_tests/elasticsearch/errors.test.ts
index b9dcfb33a23a48..abefdc7bf356ce 100644
--- a/src/core/server/integration_tests/elasticsearch/errors.test.ts
+++ b/src/core/server/integration_tests/elasticsearch/errors.test.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { inspect } from 'util';
 import {
   createTestServers,
   type TestElasticsearchUtils,
@@ -67,4 +68,28 @@ describe('elasticsearch clients errors', () => {
       `);
     }
   });
+
+  it('has the proper inspect representation', async () => {
+    const esClient = kibanaServer.coreStart.elasticsearch.client.asInternalUser;
+
+    try {
+      await esClient.search({
+        index: '.kibana',
+        // @ts-expect-error yes this is invalid
+        query: { someInvalidQuery: { foo: 'bar' } },
+      });
+      expect('should have thrown').toEqual('but it did not');
+    } catch (e) {
+      expect(inspect(e)).toMatchInlineSnapshot(`
+        "{
+          name: 'ResponseError',
+          message: 'parsing_exception\\\\n' +
+            '\\\\tCaused by:\\\\n' +
+            '\\\\t\\\\tnamed_object_not_found_exception: [1:30] unknown field [someInvalidQuery]\\\\n' +
+            '\\\\tRoot causes:\\\\n' +
+            '\\\\t\\\\tparsing_exception: unknown query [someInvalidQuery]'
+        }"
+      `);
+    }
+  });
 });
diff --git a/src/core/server/integration_tests/http/http_server.test.ts b/src/core/server/integration_tests/http/http_server.test.ts
index f65a5b59487bee..da10b231b7a226 100644
--- a/src/core/server/integration_tests/http/http_server.test.ts
+++ b/src/core/server/integration_tests/http/http_server.test.ts
@@ -36,6 +36,7 @@ describe('Http server', () => {
         allowFromAnyIp: true,
         ipAllowlist: [],
       },
+      cdn: {},
       cors: {
         enabled: false,
       },
diff --git a/src/core/server/integration_tests/http/request_representation.test.ts b/src/core/server/integration_tests/http/request_representation.test.ts
new file mode 100644
index 00000000000000..28a871ea8f849c
--- /dev/null
+++ b/src/core/server/integration_tests/http/request_representation.test.ts
@@ -0,0 +1,248 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'),
+}));
+
+import supertest from 'supertest';
+import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
+import { executionContextServiceMock } from '@kbn/core-execution-context-server-mocks';
+import { contextServiceMock } from '@kbn/core-http-context-server-mocks';
+import type { HttpService } from '@kbn/core-http-server-internal';
+import { ensureRawRequest } from '@kbn/core-http-router-server-internal';
+import { createHttpServer } from '@kbn/core-http-server-mocks';
+import { inspect } from 'util';
+
+let server: HttpService;
+
+let logger: ReturnType<typeof loggingSystemMock.create>;
+const contextSetup = contextServiceMock.createSetupContract();
+
+const setupDeps = {
+  context: contextSetup,
+  executionContext: executionContextServiceMock.createInternalSetupContract(),
+};
+
+beforeEach(async () => {
+  logger = loggingSystemMock.create();
+
+  server = createHttpServer({ logger });
+  await server.preboot({ context: contextServiceMock.createPrebootContract() });
+});
+
+afterEach(async () => {
+  await server.stop();
+});
+
+const replacePorts = (input: string): string => input.replace(/[:][0-9]+[/]/g, ':XXXX/');
+
+describe('request logging', () => {
+  describe('KibanaRequest', () => {
+    it('has expected string representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          return res.ok({ body: { req: String(req) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toEqual(
+        `[CoreKibanaRequest id="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" method="get" url="http://127.0.0.1:XXXX/" fake="false" system="false" api="false"]`
+      );
+    });
+
+    it('has expected JSON representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          return res.ok({ body: { req: JSON.stringify(req) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+
+      expect(JSON.parse(replacePorts(response.body.req))).toEqual({
+        id: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+        url: 'http://127.0.0.1:XXXX/',
+        isFakeRequest: false,
+        isInternalApiRequest: false,
+        isSystemRequest: false,
+        auth: {
+          isAuthenticated: false,
+        },
+        route: {
+          method: 'get',
+          path: '/',
+          options: expect.any(Object),
+        },
+        uuid: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+      });
+    });
+
+    it('has expected inspect representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          return res.ok({ body: { req: inspect(req) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toMatchInlineSnapshot(`
+        "{
+          id: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+          uuid: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+          url: 'http://127.0.0.1:XXXX/',
+          isFakeRequest: false,
+          isSystemRequest: false,
+          isInternalApiRequest: false,
+          auth: { isAuthenticated: false },
+          route: {
+            path: '/',
+            method: 'get',
+            options: {
+              authRequired: true,
+              xsrfRequired: false,
+              access: 'internal',
+              tags: [],
+              timeout: [Object],
+              body: undefined
+            }
+          }
+        }"
+      `);
+    });
+  });
+
+  describe('HAPI request', () => {
+    it('has expected string representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRequest = ensureRawRequest(req);
+          return res.ok({ body: { req: String(rawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toEqual(
+        `[HAPI.Request method="get" url="http://127.0.0.1:XXXX/"]`
+      );
+    });
+
+    it('has expected JSON representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRequest = ensureRawRequest(req);
+          return res.ok({ body: { req: JSON.stringify(rawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(JSON.parse(replacePorts(response.body.req))).toEqual({
+        method: 'get',
+        url: 'http://127.0.0.1:XXXX/',
+      });
+    });
+
+    it('has expected inspect representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRequest = ensureRawRequest(req);
+          return res.ok({ body: { req: inspect(rawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toMatchInlineSnapshot(
+        `"{ method: 'get', url: 'http://127.0.0.1:XXXX/' }"`
+      );
+    });
+  });
+
+  describe('http.IncomingMessage', () => {
+    it('has expected string representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRawRequest = ensureRawRequest(req).raw.req;
+          return res.ok({ body: { req: String(rawRawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toEqual(
+        `[http.IncomingMessage method="GET" url="/" complete="true" aborted="false"]`
+      );
+    });
+
+    it('has expected JSON representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRawRequest = ensureRawRequest(req).raw.req;
+          return res.ok({ body: { req: JSON.stringify(rawRawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(JSON.parse(replacePorts(response.body.req))).toEqual({
+        aborted: false,
+        complete: true,
+        method: 'GET',
+        url: '/',
+      });
+    });
+
+    it('has expected inspect representation', async () => {
+      const { server: innerServer, createRouter } = await server.setup(setupDeps);
+      const router = createRouter('/');
+      router.get(
+        { path: '/', validate: false, options: { authRequired: true } },
+        (context, req, res) => {
+          const rawRawRequest = ensureRawRequest(req).raw.req;
+          return res.ok({ body: { req: inspect(rawRawRequest) } });
+        }
+      );
+      await server.start();
+
+      const response = await supertest(innerServer.listener).get('/').expect(200);
+      expect(replacePorts(response.body.req)).toMatchInlineSnapshot(
+        `"{ method: 'GET', url: '/', complete: true, aborted: false }"`
+      );
+    });
+  });
+});
diff --git a/src/dev/precommit_hook/casing_check_config.js b/src/dev/precommit_hook/casing_check_config.js
index 93eba1bb171b2c..acf4748055589a 100644
--- a/src/dev/precommit_hook/casing_check_config.js
+++ b/src/dev/precommit_hook/casing_check_config.js
@@ -44,7 +44,7 @@ export const IGNORE_FILE_GLOBS = [
   'packages/kbn-test/jest-preset.js',
   'packages/kbn-test/*/jest-preset.js',
   'test/package/Vagrantfile',
-  'x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/Vagrantfile',
+  'x-pack/plugins/security_solution/scripts/endpoint/common/vagrant/Vagrantfile',
   '**/test/**/fixtures/**/*',
 
   // Required to match the name in the docs.elastic.dev repo.
diff --git a/src/plugins/advanced_settings/server/index.ts b/src/plugins/advanced_settings/server/index.ts
index f78be24868a5c7..de573ad54cd668 100644
--- a/src/plugins/advanced_settings/server/index.ts
+++ b/src/plugins/advanced_settings/server/index.ts
@@ -7,9 +7,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { AdvancedSettingsServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new AdvancedSettingsServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { AdvancedSettingsServerPlugin } = await import('./plugin');
+  return new AdvancedSettingsServerPlugin(initContext);
+};
diff --git a/src/plugins/bfetch/server/index.ts b/src/plugins/bfetch/server/index.ts
index f0e6b15f997583..6e477df5504198 100644
--- a/src/plugins/bfetch/server/index.ts
+++ b/src/plugins/bfetch/server/index.ts
@@ -7,10 +7,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { BfetchServerPlugin } from './plugin';
 
 export type { BfetchServerSetup, BfetchServerStart, BatchProcessingRouteParams } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { BfetchServerPlugin } = await import('./plugin');
   return new BfetchServerPlugin(initializerContext);
 }
diff --git a/src/plugins/bfetch/server/mocks.ts b/src/plugins/bfetch/server/mocks.ts
index d1be681dd407ff..4fb5d1ea8eb582 100644
--- a/src/plugins/bfetch/server/mocks.ts
+++ b/src/plugins/bfetch/server/mocks.ts
@@ -31,7 +31,7 @@ const createPlugin = async () => {
   const pluginInitializerContext = coreMock.createPluginInitializerContext();
   const coreSetup = coreMock.createSetup();
   const coreStart = coreMock.createStart();
-  const plugin = pluginInitializer(pluginInitializerContext);
+  const plugin = await pluginInitializer(pluginInitializerContext);
   const setup = await plugin.setup(coreSetup, {});
 
   return {
diff --git a/src/plugins/chart_expressions/expression_gauge/server/index.ts b/src/plugins/chart_expressions/expression_gauge/server/index.ts
index b0539ab12b18c2..9420c05feddf64 100644
--- a/src/plugins/chart_expressions/expression_gauge/server/index.ts
+++ b/src/plugins/chart_expressions/expression_gauge/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionGaugePlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionGaugePlugin } = await import('./plugin');
   return new ExpressionGaugePlugin();
 }
diff --git a/src/plugins/chart_expressions/expression_heatmap/server/index.ts b/src/plugins/chart_expressions/expression_heatmap/server/index.ts
index fbbf8027eb343c..869886ca210f19 100644
--- a/src/plugins/chart_expressions/expression_heatmap/server/index.ts
+++ b/src/plugins/chart_expressions/expression_heatmap/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionHeatmapPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionHeatmapPlugin } = await import('./plugin');
   return new ExpressionHeatmapPlugin();
 }
diff --git a/src/plugins/chart_expressions/expression_legacy_metric/server/index.ts b/src/plugins/chart_expressions/expression_legacy_metric/server/index.ts
index 9c9c1641b68a82..6053a916e2b96e 100644
--- a/src/plugins/chart_expressions/expression_legacy_metric/server/index.ts
+++ b/src/plugins/chart_expressions/expression_legacy_metric/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionLegacyMetricPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionLegacyMetricPlugin } = await import('./plugin');
   return new ExpressionLegacyMetricPlugin();
 }
diff --git a/src/plugins/chart_expressions/expression_metric/server/index.ts b/src/plugins/chart_expressions/expression_metric/server/index.ts
index dfb442514d5f0b..8bdbfd5b4f372e 100644
--- a/src/plugins/chart_expressions/expression_metric/server/index.ts
+++ b/src/plugins/chart_expressions/expression_metric/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionMetricPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionMetricPlugin } = await import('./plugin');
   return new ExpressionMetricPlugin();
 }
diff --git a/src/plugins/chart_expressions/expression_partition_vis/server/index.ts b/src/plugins/chart_expressions/expression_partition_vis/server/index.ts
index 98395d521e238d..30a53f4cfb8d2e 100755
--- a/src/plugins/chart_expressions/expression_partition_vis/server/index.ts
+++ b/src/plugins/chart_expressions/expression_partition_vis/server/index.ts
@@ -6,9 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionPartitionVisPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionPartitionVisPlugin } = await import('./plugin');
   return new ExpressionPartitionVisPlugin();
 }
 
diff --git a/src/plugins/chart_expressions/expression_tagcloud/server/index.ts b/src/plugins/chart_expressions/expression_tagcloud/server/index.ts
index c9441682713141..337d6cdc636cb6 100644
--- a/src/plugins/chart_expressions/expression_tagcloud/server/index.ts
+++ b/src/plugins/chart_expressions/expression_tagcloud/server/index.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionTagcloudPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionTagcloudPlugin } = await import('./plugin');
   return new ExpressionTagcloudPlugin();
 }
diff --git a/src/plugins/chart_expressions/expression_xy/server/index.ts b/src/plugins/chart_expressions/expression_xy/server/index.ts
index e529b2a15fe34d..453e9ed3dc3d68 100755
--- a/src/plugins/chart_expressions/expression_xy/server/index.ts
+++ b/src/plugins/chart_expressions/expression_xy/server/index.ts
@@ -6,9 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionXyPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ExpressionXyPlugin } = await import('./plugin');
   return new ExpressionXyPlugin();
 }
 
diff --git a/src/plugins/charts/server/index.ts b/src/plugins/charts/server/index.ts
index ec59c25b50e987..0317ad486c3466 100644
--- a/src/plugins/charts/server/index.ts
+++ b/src/plugins/charts/server/index.ts
@@ -6,8 +6,10 @@
  * Side Public License, v 1.
  */
 
-import { ChartsServerPlugin } from './plugin';
 export type { CustomPaletteArguments, CustomPaletteState, SystemPaletteArguments } from '../common';
 export { paletteIds } from '../common';
 
-export const plugin = () => new ChartsServerPlugin();
+export const plugin = async () => {
+  const { ChartsServerPlugin } = await import('./plugin');
+  return new ChartsServerPlugin();
+};
diff --git a/src/plugins/console/server/index.ts b/src/plugins/console/server/index.ts
index 84f0d5cbad2506..5def502ed5a251 100644
--- a/src/plugins/console/server/index.ts
+++ b/src/plugins/console/server/index.ts
@@ -8,10 +8,12 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { ConsoleServerPlugin } from './plugin';
-
 export type { ConsoleSetup, ConsoleStart } from './types';
 
 export { config } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new ConsoleServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { ConsoleServerPlugin } = await import('./plugin');
+
+  return new ConsoleServerPlugin(ctx);
+};
diff --git a/src/plugins/content_management/server/index.ts b/src/plugins/content_management/server/index.ts
index cdd69cb99b296b..3e8a540d3f6bb5 100644
--- a/src/plugins/content_management/server/index.ts
+++ b/src/plugins/content_management/server/index.ts
@@ -7,9 +7,8 @@
  */
 import type { PluginInitializerContext } from '@kbn/core/server';
 
-import { ContentManagementPlugin } from './plugin';
-
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ContentManagementPlugin } = await import('./plugin');
   return new ContentManagementPlugin(initializerContext);
 }
 
diff --git a/src/plugins/controls/server/index.ts b/src/plugins/controls/server/index.ts
index cec761ae80e202..e003036dc8f477 100644
--- a/src/plugins/controls/server/index.ts
+++ b/src/plugins/controls/server/index.ts
@@ -6,8 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ControlsPlugin } from './plugin';
-
-export const plugin = () => new ControlsPlugin();
+export const plugin = async () => {
+  const { ControlsPlugin } = await import('./plugin');
+  return new ControlsPlugin();
+};
 
 export { initializeControlGroupTelemetry } from './control_group/control_group_telemetry';
diff --git a/src/plugins/custom_integrations/server/index.ts b/src/plugins/custom_integrations/server/index.ts
index 95e181903e9733..dcca939d117ce2 100755
--- a/src/plugins/custom_integrations/server/index.ts
+++ b/src/plugins/custom_integrations/server/index.ts
@@ -8,12 +8,12 @@
 
 import { schema } from '@kbn/config-schema';
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CustomIntegrationsPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CustomIntegrationsPlugin } = await import('./plugin');
   return new CustomIntegrationsPlugin(initializerContext);
 }
 
diff --git a/src/plugins/dashboard/public/dashboard_actions/filters_notification_popover_contents.tsx b/src/plugins/dashboard/public/dashboard_actions/filters_notification_popover_contents.tsx
index 37769e2de42c7b..54003517290151 100644
--- a/src/plugins/dashboard/public/dashboard_actions/filters_notification_popover_contents.tsx
+++ b/src/plugins/dashboard/public/dashboard_actions/filters_notification_popover_contents.tsx
@@ -80,6 +80,7 @@ export function FiltersNotificationPopoverContents({
           <EuiFormRow
             label={dashboardFilterNotificationActionStrings.getQueryTitle()}
             display="rowCompressed"
+            fullWidth
           >
             <EuiCodeBlock
               language={queryLanguage}
@@ -92,7 +93,7 @@ export function FiltersNotificationPopoverContents({
           </EuiFormRow>
         )}
         {filters && filters.length > 0 && (
-          <EuiFormRow label={dashboardFilterNotificationActionStrings.getFiltersTitle()}>
+          <EuiFormRow label={dashboardFilterNotificationActionStrings.getFiltersTitle()} fullWidth>
             <EuiFlexGroup wrap={true} gutterSize="xs">
               <FilterItems filters={filters} indexPatterns={dataViews} readOnly={true} />
             </EuiFlexGroup>
diff --git a/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts b/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
index 6fefffcc1d668d..8e2f7b07d195a1 100644
--- a/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
+++ b/src/plugins/dashboard/public/dashboard_app/_dashboard_app_strings.ts
@@ -152,7 +152,7 @@ export const shareModalStrings = {
 */
 export const getDashboardBreadcrumb = () =>
   i18n.translate('dashboard.dashboardAppBreadcrumbsTitle', {
-    defaultMessage: 'Dashboard',
+    defaultMessage: 'Dashboards',
   });
 
 export const topNavStrings = {
diff --git a/src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.test.tsx b/src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.test.tsx
index 5ba29031d5cb78..529f13dc261ff1 100644
--- a/src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.test.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/external_api/dashboard_renderer.test.tsx
@@ -11,6 +11,7 @@ import { ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { mountWithIntl } from '@kbn/test-jest-helpers';
 import { NotFoundPrompt } from '@kbn/shared-ux-prompt-not-found';
+import { setStubKibanaServices } from '@kbn/embeddable-plugin/public/mocks';
 
 import { DashboardContainerFactory } from '..';
 import { DASHBOARD_CONTAINER_TYPE } from '../..';
@@ -168,6 +169,9 @@ describe('dashboard renderer', () => {
   });
 
   test('renders a 404 page when initial dashboard creation returns a savedObjectNotFound error', async () => {
+    // mock embeddable dependencies so that the embeddable panel renders
+    setStubKibanaServices();
+
     // ensure that the first attempt at creating a dashboard results in a 404
     const mockErrorEmbeddable = {
       error: new SavedObjectNotFound('dashboard', 'gat em'),
diff --git a/src/plugins/dashboard/public/plugin.tsx b/src/plugins/dashboard/public/plugin.tsx
index 4d46b837da5ca6..98af5088967f2d 100644
--- a/src/plugins/dashboard/public/plugin.tsx
+++ b/src/plugins/dashboard/public/plugin.tsx
@@ -229,7 +229,7 @@ export class DashboardPlugin
 
     const app: App = {
       id: DASHBOARD_APP_ID,
-      title: 'Dashboard',
+      title: 'Dashboards',
       order: 2500,
       euiIconType: 'logoKibana',
       defaultPath: `#${LANDING_PAGE_PATH}`,
diff --git a/src/plugins/dashboard/server/index.ts b/src/plugins/dashboard/server/index.ts
index 8dbc074fefa59f..a1ac1e5d0fd9cd 100644
--- a/src/plugins/dashboard/server/index.ts
+++ b/src/plugins/dashboard/server/index.ts
@@ -7,7 +7,6 @@
  */
 
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { DashboardPlugin } from './plugin';
 import { configSchema, ConfigSchema } from '../config';
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
@@ -20,7 +19,8 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { DashboardPlugin } = await import('./plugin');
   return new DashboardPlugin(initializerContext);
 }
 
diff --git a/src/plugins/data/common/search/search_source/fetch/get_search_params.test.ts b/src/plugins/data/common/search/search_source/fetch/get_search_params.test.ts
index 1a517bf64d13bd..975ad8d4a48786 100644
--- a/src/plugins/data/common/search/search_source/fetch/get_search_params.test.ts
+++ b/src/plugins/data/common/search/search_source/fetch/get_search_params.test.ts
@@ -9,6 +9,7 @@
 import { UI_SETTINGS } from '../../../constants';
 import { GetConfigFn } from '../../../types';
 import { getSearchParams, getSearchParamsFromRequest } from './get_search_params';
+import { createStubDataView } from '@kbn/data-views-plugin/common/data_views/data_view.stub';
 
 function getConfigStub(config: any = {}): GetConfigFn {
   return (key) => config[key];
@@ -46,4 +47,50 @@ describe('getSearchParams', () => {
       query: 123,
     });
   });
+
+  test('sets expand_wildcards=all if data view has allowHidden=true', () => {
+    const getConfig = getConfigStub({
+      [UI_SETTINGS.COURIER_SET_REQUEST_PREFERENCE]: 'custom',
+      [UI_SETTINGS.COURIER_CUSTOM_REQUEST_PREFERENCE]: 'aaa',
+    });
+    const index = createStubDataView({
+      spec: {
+        allowHidden: true,
+      },
+    });
+    const searchParams = getSearchParamsFromRequest(
+      {
+        index,
+        body: {
+          query: 123,
+          track_total_hits: true,
+        },
+      },
+      { getConfig }
+    );
+    expect(searchParams).toHaveProperty('expand_wildcards', 'all');
+  });
+
+  test('does not set expand_wildcards if data view has allowHidden=false', () => {
+    const getConfig = getConfigStub({
+      [UI_SETTINGS.COURIER_SET_REQUEST_PREFERENCE]: 'custom',
+      [UI_SETTINGS.COURIER_CUSTOM_REQUEST_PREFERENCE]: 'aaa',
+    });
+    const index = createStubDataView({
+      spec: {
+        allowHidden: false,
+      },
+    });
+    const searchParams = getSearchParamsFromRequest(
+      {
+        index,
+        body: {
+          query: 123,
+          track_total_hits: true,
+        },
+      },
+      { getConfig }
+    );
+    expect(searchParams).not.toHaveProperty('expand_wildcards', 'all');
+  });
 });
diff --git a/src/plugins/data/common/search/search_source/fetch/get_search_params.ts b/src/plugins/data/common/search/search_source/fetch/get_search_params.ts
index 5f8ca973b3dfe3..db630c85177e3d 100644
--- a/src/plugins/data/common/search/search_source/fetch/get_search_params.ts
+++ b/src/plugins/data/common/search/search_source/fetch/get_search_params.ts
@@ -42,8 +42,8 @@ export function getSearchParamsFromRequest(
   return {
     index: searchRequest.index.title || searchRequest.index,
     body,
-    // @ts-expect-error `track_total_hits` not allowed at top level for `typesWithBodyKey`
     track_total_hits,
+    ...(searchRequest.index?.allowHidden && { expand_wildcards: 'all' }),
     ...searchParams,
   };
 }
diff --git a/src/plugins/data/common/search/strategies/es_search/types.ts b/src/plugins/data/common/search/strategies/es_search/types.ts
index 73bf7961fea9b8..f8c3b73d995a9f 100644
--- a/src/plugins/data/common/search/strategies/es_search/types.ts
+++ b/src/plugins/data/common/search/strategies/es_search/types.ts
@@ -15,7 +15,8 @@ export type ISearchRequestParams = {
   trackTotalHits?: boolean;
 } & estypes.SearchRequest;
 
-export interface IEsSearchRequest extends IKibanaSearchRequest<ISearchRequestParams> {
+export interface IEsSearchRequest<T extends ISearchRequestParams = ISearchRequestParams>
+  extends IKibanaSearchRequest<T> {
   indexType?: string;
 }
 
diff --git a/src/plugins/data/common/search/strategies/ese_search/types.ts b/src/plugins/data/common/search/strategies/ese_search/types.ts
index 69812cdeae07b4..c54d6f3216f36f 100644
--- a/src/plugins/data/common/search/strategies/ese_search/types.ts
+++ b/src/plugins/data/common/search/strategies/ese_search/types.ts
@@ -6,11 +6,11 @@
  * Side Public License, v 1.
  */
 
-import { ISearchOptions } from '../../types';
+import { SearchSourceSearchOptions } from '../../search_source/types';
 
 export const ENHANCED_ES_SEARCH_STRATEGY = 'ese';
 
-export interface IAsyncSearchOptions extends ISearchOptions {
+export interface IAsyncSearchOptions extends SearchSourceSearchOptions {
   /**
    * The number of milliseconds to wait between receiving a response and sending another request
    * If not provided, then a default 1 second interval with back-off up to 5 seconds interval is used
diff --git a/src/plugins/data/public/search/errors/es_error.test.tsx b/src/plugins/data/public/search/errors/es_error.test.tsx
index 1b7f57d24d4f96..7f82faf685aba0 100644
--- a/src/plugins/data/public/search/errors/es_error.test.tsx
+++ b/src/plugins/data/public/search/errors/es_error.test.tsx
@@ -21,7 +21,7 @@ describe('EsError', () => {
         },
       },
     } as IEsError;
-    const esError = new EsError(error);
+    const esError = new EsError(error, () => {});
 
     expect(typeof esError.attributes).toEqual('object');
     expect(esError.attributes).toEqual(error.attributes);
@@ -50,7 +50,7 @@ describe('EsError', () => {
         },
       },
     } as IEsError;
-    const esError = new EsError(error);
+    const esError = new EsError(error, () => {});
     expect(esError.message).toEqual(
       'EsError: The supplied interval [2q] could not be parsed as a calendar interval.'
     );
diff --git a/src/plugins/data/public/search/errors/es_error.tsx b/src/plugins/data/public/search/errors/es_error.tsx
index 34d074a4271874..f5b978b38bc1e8 100644
--- a/src/plugins/data/public/search/errors/es_error.tsx
+++ b/src/plugins/data/public/search/errors/es_error.tsx
@@ -7,7 +7,7 @@
  */
 
 import React from 'react';
-import { EuiCodeBlock, EuiSpacer } from '@elastic/eui';
+import { EuiButton, EuiCodeBlock, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ApplicationStart } from '@kbn/core/public';
 import { KbnError } from '@kbn/kibana-utils-plugin/common';
@@ -17,7 +17,7 @@ import { getRootCause } from './utils';
 export class EsError extends KbnError {
   readonly attributes: IEsError['attributes'];
 
-  constructor(protected readonly err: IEsError) {
+  constructor(protected readonly err: IEsError, private readonly openInInspector: () => void) {
     super(
       `EsError: ${
         getRootCause(err?.attributes?.error)?.reason ||
@@ -27,7 +27,7 @@ export class EsError extends KbnError {
     this.attributes = err.attributes;
   }
 
-  public getErrorMessage(application: ApplicationStart) {
+  public getErrorMessage() {
     if (!this.attributes?.error) {
       return null;
     }
@@ -45,4 +45,14 @@ export class EsError extends KbnError {
       </>
     );
   }
+
+  public getActions(application: ApplicationStart) {
+    return [
+      <EuiButton key="viewRequestDetails" color="primary" onClick={this.openInInspector} size="s">
+        {i18n.translate('data.esError.viewDetailsButtonLabel', {
+          defaultMessage: 'View details',
+        })}
+      </EuiButton>,
+    ];
+  }
 }
diff --git a/src/plugins/data/public/search/errors/painless_error.test.tsx b/src/plugins/data/public/search/errors/painless_error.test.tsx
index 4bf79a6f5b5d93..03d4180b2aaac5 100644
--- a/src/plugins/data/public/search/errors/painless_error.test.tsx
+++ b/src/plugins/data/public/search/errors/painless_error.test.tsx
@@ -20,14 +20,17 @@ describe('PainlessError', () => {
   });
 
   it('Should show reason and code', () => {
-    const e = new PainlessError({
-      statusCode: 400,
-      message: 'search_phase_execution_exception',
-      attributes: {
-        error: searchPhaseException.error,
+    const e = new PainlessError(
+      {
+        statusCode: 400,
+        message: 'search_phase_execution_exception',
+        attributes: {
+          error: searchPhaseException.error,
+        },
       },
-    });
-    const component = mount(e.getErrorMessage(startMock.application));
+      () => {}
+    );
+    const component = mount(e.getErrorMessage());
 
     const failedShards = searchPhaseException.error.failed_shards![0];
 
@@ -41,6 +44,7 @@ describe('PainlessError', () => {
     ).getDOMNode();
     expect(humanReadableError.textContent).toBe(failedShards?.reason.caused_by?.reason);
 
-    expect(component.find('EuiButton').length).toBe(1);
+    const actions = e.getActions(startMock.application);
+    expect(actions.length).toBe(2);
   });
 });
diff --git a/src/plugins/data/public/search/errors/painless_error.tsx b/src/plugins/data/public/search/errors/painless_error.tsx
index 0435256f595cfa..e76adddfb08151 100644
--- a/src/plugins/data/public/search/errors/painless_error.tsx
+++ b/src/plugins/data/public/search/errors/painless_error.tsx
@@ -8,8 +8,7 @@
 
 import React from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiButton, EuiSpacer, EuiText, EuiCodeBlock } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n-react';
+import { EuiButtonEmpty, EuiSpacer, EuiText, EuiCodeBlock } from '@elastic/eui';
 import { ApplicationStart } from '@kbn/core/public';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import { IEsError, isEsError } from './types';
@@ -19,18 +18,12 @@ import { getRootCause } from './utils';
 export class PainlessError extends EsError {
   painlessStack?: string;
   indexPattern?: DataView;
-  constructor(err: IEsError, indexPattern?: DataView) {
-    super(err);
+  constructor(err: IEsError, openInInspector: () => void, indexPattern?: DataView) {
+    super(err, openInInspector);
     this.indexPattern = indexPattern;
   }
 
-  public getErrorMessage(application: ApplicationStart) {
-    function onClick(indexPatternId?: string) {
-      application.navigateToApp('management', {
-        path: `/kibana/indexPatterns${indexPatternId ? `/patterns/${indexPatternId}` : ''}`,
-      });
-    }
-
+  public getErrorMessage() {
     const rootCause = getRootCause(this.err.attributes?.error);
     const scriptFromStackTrace = rootCause?.script_stack
       ? rootCause?.script_stack?.slice(-2).join('\n')
@@ -41,7 +34,6 @@ export class PainlessError extends EsError {
     // fallback, show ES stacktrace
     const painlessStack = rootCause?.script_stack ? rootCause?.script_stack.join('\n') : undefined;
 
-    const indexPatternId = this?.indexPattern?.id;
     return (
       <>
         <EuiText size="s" data-test-subj="painlessScript">
@@ -54,25 +46,40 @@ export class PainlessError extends EsError {
           })}
         </EuiText>
         <EuiSpacer size="s" />
-        <EuiSpacer size="s" />
         {scriptFromStackTrace || painlessStack ? (
           <EuiCodeBlock data-test-subj="painlessStackTrace" isCopyable={true} paddingSize="s">
             {hasScript ? scriptFromStackTrace : painlessStack}
           </EuiCodeBlock>
         ) : null}
         {humanReadableError ? (
-          <EuiText data-test-subj="painlessHumanReadableError">{humanReadableError}</EuiText>
+          <EuiText size="s" data-test-subj="painlessHumanReadableError">
+            {humanReadableError}
+          </EuiText>
         ) : null}
-        <EuiSpacer size="s" />
-        <EuiSpacer size="s" />
-        <EuiText textAlign="right">
-          <EuiButton color="danger" onClick={() => onClick(indexPatternId)} size="s">
-            <FormattedMessage id="data.painlessError.buttonTxt" defaultMessage="Edit script" />
-          </EuiButton>
-        </EuiText>
       </>
     );
   }
+
+  getActions(application: ApplicationStart) {
+    function onClick(indexPatternId?: string) {
+      application.navigateToApp('management', {
+        path: `/kibana/indexPatterns${indexPatternId ? `/patterns/${indexPatternId}` : ''}`,
+      });
+    }
+    const actions = super.getActions(application) ?? [];
+    actions.push(
+      <EuiButtonEmpty
+        key="editPainlessScript"
+        onClick={() => onClick(this?.indexPattern?.id)}
+        size="s"
+      >
+        {i18n.translate('data.painlessError.buttonTxt', {
+          defaultMessage: 'Edit script',
+        })}
+      </EuiButtonEmpty>
+    );
+    return actions;
+  }
 }
 
 export function isPainlessError(err: Error | IEsError) {
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
index 013afb428931dd..09db89ee74a0ef 100644
--- a/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
@@ -23,6 +23,8 @@ import { BehaviorSubject } from 'rxjs';
 import { dataPluginMock } from '../../mocks';
 import { UI_SETTINGS } from '../../../common';
 import type { IEsError } from '../errors';
+import type { SearchServiceStartDependencies } from '../search_service';
+import type { Start as InspectorStart } from '@kbn/inspector-plugin/public';
 
 jest.mock('./utils', () => {
   const originalModule = jest.requireActual('./utils');
@@ -117,13 +119,21 @@ describe('SearchInterceptor', () => {
     const bfetchMock = bfetchPluginMock.createSetupContract();
     bfetchMock.batchedFunction.mockReturnValue(fetchMock);
 
+    const inspectorServiceMock = {
+      open: () => {},
+    } as unknown as InspectorStart;
+
     bfetchSetup = bfetchPluginMock.createSetupContract();
     bfetchSetup.batchedFunction.mockReturnValue(fetchMock);
     searchInterceptor = new SearchInterceptor({
       bfetch: bfetchSetup,
       toasts: mockCoreSetup.notifications.toasts,
       startServices: new Promise((resolve) => {
-        resolve([mockCoreStart, {}, {}]);
+        resolve([
+          mockCoreStart,
+          { inspector: inspectorServiceMock } as unknown as SearchServiceStartDependencies,
+          {},
+        ]);
       }),
       uiSettings: mockCoreSetup.uiSettings,
       http: mockCoreSetup.http,
@@ -149,13 +159,16 @@ describe('SearchInterceptor', () => {
 
     test('Renders a PainlessError', async () => {
       searchInterceptor.showError(
-        new PainlessError({
-          statusCode: 400,
-          message: 'search_phase_execution_exception',
-          attributes: {
-            error: searchPhaseException.error,
+        new PainlessError(
+          {
+            statusCode: 400,
+            message: 'search_phase_execution_exception',
+            attributes: {
+              error: searchPhaseException.error,
+            },
           },
-        })
+          () => {}
+        )
       );
       expect(mockCoreSetup.notifications.toasts.addDanger).toBeCalledTimes(1);
       expect(mockCoreSetup.notifications.toasts.addError).not.toBeCalled();
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
index 5aebc455ad5b6a..68dca8f4d0304d 100644
--- a/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { v4 as uuidv4 } from 'uuid';
 import { memoize, once } from 'lodash';
 import {
   BehaviorSubject,
@@ -29,9 +30,12 @@ import {
   takeUntil,
   tap,
 } from 'rxjs/operators';
+import { estypes } from '@elastic/elasticsearch';
+import { i18n } from '@kbn/i18n';
 import { PublicMethodsOf } from '@kbn/utility-types';
 import type { HttpSetup, IHttpFetchError } from '@kbn/core-http-browser';
 import { BfetchRequestError } from '@kbn/bfetch-plugin/public';
+import { type Start as InspectorStart, RequestAdapter } from '@kbn/inspector-plugin/public';
 
 import {
   ApplicationStart,
@@ -73,13 +77,14 @@ import { SearchResponseCache } from './search_response_cache';
 import { createRequestHash, getSearchErrorOverrideDisplay } from './utils';
 import { SearchAbortController } from './search_abort_controller';
 import { SearchConfigSchema } from '../../../config';
+import type { SearchServiceStartDependencies } from '../search_service';
 
 export interface SearchInterceptorDeps {
   bfetch: BfetchPublicSetup;
   http: HttpSetup;
   executionContext: ExecutionContextSetup;
   uiSettings: IUiSettingsClient;
-  startServices: Promise<[CoreStart, any, unknown]>;
+  startServices: Promise<[CoreStart, object, unknown]>;
   toasts: ToastsSetup;
   usageCollector?: SearchUsageCollector;
   session: ISessionService;
@@ -114,6 +119,7 @@ export class SearchInterceptor {
     { request: IKibanaSearchRequest; options: ISearchOptionsSerializable },
     IKibanaSearchResponse
   >;
+  private inspector!: InspectorStart;
 
   /*
    * @internal
@@ -121,9 +127,10 @@ export class SearchInterceptor {
   constructor(private readonly deps: SearchInterceptorDeps) {
     this.deps.http.addLoadingCountSource(this.pendingCount$);
 
-    this.deps.startServices.then(([coreStart]) => {
+    this.deps.startServices.then(([coreStart, depsStart]) => {
       this.application = coreStart.application;
       this.docLinks = coreStart.docLinks;
+      this.inspector = (depsStart as SearchServiceStartDependencies).inspector;
     });
 
     this.batchedFetch = deps.bfetch.batchedFunction({
@@ -184,7 +191,8 @@ export class SearchInterceptor {
    */
   private handleSearchError(
     e: KibanaServerError | AbortError,
-    options?: ISearchOptions,
+    requestBody: estypes.SearchRequest,
+    options?: IAsyncSearchOptions,
     isTimeout?: boolean
   ): Error {
     if (isTimeout || e.message === 'Request timed out') {
@@ -203,7 +211,36 @@ export class SearchInterceptor {
     }
 
     if (isEsError(e)) {
-      return isPainlessError(e) ? new PainlessError(e, options?.indexPattern) : new EsError(e);
+      const openInInspector = () => {
+        const requestId = options?.inspector?.id ?? uuidv4();
+        const requestAdapter = options?.inspector?.adapter ?? new RequestAdapter();
+        if (!options?.inspector?.adapter) {
+          const requestResponder = requestAdapter.start(
+            i18n.translate('data.searchService.anonymousRequestTitle', {
+              defaultMessage: 'Request',
+            }),
+            {
+              id: requestId,
+            }
+          );
+          requestResponder.json(requestBody);
+          requestResponder.error({ json: e.attributes });
+        }
+        this.inspector.open(
+          {
+            requests: requestAdapter,
+          },
+          {
+            options: {
+              initialRequestId: requestId,
+              initialTabs: ['clusters', 'response'],
+            },
+          }
+        );
+      };
+      return isPainlessError(e)
+        ? new PainlessError(e, openInInspector, options?.indexPattern)
+        : new EsError(e, openInInspector);
     }
 
     return e instanceof Error ? e : new Error(e.message);
@@ -473,7 +510,12 @@ export class SearchInterceptor {
           takeUntil(aborted$),
           catchError((e) => {
             return throwError(
-              this.handleSearchError(e, searchOptions, searchAbortController.isTimeout())
+              this.handleSearchError(
+                e,
+                request?.params?.body ?? {},
+                searchOptions,
+                searchAbortController.isTimeout()
+              )
             );
           }),
           tap((response) => {
diff --git a/src/plugins/data/public/search/search_interceptor/utils.ts b/src/plugins/data/public/search/search_interceptor/utils.ts
index c36a5ded6a2e82..f31e816de52673 100644
--- a/src/plugins/data/public/search/search_interceptor/utils.ts
+++ b/src/plugins/data/public/search/search_interceptor/utils.ts
@@ -24,13 +24,14 @@ export function getSearchErrorOverrideDisplay({
 }: {
   error: Error;
   application: ApplicationStart;
-}): { title: string; body: ReactNode } | undefined {
+}): { title: string; body: ReactNode; actions?: ReactNode[] } | undefined {
   if (error instanceof EsError) {
     return {
       title: i18n.translate('data.search.esErrorTitle', {
         defaultMessage: 'Cannot retrieve search results',
       }),
-      body: error.getErrorMessage(application),
+      body: error.getErrorMessage(),
+      actions: error.getActions(application),
     };
   }
 
diff --git a/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.test.tsx b/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.test.tsx
index d40d2ea62595b7..3a97bdddbcf46f 100644
--- a/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.test.tsx
+++ b/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.test.tsx
@@ -80,7 +80,8 @@ test("shouldn't show indicator in case no active search session", async () => {
   expect(container).toMatchInlineSnapshot(`
     <div>
       <div
-        class="kbnRedirectCrossAppLinks"
+        css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+        data-test-subj="kbnRedirectAppLink"
       />
     </div>
   `);
@@ -109,7 +110,8 @@ test("shouldn't show indicator in case app hasn't opt-in", async () => {
   expect(container).toMatchInlineSnapshot(`
     <div>
       <div
-        class="kbnRedirectCrossAppLinks"
+        css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+        data-test-subj="kbnRedirectAppLink"
       />
     </div>
   `);
diff --git a/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx b/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx
index 9a23342d58c625..ccc51091716b5c 100644
--- a/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx
+++ b/src/plugins/data/public/search/session/session_indicator/connected_search_session_indicator/connected_search_session_indicator.tsx
@@ -11,7 +11,7 @@ import { debounce } from 'rxjs/operators';
 import { timer } from 'rxjs';
 import useObservable from 'react-use/lib/useObservable';
 import { i18n } from '@kbn/i18n';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { IStorageWrapper } from '@kbn/kibana-utils-plugin/public';
 import { ApplicationStart, IBasePath } from '@kbn/core/public';
 import { SearchSessionIndicator, SearchSessionIndicatorRef } from '../search_session_indicator';
@@ -150,7 +150,11 @@ export const createConnectedSearchSessionIndicator = ({
 
     if (!sessionService.isSessionStorageReady()) return null;
     return (
-      <RedirectAppLinks application={application}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
         <SearchSessionIndicator
           ref={searchSessionIndicatorRef}
           state={state}
diff --git a/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx b/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx
index cfedbd59b29e50..371ffac111e848 100644
--- a/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx
+++ b/src/plugins/data/public/search/session/sessions_mgmt/lib/get_columns.tsx
@@ -21,7 +21,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { CoreStart } from '@kbn/core/public';
 import { capitalize } from 'lodash';
 import React from 'react';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { SearchSessionStatus } from '../../../../../common';
 import { OnActionComplete, PopoverActionsMenu, TableText } from '../components';
 import { StatusIndicator } from '../components/status';
@@ -140,7 +140,11 @@ export const getColumns = (
           ) : null;
 
         return (
-          <RedirectAppLinks application={core.application}>
+          <RedirectAppLinks
+            coreStart={{
+              application: core.application,
+            }}
+          >
             {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
             <EuiLink
               href={href}
diff --git a/src/plugins/data/server/index.ts b/src/plugins/data/server/index.ts
index 10368bd74281f5..2f077e907dfca0 100644
--- a/src/plugins/data/server/index.ts
+++ b/src/plugins/data/server/index.ts
@@ -8,7 +8,7 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { ConfigSchema, configSchema } from '../config';
-import { DataServerPlugin, DataPluginSetup, DataPluginStart } from './plugin';
+import type { DataServerPlugin, DataPluginSetup, DataPluginStart } from './plugin';
 
 export { getEsQueryConfig, DEFAULT_QUERY_LANGUAGE } from '../common';
 
@@ -101,12 +101,13 @@ export { getTime, parseInterval } from '../common';
  * @public
  */
 
-export function plugin(initializerContext: PluginInitializerContext<ConfigSchema>) {
+export async function plugin(initializerContext: PluginInitializerContext<ConfigSchema>) {
+  const { DataServerPlugin } = await import('./plugin');
   return new DataServerPlugin(initializerContext);
 }
 
 export type { DataPluginSetup as PluginSetup, DataPluginStart as PluginStart };
-export { DataServerPlugin as Plugin };
+export type { DataServerPlugin as Plugin };
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   deprecations: configDeprecationProvider,
diff --git a/src/plugins/data/server/search/routes/bsearch.ts b/src/plugins/data/server/search/routes/bsearch.ts
index 8b65c5d8eb1dc3..ee19c8cba30a37 100644
--- a/src/plugins/data/server/search/routes/bsearch.ts
+++ b/src/plugins/data/server/search/routes/bsearch.ts
@@ -11,6 +11,7 @@ import { catchError } from 'rxjs/operators';
 import { BfetchServerSetup } from '@kbn/bfetch-plugin/server';
 import type { ExecutionContextSetup } from '@kbn/core/server';
 import apm from 'elastic-apm-node';
+import { getRequestAbortedSignal } from '../..';
 import {
   IKibanaSearchRequest,
   IKibanaSearchResponse,
@@ -28,6 +29,7 @@ export function registerBsearchRoute(
     IKibanaSearchResponse
   >('/internal/bsearch', (request) => {
     const search = getScoped(request);
+    const abortSignal = getRequestAbortedSignal(request.events.aborted$);
     return {
       /**
        * @param requestOptions
@@ -39,7 +41,7 @@ export function registerBsearchRoute(
           apm.addLabels(executionContextService.getAsLabels());
 
           return firstValueFrom(
-            search.search(requestData, restOptions).pipe(
+            search.search(requestData, { ...restOptions, abortSignal }).pipe(
               catchError((err) => {
                 // Re-throw as object, to get attributes passed to the client
                 // eslint-disable-next-line no-throw-literal
diff --git a/src/plugins/data/server/search/search_service.ts b/src/plugins/data/server/search/search_service.ts
index 71a335ce515926..188f853e6a2ce2 100644
--- a/src/plugins/data/server/search/search_service.ts
+++ b/src/plugins/data/server/search/search_service.ts
@@ -437,11 +437,7 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
     }
   };
 
-  private cancel = async (
-    deps: SearchStrategyDependencies,
-    id: string,
-    options: ISearchOptions = {}
-  ) => {
+  private cancel = (deps: SearchStrategyDependencies, id: string, options: ISearchOptions = {}) => {
     const strategy = this.getSearchStrategy(options.strategy);
     if (!strategy.cancel) {
       throw new KbnServerError(
@@ -468,14 +464,18 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   private cancelSessionSearches = async (deps: SearchStrategyDependencies, sessionId: string) => {
     const searchIdMapping = await deps.searchSessionsClient.getSearchIdMapping(sessionId);
     await Promise.allSettled(
-      Array.from(searchIdMapping).map(([searchId, strategyName]) => {
+      Array.from(searchIdMapping).map(async ([searchId, strategyName]) => {
         const searchOptions = {
           sessionId,
           strategy: strategyName,
           isStored: true,
         };
 
-        return this.cancel(deps, searchId, searchOptions);
+        try {
+          await this.cancel(deps, searchId, searchOptions);
+        } catch (e) {
+          this.logger.error(`cancelSessionSearches error: ${e.message}`);
+        }
       })
     );
   };
diff --git a/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.test.ts b/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.test.ts
index 6d61f62cc79abb..475c43a5daed68 100644
--- a/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.test.ts
+++ b/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.test.ts
@@ -15,6 +15,7 @@ import { getMockSearchConfig } from '../../../../config.mock';
 
 const getMockEqlResponse = () => ({
   body: {
+    id: 'my-search-id',
     is_partial: false,
     is_running: false,
     took: 162,
@@ -54,6 +55,7 @@ describe('EQL search strategy', () => {
   describe('search()', () => {
     let mockEqlSearch: jest.Mock;
     let mockEqlGet: jest.Mock;
+    let mockEqlDelete: jest.Mock;
     let mockDeps: SearchStrategyDependencies;
     let params: Required<EqlSearchStrategyRequest>['params'];
     let options: Required<EqlSearchStrategyRequest>['options'];
@@ -61,6 +63,8 @@ describe('EQL search strategy', () => {
     beforeEach(() => {
       mockEqlSearch = jest.fn().mockResolvedValueOnce(getMockEqlResponse());
       mockEqlGet = jest.fn().mockResolvedValueOnce(getMockEqlResponse());
+      mockEqlDelete = jest.fn();
+
       mockDeps = {
         uiSettingsClient: {
           get: jest.fn(),
@@ -70,6 +74,7 @@ describe('EQL search strategy', () => {
             eql: {
               get: mockEqlGet,
               search: mockEqlSearch,
+              delete: mockEqlDelete,
             },
           },
         },
@@ -124,6 +129,34 @@ describe('EQL search strategy', () => {
       });
     });
 
+    it('should delete when aborted', async () => {
+      const response = getMockEqlResponse();
+      mockEqlSearch.mockReset().mockResolvedValueOnce({
+        ...response,
+        body: {
+          ...response.body,
+          is_running: true,
+        },
+      });
+      const eqlSearch = await eqlSearchStrategyProvider(mockSearchConfig, mockLogger);
+      const abortController = new AbortController();
+      const abortSignal = abortController.signal;
+
+      // Abort after an incomplete first response is returned
+      setTimeout(() => abortController.abort(), 100);
+
+      let err: any;
+      try {
+        await eqlSearch.search({ options, params }, { abortSignal }, mockDeps).toPromise();
+      } catch (e) {
+        err = e;
+      }
+
+      expect(mockEqlSearch).toBeCalled();
+      expect(err).not.toBeUndefined();
+      expect(mockEqlDelete).toBeCalled();
+    });
+
     describe('arguments', () => {
       it('sends along async search options', async () => {
         const eqlSearch = await eqlSearchStrategyProvider(mockSearchConfig, mockLogger);
diff --git a/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.ts b/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.ts
index 9dd24e67917196..00b8cfdeb52e5c 100644
--- a/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.ts
+++ b/src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.ts
@@ -9,6 +9,7 @@
 import type { TransportResult } from '@elastic/elasticsearch';
 import { tap } from 'rxjs/operators';
 import type { IScopedClusterClient, Logger } from '@kbn/core/server';
+import { getKbnServerError } from '@kbn/kibana-utils-plugin/server';
 import { SearchConfigSchema } from '../../../../config';
 import {
   EqlSearchStrategyRequest,
@@ -27,15 +28,19 @@ export const eqlSearchStrategyProvider = (
   searchConfig: SearchConfigSchema,
   logger: Logger
 ): ISearchStrategy<EqlSearchStrategyRequest, EqlSearchStrategyResponse> => {
-  async function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
+  function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
     const client = esClient.asCurrentUser.eql;
-    await client.delete({ id });
+    return client.delete({ id });
   }
 
   return {
     cancel: async (id, options, { esClient }) => {
       logger.debug(`_eql/delete ${id}`);
-      await cancelAsyncSearch(id, esClient);
+      try {
+        await cancelAsyncSearch(id, esClient);
+      } catch (e) {
+        throw getKbnServerError(e);
+      }
     },
 
     search: ({ id, ...request }, options: IAsyncSearchOptions, { esClient, uiSettingsClient }) => {
@@ -85,8 +90,15 @@ export const eqlSearchStrategyProvider = (
       };
 
       const cancel = async () => {
-        if (id) {
+        if (!id) return;
+        try {
           await cancelAsyncSearch(id, esClient);
+        } catch (e) {
+          // A 404 means either this search request does not exist, or that it is already cancelled
+          if (e.meta?.statusCode === 404) return;
+
+          // Log all other (unexpected) error messages
+          logger.error(`cancelEqlSearch error: ${e.message}`);
         }
       };
 
diff --git a/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.test.ts b/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.test.ts
index 3b2c5e8e0e5c8b..33987c09d88ddf 100644
--- a/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.test.ts
+++ b/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.test.ts
@@ -136,6 +136,30 @@ describe('ES search strategy', () => {
         expect(request).toHaveProperty('keep_alive', '60000ms');
       });
 
+      it('allows overriding keep_alive and wait_for_completion_timeout', async () => {
+        mockGetCaller.mockResolvedValueOnce(mockAsyncResponse);
+
+        const params = {
+          index: 'logstash-*',
+          body: { query: {} },
+          wait_for_completion_timeout: '10s',
+          keep_alive: '5m',
+        };
+        const esSearch = await enhancedEsSearchStrategyProvider(
+          mockLegacyConfig$,
+          mockSearchConfig,
+          mockLogger
+        );
+
+        await esSearch.search({ id: 'foo', params }, {}, mockDeps).toPromise();
+
+        expect(mockGetCaller).toBeCalled();
+        const request = mockGetCaller.mock.calls[0][0];
+        expect(request.id).toEqual('foo');
+        expect(request).toHaveProperty('wait_for_completion_timeout', '10s');
+        expect(request).toHaveProperty('keep_alive', '5m');
+      });
+
       it('sets transport options on POST requests', async () => {
         const transportOptions = { maxRetries: 1 };
         mockSubmitCaller.mockResolvedValueOnce(mockAsyncResponse);
@@ -260,6 +284,38 @@ describe('ES search strategy', () => {
 
         expect(mockApiCaller).toBeCalledTimes(0);
       });
+
+      it('should delete when aborted', async () => {
+        mockSubmitCaller.mockResolvedValueOnce({
+          ...mockAsyncResponse,
+          body: {
+            ...mockAsyncResponse.body,
+            is_running: true,
+          },
+        });
+
+        const params = { index: 'logstash-*', body: { query: {} } };
+        const esSearch = await enhancedEsSearchStrategyProvider(
+          mockLegacyConfig$,
+          mockSearchConfig,
+          mockLogger
+        );
+        const abortController = new AbortController();
+        const abortSignal = abortController.signal;
+
+        // Abort after an incomplete first response is returned
+        setTimeout(() => abortController.abort(), 100);
+
+        let err: KbnServerError | undefined;
+        try {
+          await esSearch.search({ params }, { abortSignal }, mockDeps).toPromise();
+        } catch (e) {
+          err = e;
+        }
+        expect(mockSubmitCaller).toBeCalled();
+        expect(err).not.toBeUndefined();
+        expect(mockDeleteCaller).toBeCalled();
+      });
     });
 
     describe('with sessionId', () => {
@@ -367,6 +423,44 @@ describe('ES search strategy', () => {
         expect(request).toHaveProperty('wait_for_completion_timeout');
         expect(request).not.toHaveProperty('keep_alive');
       });
+
+      it('should not delete a saved session when aborted', async () => {
+        mockSubmitCaller.mockResolvedValueOnce({
+          ...mockAsyncResponse,
+          body: {
+            ...mockAsyncResponse.body,
+            is_running: true,
+          },
+        });
+
+        const params = { index: 'logstash-*', body: { query: {} } };
+        const esSearch = await enhancedEsSearchStrategyProvider(
+          mockLegacyConfig$,
+          mockSearchConfig,
+          mockLogger
+        );
+        const abortController = new AbortController();
+        const abortSignal = abortController.signal;
+
+        // Abort after an incomplete first response is returned
+        setTimeout(() => abortController.abort(), 100);
+
+        let err: KbnServerError | undefined;
+        try {
+          await esSearch
+            .search(
+              { params },
+              { abortSignal, sessionId: '1', isSearchStored: true, isStored: true },
+              mockDeps
+            )
+            .toPromise();
+        } catch (e) {
+          err = e;
+        }
+        expect(mockSubmitCaller).toBeCalled();
+        expect(err).not.toBeUndefined();
+        expect(mockDeleteCaller).not.toBeCalled();
+      });
     });
 
     it('throws normalized error if ResponseError is thrown', async () => {
diff --git a/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.ts b/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.ts
index 89699d7d58611f..174f9924f1cc7b 100644
--- a/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.ts
+++ b/src/plugins/data/server/search/strategies/ese_search/ese_search_strategy.ts
@@ -12,6 +12,7 @@ import { catchError, tap } from 'rxjs/operators';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { firstValueFrom, from } from 'rxjs';
 import { getKbnServerError } from '@kbn/kibana-utils-plugin/server';
+import { IAsyncSearchRequestParams } from '../..';
 import { getKbnSearchError, KbnSearchError } from '../../report_search_error';
 import type { ISearchStrategy, SearchStrategyDependencies } from '../../types';
 import type {
@@ -43,18 +44,14 @@ export const enhancedEsSearchStrategyProvider = (
   logger: Logger,
   usage?: SearchUsage,
   useInternalUser: boolean = false
-): ISearchStrategy => {
-  async function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
-    try {
-      const client = useInternalUser ? esClient.asInternalUser : esClient.asCurrentUser;
-      await client.asyncSearch.delete({ id });
-    } catch (e) {
-      throw getKbnServerError(e);
-    }
+): ISearchStrategy<IEsSearchRequest<IAsyncSearchRequestParams>> => {
+  function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
+    const client = useInternalUser ? esClient.asInternalUser : esClient.asCurrentUser;
+    return client.asyncSearch.delete({ id });
   }
 
   function asyncSearch(
-    { id, ...request }: IEsSearchRequest,
+    { id, ...request }: IEsSearchRequest<IAsyncSearchRequestParams>,
     options: IAsyncSearchOptions,
     { esClient, uiSettingsClient }: SearchStrategyDependencies
   ) {
@@ -62,7 +59,13 @@ export const enhancedEsSearchStrategyProvider = (
 
     const search = async () => {
       const params = id
-        ? getDefaultAsyncGetParams(searchConfig, options)
+        ? {
+            ...getDefaultAsyncGetParams(searchConfig, options),
+            ...(request.params?.keep_alive ? { keep_alive: request.params.keep_alive } : {}),
+            ...(request.params?.wait_for_completion_timeout
+              ? { wait_for_completion_timeout: request.params.wait_for_completion_timeout }
+              : {}),
+          }
         : {
             ...(await getDefaultAsyncSubmitParams(uiSettingsClient, searchConfig, options)),
             ...request.params,
@@ -89,8 +92,15 @@ export const enhancedEsSearchStrategyProvider = (
     };
 
     const cancel = async () => {
-      if (id) {
+      if (!id || options.isStored) return;
+      try {
         await cancelAsyncSearch(id, esClient);
+      } catch (e) {
+        // A 404 means either this search request does not exist, or that it is already cancelled
+        if (e.meta?.statusCode === 404) return;
+
+        // Log all other (unexpected) error messages
+        logger.error(`cancelAsyncSearch error: ${e.message}`);
       }
     };
 
@@ -179,7 +189,11 @@ export const enhancedEsSearchStrategyProvider = (
      */
     cancel: async (id, options, { esClient }) => {
       logger.debug(`cancel ${id}`);
-      await cancelAsyncSearch(id, esClient);
+      try {
+        await cancelAsyncSearch(id, esClient);
+      } catch (e) {
+        throw getKbnServerError(e);
+      }
     },
     /**
      *
diff --git a/src/plugins/data/server/search/strategies/ese_search/types.ts b/src/plugins/data/server/search/strategies/ese_search/types.ts
index 4116aa43803397..5ff324e1c2e4f0 100644
--- a/src/plugins/data/server/search/strategies/ese_search/types.ts
+++ b/src/plugins/data/server/search/strategies/ese_search/types.ts
@@ -6,11 +6,21 @@
  * Side Public License, v 1.
  */
 
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type {
+  AsyncSearchGetRequest,
+  SearchResponse,
+  ShardStatistics,
+} from '@elastic/elasticsearch/lib/api/types';
+import { ISearchRequestParams } from '../../../../common';
+
+export interface IAsyncSearchRequestParams extends ISearchRequestParams {
+  keep_alive?: AsyncSearchGetRequest['keep_alive'];
+  wait_for_completion_timeout?: AsyncSearchGetRequest['wait_for_completion_timeout'];
+}
 
 export interface AsyncSearchResponse<T = unknown> {
   id?: string;
-  response: estypes.SearchResponse<T>;
+  response: SearchResponse<T>;
   start_time_in_millis: number;
   expiration_time_in_millis: number;
   is_partial: boolean;
@@ -18,5 +28,5 @@ export interface AsyncSearchResponse<T = unknown> {
 }
 export interface AsyncSearchStatusResponse extends Omit<AsyncSearchResponse, 'response'> {
   completion_status: number;
-  _shards: estypes.ShardStatistics;
+  _shards: ShardStatistics;
 }
diff --git a/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.test.ts b/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.test.ts
index 700c658de10c04..36fb43a34894ff 100644
--- a/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.test.ts
+++ b/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.test.ts
@@ -124,6 +124,33 @@ describe('SQL search strategy', () => {
           signal: undefined,
         });
       });
+
+      it('should delete when aborted', async () => {
+        mockSqlQuery.mockResolvedValueOnce({
+          ...mockSqlResponse,
+          body: {
+            ...mockSqlResponse.body,
+            is_running: true,
+          },
+        });
+        const esSearch = await sqlSearchStrategyProvider(mockSearchConfig, mockLogger);
+        const abortController = new AbortController();
+        const abortSignal = abortController.signal;
+
+        // Abort after an incomplete first response is returned
+        setTimeout(() => abortController.abort(), 100);
+
+        let err: any;
+        try {
+          await esSearch.search({ params: {} }, { abortSignal }, mockDeps).toPromise();
+        } catch (e) {
+          err = e;
+        }
+
+        expect(mockSqlQuery).toBeCalled();
+        expect(err).not.toBeUndefined();
+        expect(mockSqlDelete).toBeCalled();
+      });
     });
 
     // skip until full search session support https://github.com/elastic/kibana/issues/127880
diff --git a/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.ts b/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.ts
index 87b29f5438efb1..9e04675d12247f 100644
--- a/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.ts
+++ b/src/plugins/data/server/search/strategies/sql_search/sql_search_strategy.ts
@@ -29,13 +29,9 @@ export const sqlSearchStrategyProvider = (
   logger: Logger,
   useInternalUser: boolean = false
 ): ISearchStrategy<SqlSearchStrategyRequest, SqlSearchStrategyResponse> => {
-  async function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
-    try {
-      const client = useInternalUser ? esClient.asInternalUser : esClient.asCurrentUser;
-      await client.sql.deleteAsync({ id });
-    } catch (e) {
-      throw getKbnServerError(e);
-    }
+  function cancelAsyncSearch(id: string, esClient: IScopedClusterClient) {
+    const client = useInternalUser ? esClient.asInternalUser : esClient.asCurrentUser;
+    return client.sql.deleteAsync({ id });
   }
 
   function asyncSearch(
@@ -92,8 +88,15 @@ export const sqlSearchStrategyProvider = (
     };
 
     const cancel = async () => {
-      if (id) {
+      if (!id) return;
+      try {
         await cancelAsyncSearch(id, esClient);
+      } catch (e) {
+        // A 404 means either this search request does not exist, or that it is already cancelled
+        if (e.meta?.statusCode === 404) return;
+
+        // Log all other (unexpected) error messages
+        logger.error(`cancelSqlSearch error: ${e.message}`);
       }
     };
 
@@ -130,7 +133,11 @@ export const sqlSearchStrategyProvider = (
      */
     cancel: async (id, options, { esClient }) => {
       logger.debug(`sql search: cancel async_search_id=${id}`);
-      await cancelAsyncSearch(id, esClient);
+      try {
+        await cancelAsyncSearch(id, esClient);
+      } catch (e) {
+        throw getKbnServerError(e);
+      }
     },
     /**
      *
diff --git a/src/plugins/data/tsconfig.json b/src/plugins/data/tsconfig.json
index 41b1d1d755ad70..7619be78a82dcf 100644
--- a/src/plugins/data/tsconfig.json
+++ b/src/plugins/data/tsconfig.json
@@ -48,7 +48,8 @@
     "@kbn/core-saved-objects-utils-server",
     "@kbn/data-service",
     "@kbn/react-kibana-context-render",
-    "@kbn/search-response-warnings"
+    "@kbn/search-response-warnings",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_content.tsx b/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_content.tsx
index dcb8e2c1e1d80c..db3746d02dc664 100644
--- a/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_content.tsx
+++ b/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_content.tsx
@@ -30,14 +30,16 @@ interface AdvancedParamsContentProps {
   disableAllowHidden: boolean;
   disableId: boolean;
   onAllowHiddenChange?: (value: boolean) => void;
+  defaultVisible?: boolean;
 }
 
 export const AdvancedParamsContent = ({
   disableAllowHidden,
   disableId,
   onAllowHiddenChange,
+  defaultVisible = false,
 }: AdvancedParamsContentProps) => (
-  <AdvancedParamsSection>
+  <AdvancedParamsSection defaultVisible={defaultVisible}>
     <EuiFlexGroup>
       <EuiFlexItem>
         <UseField<boolean, IndexPatternConfig>
diff --git a/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_section.tsx b/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_section.tsx
index b313fddb8ee2d8..ce52223413ecd6 100644
--- a/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_section.tsx
+++ b/src/plugins/data_view_editor/public/components/advanced_params_content/advanced_params_section.tsx
@@ -13,10 +13,11 @@ import { EuiButtonEmpty, EuiSpacer } from '@elastic/eui';
 
 interface Props {
   children: React.ReactNode;
+  defaultVisible: boolean;
 }
 
-export const AdvancedParamsSection = ({ children }: Props) => {
-  const [isVisible, setIsVisible] = useState<boolean>(false);
+export const AdvancedParamsSection = ({ children, defaultVisible = false }: Props) => {
+  const [isVisible, setIsVisible] = useState<boolean>(defaultVisible);
 
   const toggleIsVisible = useCallback(() => {
     setIsVisible(!isVisible);
diff --git a/src/plugins/data_view_editor/public/components/data_view_editor_flyout_content.tsx b/src/plugins/data_view_editor/public/components/data_view_editor_flyout_content.tsx
index ad344d482c0cf4..73432737f93211 100644
--- a/src/plugins/data_view_editor/public/components/data_view_editor_flyout_content.tsx
+++ b/src/plugins/data_view_editor/public/components/data_view_editor_flyout_content.tsx
@@ -105,6 +105,7 @@ const IndexPatternEditorFlyoutContentComponent = ({
             title: editData.getIndexPattern(),
             id: editData.id,
             name: editData.name,
+            allowHidden: editData.getAllowHidden(),
             ...(editData.timeFieldName
               ? {
                   timestampField: { label: editData.timeFieldName, value: editData.timeFieldName },
@@ -124,6 +125,7 @@ const IndexPatternEditorFlyoutContentComponent = ({
         timeFieldName: formData.timestampField?.value,
         id: formData.id,
         name: formData.name,
+        allowHidden: formData.allowHidden,
       };
 
       if (type === INDEX_PATTERN_TYPE.ROLLUP && rollupIndex) {
@@ -293,6 +295,7 @@ const IndexPatternEditorFlyoutContentComponent = ({
             onAllowHiddenChange={() => {
               form.getFields().title.validate();
             }}
+            defaultVisible={editData?.getAllowHidden()}
           />
         </Form>
         <Footer
diff --git a/src/plugins/data_view_editor/public/components/data_view_flyout_content_container.tsx b/src/plugins/data_view_editor/public/components/data_view_flyout_content_container.tsx
index a75367fbb4d8ac..fc7127c02ddeb2 100644
--- a/src/plugins/data_view_editor/public/components/data_view_flyout_content_container.tsx
+++ b/src/plugins/data_view_editor/public/components/data_view_flyout_content_container.tsx
@@ -50,10 +50,11 @@ const DataViewFlyoutContentContainer = ({
     try {
       let saveResponse;
       if (editData) {
-        const { name = '', timeFieldName, title = '' } = dataViewSpec;
+        const { name = '', timeFieldName, title = '', allowHidden = false } = dataViewSpec;
         editData.setIndexPattern(title);
         editData.name = name;
         editData.timeFieldName = timeFieldName;
+        editData.setAllowHidden(allowHidden);
         saveResponse = editData.isPersisted()
           ? await dataViews.updateSavedObject(editData)
           : editData;
diff --git a/src/plugins/data_view_editor/public/data_view_editor_service.ts b/src/plugins/data_view_editor/public/data_view_editor_service.ts
index c9b382447fd871..dcc50567c4b44e 100644
--- a/src/plugins/data_view_editor/public/data_view_editor_service.ts
+++ b/src/plugins/data_view_editor/public/data_view_editor_service.ts
@@ -342,6 +342,7 @@ export class DataViewEditorService {
 
     const getFieldsOptions: GetFieldsOptions = {
       pattern: this.indexPattern,
+      allowHidden: this.allowHidden,
     };
     if (this.type === INDEX_PATTERN_TYPE.ROLLUP) {
       getFieldsOptions.type = INDEX_PATTERN_TYPE.ROLLUP;
diff --git a/src/plugins/data_view_field_editor/server/index.ts b/src/plugins/data_view_field_editor/server/index.ts
index 38ae28ebe98928..67fdafcbb3f394 100644
--- a/src/plugins/data_view_field_editor/server/index.ts
+++ b/src/plugins/data_view_field_editor/server/index.ts
@@ -6,8 +6,8 @@
  * Side Public License, v 1.
  */
 import { PluginInitializerContext } from '@kbn/core/server';
-import { IndexPatternPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { IndexPatternPlugin } = await import('./plugin');
   return new IndexPatternPlugin(initializerContext);
 }
diff --git a/src/plugins/data_view_management/server/index.ts b/src/plugins/data_view_management/server/index.ts
index 77e1ddf010eaf8..7116606cab6fe0 100644
--- a/src/plugins/data_view_management/server/index.ts
+++ b/src/plugins/data_view_management/server/index.ts
@@ -7,8 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { IndexPatternManagementPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { IndexPatternManagementPlugin } = await import('./plugin');
   return new IndexPatternManagementPlugin(initializerContext);
 }
diff --git a/src/plugins/data_views/common/content_management/v1/cm_services.ts b/src/plugins/data_views/common/content_management/v1/cm_services.ts
index 87bcee356098d6..c850672353c971 100644
--- a/src/plugins/data_views/common/content_management/v1/cm_services.ts
+++ b/src/plugins/data_views/common/content_management/v1/cm_services.ts
@@ -46,6 +46,7 @@ const dataViewAttributesSchema = schema.object(
     allowNoIndex: schema.maybe(schema.boolean()),
     runtimeFieldMap: schema.maybe(schema.any()),
     name: schema.maybe(schema.string()),
+    allowHidden: schema.maybe(schema.boolean()),
   },
   { unknowns: 'forbid' }
 );
diff --git a/src/plugins/data_views/common/data_views/__snapshots__/data_view.test.ts.snap b/src/plugins/data_views/common/data_views/__snapshots__/data_view.test.ts.snap
index dcac963b3a7b90..3df45ed00e4505 100644
--- a/src/plugins/data_views/common/data_views/__snapshots__/data_view.test.ts.snap
+++ b/src/plugins/data_views/common/data_views/__snapshots__/data_view.test.ts.snap
@@ -28,6 +28,7 @@ Object {
 
 exports[`IndexPattern toMinimalSpec can exclude fields 1`] = `
 Object {
+  "allowHidden": false,
   "allowNoIndex": false,
   "fieldAttrs": undefined,
   "fieldFormats": Object {},
@@ -51,6 +52,7 @@ Object {
 
 exports[`IndexPattern toSpec can optionally exclude fields 1`] = `
 Object {
+  "allowHidden": false,
   "allowNoIndex": false,
   "fieldAttrs": Object {},
   "fieldFormats": Object {},
@@ -74,6 +76,7 @@ Object {
 
 exports[`IndexPattern toSpec should match snapshot 1`] = `
 Object {
+  "allowHidden": false,
   "allowNoIndex": false,
   "fieldAttrs": Object {
     "@timestamp": Object {
diff --git a/src/plugins/data_views/common/data_views/__snapshots__/data_views.test.ts.snap b/src/plugins/data_views/common/data_views/__snapshots__/data_views.test.ts.snap
index 0d646f4afc28d1..53b77e28a416c3 100644
--- a/src/plugins/data_views/common/data_views/__snapshots__/data_views.test.ts.snap
+++ b/src/plugins/data_views/common/data_views/__snapshots__/data_views.test.ts.snap
@@ -28,6 +28,7 @@ exports[`IndexPatterns delete will throw if insufficient access 1`] = `[DataView
 
 exports[`IndexPatterns savedObjectToSpec 1`] = `
 Object {
+  "allowHidden": undefined,
   "allowNoIndex": undefined,
   "fieldAttrs": Object {
     "aRuntimeField": Object {
diff --git a/src/plugins/data_views/common/data_views/abstract_data_views.ts b/src/plugins/data_views/common/data_views/abstract_data_views.ts
index 0be234a7d3e53a..15ec8342cfd5b9 100644
--- a/src/plugins/data_views/common/data_views/abstract_data_views.ts
+++ b/src/plugins/data_views/common/data_views/abstract_data_views.ts
@@ -126,6 +126,8 @@ export abstract class AbstractDataView {
 
   protected scriptedFields: DataViewFieldBase[];
 
+  private allowHidden: boolean = false;
+
   constructor(config: AbstractDataViewDeps) {
     const { spec = {}, fieldFormats, shortDotsEnable = false, metaFields = [] } = config;
 
@@ -178,8 +180,13 @@ export abstract class AbstractDataView {
     this.runtimeFieldMap = cloneDeep(spec.runtimeFieldMap) || {};
     this.namespaces = spec.namespaces || [];
     this.name = spec.name || '';
+    this.allowHidden = spec.allowHidden || false;
   }
 
+  getAllowHidden = () => this.allowHidden;
+
+  setAllowHidden = (allowHidden: boolean) => (this.allowHidden = allowHidden);
+
   /**
    * Get name of Data View
    */
@@ -325,6 +332,7 @@ export abstract class AbstractDataView {
       allowNoIndex: this.allowNoIndex ? this.allowNoIndex : undefined,
       runtimeFieldMap: stringifyOrUndefined(this.runtimeFieldMap),
       name: this.name,
+      allowHidden: this.allowHidden,
     };
   }
 
diff --git a/src/plugins/data_views/common/data_views/data_view.ts b/src/plugins/data_views/common/data_views/data_view.ts
index 27681021757ffc..f47d4c0fb21778 100644
--- a/src/plugins/data_views/common/data_views/data_view.ts
+++ b/src/plugins/data_views/common/data_views/data_view.ts
@@ -160,6 +160,7 @@ export class DataView extends AbstractDataView implements DataViewBase {
       fieldAttrs,
       allowNoIndex: this.allowNoIndex,
       name: this.name,
+      allowHidden: this.getAllowHidden(),
     };
 
     // Filter undefined values from the spec
diff --git a/src/plugins/data_views/common/data_views/data_views.ts b/src/plugins/data_views/common/data_views/data_views.ts
index 7ec161e689e76f..6052be19d4f994 100644
--- a/src/plugins/data_views/common/data_views/data_views.ts
+++ b/src/plugins/data_views/common/data_views/data_views.ts
@@ -531,6 +531,8 @@ export class DataViewsService {
       allowNoIndex: true,
       ...options,
       pattern: indexPattern.title as string,
+      allowHidden:
+        (indexPattern as DataViewSpec).allowHidden || (indexPattern as DataView)?.getAllowHidden(),
     });
 
   private getFieldsAndIndicesForDataView = async (dataView: DataView) => {
@@ -541,6 +543,7 @@ export class DataViewsService {
       allowNoIndex: true,
       pattern: dataView.getIndexPattern(),
       metaFields,
+      allowHidden: dataView.getAllowHidden(),
     });
   };
 
@@ -553,6 +556,7 @@ export class DataViewsService {
       rollupIndex: options.rollupIndex,
       allowNoIndex: true,
       indexFilter: options.indexFilter,
+      allowHidden: options.allowHidden,
     });
   };
 
@@ -704,6 +708,7 @@ export class DataViewsService {
         fieldAttrs,
         allowNoIndex,
         name,
+        allowHidden,
       },
     } = savedObject;
 
@@ -731,6 +736,7 @@ export class DataViewsService {
       allowNoIndex,
       runtimeFieldMap: parsedRuntimeFieldMap,
       name,
+      allowHidden,
     };
   };
 
@@ -763,6 +769,7 @@ export class DataViewsService {
         type,
         rollupIndex: typeMeta?.params?.rollup_index,
         allowNoIndex: spec.allowNoIndex,
+        allowHidden: spec.allowHidden,
       },
       spec.fieldAttrs,
       displayErrors
diff --git a/src/plugins/data_views/common/types.ts b/src/plugins/data_views/common/types.ts
index 79a2524a4d80c5..dc477d2fb5b838 100644
--- a/src/plugins/data_views/common/types.ts
+++ b/src/plugins/data_views/common/types.ts
@@ -157,6 +157,10 @@ export interface DataViewAttributes {
    * Name of the data view. Human readable name used to differentiate data view.
    */
   name?: string;
+  /**
+   * Allow hidden and system indices when loading field list
+   */
+  allowHidden?: boolean;
 }
 
 /**
@@ -309,6 +313,7 @@ export interface GetFieldsOptions {
   indexFilter?: QueryDslQueryContainer;
   includeUnmapped?: boolean;
   fields?: string[];
+  allowHidden?: boolean;
 }
 
 /**
@@ -517,6 +522,10 @@ export type DataViewSpec = {
    * Name of the data view. Human readable name used to differentiate data view.
    */
   name?: string;
+  /**
+   * Allow hidden and system indices when loading field list
+   */
+  allowHidden?: boolean;
 };
 
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
diff --git a/src/plugins/data_views/public/data_views/data_views_api_client.test.ts b/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
index 90a208650a965e..f36776153ee3a7 100644
--- a/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
+++ b/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import type { HttpSetup } from '@kbn/core/public';
 import { http } from './data_views_api_client.test.mock';
 import { DataViewsApiClient } from './data_views_api_client';
 import { FIELDS_FOR_WILDCARD_PATH as expectedPath } from '../../common/constants';
@@ -16,7 +17,7 @@ describe('IndexPatternsApiClient', () => {
 
   beforeEach(() => {
     fetchSpy = jest.spyOn(http, 'fetch').mockImplementation(() => Promise.resolve({}));
-    indexPatternsApiClient = new DataViewsApiClient(http);
+    indexPatternsApiClient = new DataViewsApiClient(http as HttpSetup);
   });
 
   test('uses the right URI to fetch fields for wildcard', async function () {
diff --git a/src/plugins/data_views/public/data_views/data_views_api_client.ts b/src/plugins/data_views/public/data_views/data_views_api_client.ts
index bb53c68eafaa7a..ca5782736e3cd1 100644
--- a/src/plugins/data_views/public/data_views/data_views_api_client.ts
+++ b/src/plugins/data_views/public/data_views/data_views_api_client.ts
@@ -60,6 +60,7 @@ export class DataViewsApiClient implements IDataViewsApiClient {
       indexFilter,
       includeUnmapped,
       fields,
+      allowHidden,
     } = options;
     return this._request<FieldsForWildcardResponse>(
       FIELDS_FOR_WILDCARD_PATH,
@@ -71,6 +72,7 @@ export class DataViewsApiClient implements IDataViewsApiClient {
         allow_no_index: allowNoIndex,
         include_unmapped: includeUnmapped,
         fields,
+        allow_hidden: allowHidden,
       },
       indexFilter ? JSON.stringify({ index_filter: indexFilter }) : undefined
     ).then((response) => {
diff --git a/src/plugins/data_views/server/content_management/data_views_storage.ts b/src/plugins/data_views/server/content_management/data_views_storage.ts
index 35a9151f3f69e4..bb01064d59956a 100644
--- a/src/plugins/data_views/server/content_management/data_views_storage.ts
+++ b/src/plugins/data_views/server/content_management/data_views_storage.ts
@@ -37,6 +37,7 @@ export class DataViewsStorage extends SOContentStorage<DataViewCrudTypes> {
         'runtimeFieldMap',
         'allowNoIndex',
         'name',
+        'allowHidden',
       ],
       mSearchAdditionalSearchFields: ['name'],
       logger,
diff --git a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
index 82f07bd7f489a1..aca312c8ea64dc 100644
--- a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
+++ b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
@@ -71,12 +71,23 @@ export class IndexPatternsFetcher {
     rollupIndex?: string;
     indexFilter?: QueryDslQueryContainer;
     fields?: string[];
+    allowHidden?: boolean;
   }): Promise<{ fields: FieldDescriptor[]; indices: string[] }> {
-    const { pattern, metaFields = [], fieldCapsOptions, type, rollupIndex, indexFilter } = options;
+    const {
+      pattern,
+      metaFields = [],
+      fieldCapsOptions,
+      type,
+      rollupIndex,
+      indexFilter,
+      allowHidden,
+    } = options;
     const allowNoIndices = fieldCapsOptions
       ? fieldCapsOptions.allow_no_indices
       : this.allowNoIndices;
 
+    const expandWildcards = allowHidden ? 'all' : 'open';
+
     const fieldCapsResponse = await getFieldCapabilities({
       callCluster: this.elasticsearchClient,
       indices: pattern,
@@ -87,6 +98,7 @@ export class IndexPatternsFetcher {
       },
       indexFilter,
       fields: options.fields || ['*'],
+      expandWildcards,
     });
 
     if (this.rollupsEnabled && type === 'rollup' && rollupIndex) {
diff --git a/src/plugins/data_views/server/fetcher/lib/es_api.ts b/src/plugins/data_views/server/fetcher/lib/es_api.ts
index 988e4a4ec28c8a..62ad89a87f50b3 100644
--- a/src/plugins/data_views/server/fetcher/lib/es_api.ts
+++ b/src/plugins/data_views/server/fetcher/lib/es_api.ts
@@ -7,6 +7,7 @@
  */
 
 import { ElasticsearchClient } from '@kbn/core/server';
+import { ExpandWildcard } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { QueryDslQueryContainer } from '../../../common/types';
 import { convertEsError } from './errors';
 
@@ -45,6 +46,7 @@ interface FieldCapsApiParams {
   fieldCapsOptions?: { allow_no_indices: boolean; include_unmapped?: boolean };
   indexFilter?: QueryDslQueryContainer;
   fields?: string[];
+  expandWildcards?: ExpandWildcard;
 }
 
 /**
@@ -69,6 +71,7 @@ export async function callFieldCapsApi(params: FieldCapsApiParams) {
       include_unmapped: false,
     },
     fields = ['*'],
+    expandWildcards,
   } = params;
   try {
     return await callCluster.fieldCaps(
@@ -77,6 +80,7 @@ export async function callFieldCapsApi(params: FieldCapsApiParams) {
         fields,
         ignore_unavailable: true,
         index_filter: indexFilter,
+        expand_wildcards: expandWildcards,
         ...fieldCapsOptions,
       },
       { meta: true }
diff --git a/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.test.js b/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.test.js
index 1b3be374bbd7c2..8ea934e9f703ec 100644
--- a/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.test.js
+++ b/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.test.js
@@ -34,6 +34,7 @@ describe('index_patterns/field_capabilities/field_capabilities', () => {
   const fillUndefinedParams = (args) => ({
     callCluster: undefined,
     indices: undefined,
+    expandWildcards: undefined,
     fieldCapsOptions: undefined,
     indexFilter: undefined,
     fields: undefined,
diff --git a/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.ts b/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.ts
index 73e550ebd68cee..fdf3f1afe7c448 100644
--- a/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.ts
+++ b/src/plugins/data_views/server/fetcher/lib/field_capabilities/field_capabilities.ts
@@ -8,6 +8,7 @@
 
 import { defaults, keyBy, sortBy } from 'lodash';
 
+import { ExpandWildcard } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ElasticsearchClient } from '@kbn/core/server';
 import { callFieldCapsApi } from '../es_api';
 import { readFieldCapsResponse } from './field_caps_response';
@@ -22,6 +23,7 @@ interface FieldCapabilitiesParams {
   fieldCapsOptions?: { allow_no_indices: boolean; include_unmapped?: boolean };
   indexFilter?: QueryDslQueryContainer;
   fields?: string[];
+  expandWildcards?: ExpandWildcard;
 }
 
 /**
@@ -42,6 +44,7 @@ export async function getFieldCapabilities(params: FieldCapabilitiesParams) {
     indexFilter,
     metaFields = [],
     fields,
+    expandWildcards,
   } = params;
   const esFieldCaps = await callFieldCapsApi({
     callCluster,
@@ -49,6 +52,7 @@ export async function getFieldCapabilities(params: FieldCapabilitiesParams) {
     fieldCapsOptions,
     indexFilter,
     fields,
+    expandWildcards,
   });
   const fieldCapsArr = readFieldCapsResponse(esFieldCaps.body);
   const fieldsFromFieldCapsByName = keyBy(fieldCapsArr, 'name');
diff --git a/src/plugins/data_views/server/index.ts b/src/plugins/data_views/server/index.ts
index a489feabbf9351..eba0a83a8df493 100644
--- a/src/plugins/data_views/server/index.ts
+++ b/src/plugins/data_views/server/index.ts
@@ -19,7 +19,7 @@ export type {
 } from './types';
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { DataViewsServerPlugin } from './plugin';
+import type { DataViewsServerPlugin } from './plugin';
 import { DataViewsServerPluginSetup, DataViewsServerPluginStart } from './types';
 export type { dataViewsServiceFactory } from './data_views_service_factory';
 
@@ -28,7 +28,8 @@ export type { dataViewsServiceFactory } from './data_views_service_factory';
  * @public
  */
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { DataViewsServerPlugin } = await import('./plugin');
   return new DataViewsServerPlugin(initializerContext);
 }
 
@@ -36,7 +37,7 @@ export type {
   DataViewsServerPluginSetup as PluginSetup,
   DataViewsServerPluginStart as PluginStart,
 };
-export { DataViewsServerPlugin as Plugin };
+export type { DataViewsServerPlugin as Plugin };
 
 const configSchema = schema.object({
   scriptedFieldsEnabled: schema.conditional(
diff --git a/src/plugins/data_views/server/rest_api_routes/internal/fields_for.ts b/src/plugins/data_views/server/rest_api_routes/internal/fields_for.ts
index 15d761935c0a73..7d39b41d5caee9 100644
--- a/src/plugins/data_views/server/rest_api_routes/internal/fields_for.ts
+++ b/src/plugins/data_views/server/rest_api_routes/internal/fields_for.ts
@@ -50,6 +50,7 @@ interface IQuery {
   allow_no_index?: boolean;
   include_unmapped?: boolean;
   fields?: string[];
+  allow_hidden?: boolean;
 }
 
 const querySchema = schema.object({
@@ -62,6 +63,7 @@ const querySchema = schema.object({
   allow_no_index: schema.maybe(schema.boolean()),
   include_unmapped: schema.maybe(schema.boolean()),
   fields: schema.maybe(schema.oneOf([schema.string(), schema.arrayOf(schema.string())])),
+  allow_hidden: schema.maybe(schema.boolean()),
 });
 
 const fieldSubTypeSchema = schema.object({
@@ -122,6 +124,7 @@ const handler: (isRollupsEnabled: () => boolean) => RequestHandler<{}, IQuery, I
       rollup_index: rollupIndex,
       allow_no_index: allowNoIndex,
       include_unmapped: includeUnmapped,
+      allow_hidden: allowHidden,
     } = request.query;
 
     // not available to get request
@@ -147,6 +150,7 @@ const handler: (isRollupsEnabled: () => boolean) => RequestHandler<{}, IQuery, I
           includeUnmapped,
         },
         indexFilter,
+        allowHidden,
         ...(parsedFields.length > 0 ? { fields: parsedFields } : {}),
       });
 
diff --git a/src/plugins/data_views/server/rest_api_routes/route_types.ts b/src/plugins/data_views/server/rest_api_routes/route_types.ts
index 106817973e8a25..f7786c31faaa67 100644
--- a/src/plugins/data_views/server/rest_api_routes/route_types.ts
+++ b/src/plugins/data_views/server/rest_api_routes/route_types.ts
@@ -121,6 +121,7 @@ export type DataViewSpecRestResponse = {
   allowNoIndex?: boolean;
   namespaces?: string[];
   name?: string;
+  allowHidden?: boolean;
 };
 
 export interface DataViewListItemRestResponse {
diff --git a/src/plugins/data_views/server/rest_api_routes/schema.ts b/src/plugins/data_views/server/rest_api_routes/schema.ts
index 6db8c5138a52b4..d39d6dbb10b54e 100644
--- a/src/plugins/data_views/server/rest_api_routes/schema.ts
+++ b/src/plugins/data_views/server/rest_api_routes/schema.ts
@@ -46,6 +46,7 @@ export const dataViewSpecSchema = schema.object({
   runtimeFieldMap: schema.maybe(schema.recordOf(schema.string(), runtimeFieldSchema)),
   name: schema.maybe(schema.string()),
   namespaces: schema.maybe(schema.arrayOf(schema.string())),
+  allowHidden: schema.maybe(schema.boolean()),
 });
 
 export const dataViewsRuntimeResponseSchema = schema.object({
diff --git a/src/plugins/dev_tools/server/index.ts b/src/plugins/dev_tools/server/index.ts
index ca7d3a5b0eb320..0b572bdacf98ce 100644
--- a/src/plugins/dev_tools/server/index.ts
+++ b/src/plugins/dev_tools/server/index.ts
@@ -7,9 +7,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { DevToolsServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new DevToolsServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { DevToolsServerPlugin } = await import('./plugin');
+  return new DevToolsServerPlugin(initContext);
+};
diff --git a/src/plugins/discover/public/__mocks__/data_view_complex.ts b/src/plugins/discover/public/__mocks__/data_view_complex.ts
index 03161a0df4e3fd..05051f48b155c5 100644
--- a/src/plugins/discover/public/__mocks__/data_view_complex.ts
+++ b/src/plugins/discover/public/__mocks__/data_view_complex.ts
@@ -426,3 +426,18 @@ export const dataViewAdHoc = {
   }),
   isPersisted: () => false,
 } as DataView;
+
+export const dataViewWithDefaultColumnMock = buildDataViewMock({
+  name: 'data-view-with-user-default-column',
+  fields: [
+    ...fields,
+    {
+      name: 'default_column',
+      type: 'date',
+      scripted: false,
+      searchable: true,
+      aggregatable: true,
+    },
+  ] as DataView['fields'],
+  timeFieldName: '@timestamp',
+});
diff --git a/src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts b/src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts
index d681365767ce89..5a5c2bb0396835 100644
--- a/src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts
+++ b/src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts
@@ -86,7 +86,6 @@ const getCommonProps = () => {
     inspectorAdapters: { requests: new RequestAdapter() },
     onChangeDataView: action('change the data view'),
     onUpdateQuery: action('update the query'),
-    resetSavedSearch: action('reset the saved search the query'),
     savedSearch: savedSearchMock,
     savedSearchRefetch$: new Subject(),
     searchSource: searchSourceMock,
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
index 832a37577fc89f..9802b25d8fc92e 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.test.tsx
@@ -29,7 +29,6 @@ import { Storage } from '@kbn/kibana-utils-plugin/public';
 import { createSearchSessionMock } from '../../../../__mocks__/search_session';
 import { searchSourceInstanceMock } from '@kbn/data-plugin/common/search/search_source/mocks';
 import { getSessionServiceMock } from '@kbn/data-plugin/public/search/session/mocks';
-import { ResetSearchButton } from './reset_search_button';
 import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock';
 import { DiscoverMainProvider } from '../../services/discover_state_provider';
 import { act } from 'react-dom/test-utils';
@@ -162,25 +161,4 @@ describe('Discover histogram layout component', () => {
       expect(component.isEmptyRender()).toBe(false);
     });
   });
-
-  describe('reset search button', () => {
-    it('renders the button when there is a saved search', async () => {
-      const { component } = await mountComponent();
-      expect(component.find(ResetSearchButton).exists()).toBe(true);
-    });
-
-    it('does not render the button when there is no saved search', async () => {
-      const { component } = await mountComponent({
-        savedSearch: { ...savedSearchMock, id: undefined },
-      });
-      expect(component.find(ResetSearchButton).exists()).toBe(false);
-    });
-
-    it('should call resetSavedSearch when clicked', async () => {
-      const { component, stateContainer } = await mountComponent();
-      expect(component.find(ResetSearchButton).exists()).toBe(true);
-      component.find(ResetSearchButton).find('button').simulate('click');
-      expect(stateContainer.actions.undoSavedSearchChanges).toHaveBeenCalled();
-    });
-  });
 });
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
index 54447ebe06b06f..d6bcd73c94d8e5 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_histogram_layout.tsx
@@ -10,10 +10,8 @@ import React from 'react';
 import { UnifiedHistogramContainer } from '@kbn/unified-histogram-plugin/public';
 import { css } from '@emotion/react';
 import useObservable from 'react-use/lib/useObservable';
-import { useSavedSearchInitial } from '../../services/discover_state_provider';
 import { useDiscoverHistogram } from './use_discover_histogram';
 import { type DiscoverMainContentProps, DiscoverMainContent } from './discover_main_content';
-import { ResetSearchButton } from './reset_search_button';
 import { useAppStateSelector } from '../../services/discover_app_state_container';
 
 export interface DiscoverHistogramLayoutProps extends DiscoverMainContentProps {
@@ -32,7 +30,6 @@ export const DiscoverHistogramLayout = ({
   ...mainContentProps
 }: DiscoverHistogramLayoutProps) => {
   const { dataState } = stateContainer;
-  const savedSearch = useSavedSearchInitial();
   const searchSessionId = useObservable(stateContainer.searchSessionManager.searchSessionId$);
   const hideChart = useAppStateSelector((state) => state.hideChart);
   const unifiedHistogramProps = useDiscoverHistogram({
@@ -54,11 +51,6 @@ export const DiscoverHistogramLayout = ({
       searchSessionId={searchSessionId}
       requestAdapter={dataState.inspectorAdapters.requests}
       container={container}
-      appendHitsCounter={
-        savedSearch.id ? (
-          <ResetSearchButton resetSavedSearch={stateContainer.actions.undoSavedSearchChanges} />
-        ) : undefined
-      }
       css={histogramLayoutCss}
     >
       <DiscoverMainContent
diff --git a/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx b/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
index d4cfa7e049a46b..d172782398b2ce 100644
--- a/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
+++ b/src/plugins/discover/public/application/main/components/layout/discover_layout.test.tsx
@@ -119,7 +119,6 @@ async function mountComponent(
     navigateTo: jest.fn(),
     onChangeDataView: jest.fn(),
     onUpdateQuery: jest.fn(),
-    resetSavedSearch: jest.fn(),
     savedSearch: savedSearchMock,
     searchSource: searchSourceMock,
     state: { columns: [], query, hideChart: false, interval: 'auto' },
diff --git a/src/plugins/discover/public/application/main/components/layout/reset_search_button.test.tsx b/src/plugins/discover/public/application/main/components/layout/reset_search_button.test.tsx
deleted file mode 100644
index cde96ff72050f3..00000000000000
--- a/src/plugins/discover/public/application/main/components/layout/reset_search_button.test.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { mountWithIntl } from '@kbn/test-jest-helpers';
-import React from 'react';
-import { ResetSearchButton } from './reset_search_button';
-
-describe('ResetSearchButton', () => {
-  it('should call resetSavedSearch when the button is clicked', () => {
-    const resetSavedSearch = jest.fn();
-    const component = mountWithIntl(<ResetSearchButton resetSavedSearch={resetSavedSearch} />);
-    component.find('button[data-test-subj="resetSavedSearch"]').simulate('click');
-    expect(resetSavedSearch).toHaveBeenCalled();
-  });
-});
diff --git a/src/plugins/discover/public/application/main/components/layout/reset_search_button.tsx b/src/plugins/discover/public/application/main/components/layout/reset_search_button.tsx
deleted file mode 100644
index e9b0cc2417d976..00000000000000
--- a/src/plugins/discover/public/application/main/components/layout/reset_search_button.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { EuiButtonEmpty, EuiFlexItem } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n-react';
-import { css } from '@emotion/react';
-
-const resetSearchButtonWrapper = css`
-  overflow: hidden;
-`;
-
-export const ResetSearchButton = ({ resetSavedSearch }: { resetSavedSearch?: () => void }) => {
-  return (
-    <EuiFlexItem grow={false} css={resetSearchButtonWrapper}>
-      <EuiButtonEmpty
-        iconType="refresh"
-        data-test-subj="resetSavedSearch"
-        onClick={resetSavedSearch}
-        size="s"
-        aria-label={i18n.translate('discover.reloadSavedSearchButton', {
-          defaultMessage: 'Reset search',
-        })}
-      >
-        <FormattedMessage id="discover.reloadSavedSearchButton" defaultMessage="Reset search" />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-  );
-};
diff --git a/src/plugins/discover/public/application/main/components/top_nav/discover_topnav.tsx b/src/plugins/discover/public/application/main/components/top_nav/discover_topnav.tsx
index 7b53587d08eb44..51484519ee7ac3 100644
--- a/src/plugins/discover/public/application/main/components/top_nav/discover_topnav.tsx
+++ b/src/plugins/discover/public/application/main/components/top_nav/discover_topnav.tsx
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 import React, { useCallback, useEffect, useMemo, useRef } from 'react';
+import useObservable from 'react-use/lib/useObservable';
 import type { Query, TimeRange, AggregateQuery } from '@kbn/es-query';
 import { DataViewType, type DataView } from '@kbn/data-views-plugin/public';
 import type { DataViewPickerProps } from '@kbn/unified-search-plugin/public';
@@ -14,6 +15,7 @@ import { useSavedSearchInitial } from '../../services/discover_state_provider';
 import { useInternalStateSelector } from '../../services/discover_internal_state_container';
 import { useDiscoverServices } from '../../../../hooks/use_discover_services';
 import { getTopNavLinks } from './get_top_nav_links';
+import { getTopNavBadges } from './get_top_nav_badges';
 import { getHeaderActionMenuMounter } from '../../../../kibana_services';
 import { DiscoverStateContainer } from '../../services/discover_state';
 import { onSaveSearch } from './on_save_search';
@@ -115,6 +117,20 @@ export const DiscoverTopNav = ({
 
   const topNavCustomization = useDiscoverCustomization('top_nav');
 
+  const hasSavedSearchChanges = useObservable(stateContainer.savedSearchState.getHasChanged$());
+  const hasUnsavedChanges =
+    hasSavedSearchChanges && Boolean(stateContainer.savedSearchState.getId());
+  const topNavBadges = useMemo(
+    () =>
+      getTopNavBadges({
+        stateContainer,
+        services,
+        hasUnsavedChanges,
+        topNavCustomization,
+      }),
+    [stateContainer, services, hasUnsavedChanges, topNavCustomization]
+  );
+
   const topNavMenu = useMemo(
     () =>
       getTopNavLinks({
@@ -216,6 +232,7 @@ export const DiscoverTopNav = ({
   return (
     <SearchBar
       appName="discover"
+      badges={topNavBadges}
       config={topNavMenu}
       indexPatterns={[dataView]}
       onQuerySubmit={updateQuery}
diff --git a/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.test.ts b/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.test.ts
new file mode 100644
index 00000000000000..165c48c8d23c45
--- /dev/null
+++ b/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.test.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getTopNavBadges } from './get_top_nav_badges';
+import { discoverServiceMock } from '../../../../__mocks__/services';
+import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock';
+
+const stateContainer = getDiscoverStateMock({ isTimeBased: true });
+
+describe('getTopNavBadges()', function () {
+  test('should not return the unsaved changes badge if no changes', () => {
+    const topNavBadges = getTopNavBadges({
+      hasUnsavedChanges: false,
+      services: discoverServiceMock,
+      stateContainer,
+      topNavCustomization: undefined,
+    });
+    expect(topNavBadges).toMatchInlineSnapshot(`Array []`);
+  });
+
+  test('should return the unsaved changes badge when has changes', () => {
+    const topNavBadges = getTopNavBadges({
+      hasUnsavedChanges: true,
+      services: discoverServiceMock,
+      stateContainer,
+      topNavCustomization: undefined,
+    });
+    expect(topNavBadges).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "badgeText": "Unsaved changes",
+          "renderCustomBadge": [Function],
+        },
+      ]
+    `);
+  });
+
+  test('should not return the unsaved changes badge when disabled in customization', () => {
+    const topNavBadges = getTopNavBadges({
+      hasUnsavedChanges: true,
+      services: discoverServiceMock,
+      stateContainer,
+      topNavCustomization: {
+        id: 'top_nav',
+        defaultBadges: {
+          unsavedChangesBadge: {
+            disabled: true,
+          },
+        },
+      },
+    });
+    expect(topNavBadges).toMatchInlineSnapshot(`Array []`);
+  });
+
+  test('should allow to render additional badges when customized', () => {
+    const topNavBadges = getTopNavBadges({
+      hasUnsavedChanges: true,
+      services: discoverServiceMock,
+      stateContainer,
+      topNavCustomization: {
+        id: 'top_nav',
+        getBadges: () => {
+          return [
+            {
+              data: {
+                badgeText: 'test10',
+              },
+              order: 10,
+            },
+            {
+              data: {
+                badgeText: 'test200',
+              },
+              order: 200,
+            },
+          ];
+        },
+      },
+    });
+    expect(topNavBadges).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "badgeText": "test10",
+        },
+        Object {
+          "badgeText": "Unsaved changes",
+          "renderCustomBadge": [Function],
+        },
+        Object {
+          "badgeText": "test200",
+        },
+      ]
+    `);
+  });
+});
diff --git a/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.tsx b/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.tsx
new file mode 100644
index 00000000000000..74547544848d97
--- /dev/null
+++ b/src/plugins/discover/public/application/main/components/top_nav/get_top_nav_badges.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { TopNavMenuBadgeProps } from '@kbn/navigation-plugin/public';
+import { getTopNavUnsavedChangesBadge } from '@kbn/unsaved-changes-badge';
+import { DiscoverStateContainer } from '../../services/discover_state';
+import type { TopNavCustomization } from '../../../../customizations';
+import { onSaveSearch } from './on_save_search';
+import { DiscoverServices } from '../../../../build_services';
+
+/**
+ * Helper function to build the top nav badges
+ */
+export const getTopNavBadges = ({
+  hasUnsavedChanges,
+  stateContainer,
+  services,
+  topNavCustomization,
+}: {
+  hasUnsavedChanges: boolean | undefined;
+  stateContainer: DiscoverStateContainer;
+  services: DiscoverServices;
+  topNavCustomization: TopNavCustomization | undefined;
+}): TopNavMenuBadgeProps[] => {
+  const saveSearch = (initialCopyOnSave?: boolean) =>
+    onSaveSearch({
+      initialCopyOnSave,
+      savedSearch: stateContainer.savedSearchState.getState(),
+      services,
+      state: stateContainer,
+    });
+
+  const defaultBadges = topNavCustomization?.defaultBadges;
+  const entries = [...(topNavCustomization?.getBadges?.() ?? [])];
+
+  if (hasUnsavedChanges && !defaultBadges?.unsavedChangesBadge?.disabled) {
+    entries.push({
+      data: getTopNavUnsavedChangesBadge({
+        onRevert: stateContainer.actions.undoSavedSearchChanges,
+        onSave: async () => {
+          await saveSearch();
+        },
+        onSaveAs: async () => {
+          await saveSearch(true);
+        },
+      }),
+      order: defaultBadges?.unsavedChangesBadge?.order ?? 100,
+    });
+  }
+
+  return entries.sort((a, b) => a.order - b.order).map((entry) => entry.data);
+};
diff --git a/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx b/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx
index abae8e83b41a16..30d73a6280072b 100644
--- a/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx
+++ b/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx
@@ -80,12 +80,14 @@ export async function onSaveSearch({
   savedSearch,
   services,
   state,
+  initialCopyOnSave,
   onClose,
   onSaveCb,
 }: {
   savedSearch: SavedSearch;
   services: DiscoverServices;
   state: DiscoverStateContainer;
+  initialCopyOnSave?: boolean;
   onClose?: () => void;
   onSaveCb?: () => void;
 }) {
@@ -173,6 +175,7 @@ export async function onSaveSearch({
       services={services}
       title={savedSearch.title ?? ''}
       showCopyOnSave={!!savedSearch.id}
+      initialCopyOnSave={initialCopyOnSave}
       description={savedSearch.description}
       timeRestore={savedSearch.timeRestore}
       tags={savedSearch.tags ?? []}
@@ -188,6 +191,7 @@ const SaveSearchObjectModal: React.FC<{
   services: DiscoverServices;
   title: string;
   showCopyOnSave: boolean;
+  initialCopyOnSave?: boolean;
   description?: string;
   timeRestore?: boolean;
   tags: string[];
@@ -200,6 +204,7 @@ const SaveSearchObjectModal: React.FC<{
   description,
   tags,
   showCopyOnSave,
+  initialCopyOnSave,
   timeRestore: savedTimeRestore,
   onSave,
   onClose,
@@ -263,6 +268,7 @@ const SaveSearchObjectModal: React.FC<{
     <SavedObjectSaveModal
       title={title}
       showCopyOnSave={showCopyOnSave}
+      initialCopyOnSave={initialCopyOnSave}
       description={description}
       objectType={i18n.translate('discover.localMenu.saveSaveSearchObjectType', {
         defaultMessage: 'search',
diff --git a/src/plugins/discover/public/application/main/hooks/utils/change_data_view.test.ts b/src/plugins/discover/public/application/main/hooks/utils/change_data_view.test.ts
index 37a503716af0e1..a0266b65ed01df 100644
--- a/src/plugins/discover/public/application/main/hooks/utils/change_data_view.test.ts
+++ b/src/plugins/discover/public/application/main/hooks/utils/change_data_view.test.ts
@@ -6,11 +6,14 @@
  * Side Public License, v 1.
  */
 
+import {
+  dataViewComplexMock,
+  dataViewWithDefaultColumnMock,
+} from '../../../../__mocks__/data_view_complex';
 import { changeDataView } from './change_data_view';
 import { savedSearchMock } from '../../../../__mocks__/saved_search';
 import { discoverServiceMock } from '../../../../__mocks__/services';
 import type { DataView } from '@kbn/data-views-plugin/common';
-import { dataViewComplexMock } from '../../../../__mocks__/data_view_complex';
 import { getDiscoverStateMock } from '../../../../__mocks__/discover_state.mock';
 
 const setupTestParams = (dataView: DataView | undefined) => {
@@ -27,11 +30,21 @@ const setupTestParams = (dataView: DataView | undefined) => {
 };
 
 describe('changeDataView', () => {
+  it('should set the right app state when a valid data view (which includes the preconfigured default column) to switch to is given', async () => {
+    const params = setupTestParams(dataViewWithDefaultColumnMock);
+    await changeDataView(dataViewWithDefaultColumnMock.id!, params);
+    expect(params.appState.update).toHaveBeenCalledWith({
+      columns: ['default_column'], // default_column would be added as dataViewWithDefaultColumn has it as a mapped field
+      index: 'data-view-with-user-default-column-id',
+      sort: [['@timestamp', 'desc']],
+    });
+  });
+
   it('should set the right app state when a valid data view to switch to is given', async () => {
-    const params = setupTestParams(dataViewComplexMock as DataView);
-    await changeDataView('data-view-with-various-field-types', params);
+    const params = setupTestParams(dataViewComplexMock);
+    await changeDataView(dataViewComplexMock.id!, params);
     expect(params.appState.update).toHaveBeenCalledWith({
-      columns: ['default_column'],
+      columns: [], // default_column would not be added as dataViewComplexMock does not have it as a mapped field
       index: 'data-view-with-various-field-types-id',
       sort: [['data', 'desc']],
     });
diff --git a/src/plugins/discover/public/application/main/hooks/utils/change_data_view.ts b/src/plugins/discover/public/application/main/hooks/utils/change_data_view.ts
index db7a4b0c00bbe1..7218ea76b2ac6e 100644
--- a/src/plugins/discover/public/application/main/hooks/utils/change_data_view.ts
+++ b/src/plugins/discover/public/application/main/hooks/utils/change_data_view.ts
@@ -8,7 +8,11 @@
 
 import { SortOrder } from '@kbn/saved-search-plugin/public';
 import { DataView } from '@kbn/data-views-plugin/common';
-import { MODIFY_COLUMNS_ON_SWITCH, SORT_DEFAULT_ORDER_SETTING } from '@kbn/discover-utils';
+import {
+  MODIFY_COLUMNS_ON_SWITCH,
+  SORT_DEFAULT_ORDER_SETTING,
+  DEFAULT_COLUMNS_SETTING,
+} from '@kbn/discover-utils';
 import { DiscoverInternalStateContainer } from '../../services/discover_internal_state_container';
 import { DiscoverAppStateContainer } from '../../services/discover_app_state_container';
 import { addLog } from '../../../../utils/add_log';
@@ -46,6 +50,7 @@ export async function changeDataView(
     const nextAppState = getDataViewAppState(
       dataView,
       nextDataView,
+      uiSettings.get(DEFAULT_COLUMNS_SETTING, []),
       state.columns || [],
       (state.sort || []) as SortOrder[],
       uiSettings.get(MODIFY_COLUMNS_ON_SWITCH),
diff --git a/src/plugins/discover/public/application/main/services/discover_saved_search_container.ts b/src/plugins/discover/public/application/main/services/discover_saved_search_container.ts
index b47ddd10c41498..8948c954d039c4 100644
--- a/src/plugins/discover/public/application/main/services/discover_saved_search_container.ts
+++ b/src/plugins/discover/public/application/main/services/discover_saved_search_container.ts
@@ -8,6 +8,7 @@
 
 import { SavedSearch } from '@kbn/saved-search-plugin/public';
 import { BehaviorSubject } from 'rxjs';
+import type { SearchSourceFields } from '@kbn/data-plugin/common';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import { SavedObjectSaveOpts } from '@kbn/saved-objects-plugin/public';
 import { isEqual } from 'lodash';
@@ -245,19 +246,61 @@ export function isEqualSavedSearch(savedSearchPrev: SavedSearch, savedSearchNext
   const keys = new Set([
     ...Object.keys(prevSavedSearch),
     ...Object.keys(nextSavedSearchWithoutSearchSource),
-  ]);
-  const savedSearchDiff = [...keys].filter((key: string) => {
-    // @ts-expect-error
-    return !isEqual(prevSavedSearch[key], nextSavedSearchWithoutSearchSource[key]);
+  ] as Array<keyof Omit<SavedSearch, 'searchSource'>>);
+
+  // at least one change in saved search attributes
+  const hasChangesInSavedSearch = [...keys].some((key) => {
+    if (
+      ['usesAdHocDataView', 'hideChart'].includes(key) &&
+      typeof prevSavedSearch[key] === 'undefined' &&
+      nextSavedSearchWithoutSearchSource[key] === false
+    ) {
+      return false; // ignore when value was changed from `undefined` to `false` as it happens per app logic, not by a user action
+    }
+
+    const isSame = isEqual(prevSavedSearch[key], nextSavedSearchWithoutSearchSource[key]);
+
+    if (!isSame) {
+      addLog('[savedSearch] difference between initial and changed version', {
+        key,
+        before: prevSavedSearch[key],
+        after: nextSavedSearchWithoutSearchSource[key],
+      });
+    }
+
+    return !isSame;
   });
 
-  const searchSourceDiff =
-    !isEqual(prevSearchSource.getField('filter'), nextSearchSource.getField('filter')) ||
-    !isEqual(prevSearchSource.getField('query'), nextSearchSource.getField('query')) ||
-    !isEqual(prevSearchSource.getField('index'), nextSearchSource.getField('index'));
-  const hasChanged = Boolean(savedSearchDiff.length || searchSourceDiff);
-  if (hasChanged) {
-    addLog('[savedSearch] difference between initial and changed version', searchSourceDiff);
+  if (hasChangesInSavedSearch) {
+    return false;
   }
-  return !hasChanged;
+
+  // at least one change in search source fields
+  const hasChangesInSearchSource = (
+    ['filter', 'query', 'index'] as Array<keyof SearchSourceFields>
+  ).some((key) => {
+    const prevValue =
+      key === 'index' ? prevSearchSource.getField(key)?.id : prevSearchSource.getField(key);
+    const nextValue =
+      key === 'index' ? nextSearchSource.getField(key)?.id : nextSearchSource.getField(key);
+    const isSame = isEqual(prevValue, nextValue);
+
+    if (!isSame) {
+      addLog('[savedSearch] difference between initial and changed version', {
+        key,
+        before: prevValue,
+        after: nextValue,
+      });
+    }
+
+    return !isSame;
+  });
+
+  if (hasChangesInSearchSource) {
+    return false;
+  }
+
+  addLog('[savedSearch] no difference between initial and changed version');
+
+  return true;
 }
diff --git a/src/plugins/discover/public/application/main/services/discover_state.test.ts b/src/plugins/discover/public/application/main/services/discover_state.test.ts
index bcd96315ce5754..c946ac70bbe62f 100644
--- a/src/plugins/discover/public/application/main/services/discover_state.test.ts
+++ b/src/plugins/discover/public/application/main/services/discover_state.test.ts
@@ -360,10 +360,16 @@ describe('Test discover state actions', () => {
     const { searchSource, ...savedSearch } = state.savedSearchState.getState();
     expect(savedSearch).toMatchInlineSnapshot(`
       Object {
+        "breakdownField": undefined,
         "columns": Array [
           "default_column",
         ],
+        "hideAggregatedPreview": undefined,
+        "hideChart": undefined,
         "refreshInterval": undefined,
+        "rowHeight": undefined,
+        "rowsPerPage": undefined,
+        "sampleSize": undefined,
         "sort": Array [],
         "timeRange": undefined,
         "usesAdHocDataView": false,
@@ -698,7 +704,7 @@ describe('Test discover state actions', () => {
     await state.actions.onChangeDataView(dataViewComplexMock.id!);
     await new Promise(process.nextTick);
     expect(getCurrentUrl()).toMatchInlineSnapshot(
-      `"/#?_g=(refreshInterval:(pause:!t,value:1000),time:(from:now-15d,to:now))&_a=(columns:!(default_column),index:data-view-with-various-field-types-id,interval:auto,sort:!(!(data,desc)))"`
+      `"/#?_g=(refreshInterval:(pause:!t,value:1000),time:(from:now-15d,to:now))&_a=(columns:!(),index:data-view-with-various-field-types-id,interval:auto,sort:!(!(data,desc)))"`
     );
     await waitFor(() => {
       expect(state.dataState.fetch).toHaveBeenCalledTimes(1);
diff --git a/src/plugins/discover/public/application/main/services/discover_state.ts b/src/plugins/discover/public/application/main/services/discover_state.ts
index bb0fbed792d644..b3abfed5e6eccf 100644
--- a/src/plugins/discover/public/application/main/services/discover_state.ts
+++ b/src/plugins/discover/public/application/main/services/discover_state.ts
@@ -185,7 +185,7 @@ export interface DiscoverStateContainer {
     /**
      * Undo changes made to the saved search, e.g. when the user triggers the "Reset search" button
      */
-    undoSavedSearchChanges: () => void;
+    undoSavedSearchChanges: () => Promise<SavedSearch>;
     /**
      * When saving a saved search with an ad hoc data view, a new id needs to be generated for the data view
      * This is to prevent duplicate ids messing with our system
diff --git a/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.test.ts b/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.test.ts
index cf987c8c71090b..e265a90ab291d7 100644
--- a/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.test.ts
+++ b/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.test.ts
@@ -9,6 +9,8 @@
 import { getDataViewAppState } from './get_switch_data_view_app_state';
 import { DataView } from '@kbn/data-views-plugin/public';
 
+const emptyDefaultColumns: string[] = [];
+
 /**
  * Helper function returning an data view
  */
@@ -36,23 +38,36 @@ const getDataView = (id: string, timeFieldName: string, fields: string[]) => {
 };
 
 const currentDataView = getDataView('curr', '', ['category', 'name']);
-const nextDataView = getDataView('next', '', ['category']);
+const nextDataView = getDataView('next', '', ['category', 'user_default_column']);
 
 describe('Discover getDataViewAppState', () => {
   test('removing fields that are not part of the next data view, keeping unknown fields ', async () => {
     const result = getDataViewAppState(
       currentDataView,
       nextDataView,
+      emptyDefaultColumns,
       ['category', 'name', 'unknown'],
       [['category', 'desc']]
     );
     expect(result.columns).toEqual(['category', 'unknown']);
     expect(result.sort).toEqual([['category', 'desc']]);
   });
+  test('removing fields that are not part of the next data view and adding default columns', async () => {
+    const result = getDataViewAppState(
+      currentDataView,
+      nextDataView,
+      ['user_default_column', 'user_unknown_default_column'],
+      ['category', 'name', 'user_default_column'],
+      [['category', 'desc']]
+    );
+    expect(result.columns).toEqual(['category', 'user_default_column']);
+    expect(result.sort).toEqual([['category', 'desc']]);
+  });
   test('removing sorted by fields that are not part of the next data view', async () => {
     const result = getDataViewAppState(
       currentDataView,
       nextDataView,
+      emptyDefaultColumns,
       ['name'],
       [
         ['category', 'desc'],
@@ -66,6 +81,7 @@ describe('Discover getDataViewAppState', () => {
     const result = getDataViewAppState(
       currentDataView,
       nextDataView,
+      emptyDefaultColumns,
       ['name'],
       [
         ['category', 'desc'],
@@ -80,7 +96,13 @@ describe('Discover getDataViewAppState', () => {
     const current = getDataView('a', 'timeFieldA', ['timeFieldA']);
     const next = getDataView('b', 'timeFieldB', ['timeFieldB']);
 
-    const result = getDataViewAppState(current, next, [], [['timeFieldA', 'desc']]);
+    const result = getDataViewAppState(
+      current,
+      next,
+      emptyDefaultColumns,
+      [],
+      [['timeFieldA', 'desc']]
+    );
     expect(result.columns).toEqual([]);
     expect(result.sort).toEqual([['timeFieldB', 'desc']]);
   });
@@ -89,7 +111,13 @@ describe('Discover getDataViewAppState', () => {
     const current = getDataView('a', 'timeFieldA', ['timeFieldA']);
     const next = getDataView('b', '', ['timeFieldA']);
 
-    const result = getDataViewAppState(current, next, [], [['timeFieldA', 'desc']]);
+    const result = getDataViewAppState(
+      current,
+      next,
+      emptyDefaultColumns,
+      [],
+      [['timeFieldA', 'desc']]
+    );
     expect(result.columns).toEqual([]);
     expect(result.sort).toEqual([]);
   });
@@ -97,7 +125,7 @@ describe('Discover getDataViewAppState', () => {
     const current = getDataView('b', '', ['timeFieldA']);
     const next = getDataView('a', 'timeFieldA', ['timeFieldA']);
 
-    const result = getDataViewAppState(current, next, [], []);
+    const result = getDataViewAppState(current, next, emptyDefaultColumns, [], []);
     expect(result.columns).toEqual([]);
     expect(result.sort).toEqual([['timeFieldA', 'desc']]);
   });
@@ -105,8 +133,16 @@ describe('Discover getDataViewAppState', () => {
     const current = getDataView('timebased', 'timefield', ['timefield']);
     const next = getDataView('timebased2', 'timefield2', ['timefield', 'timefield2']);
 
-    const result = getDataViewAppState(current, next, [], [['timefield', 'desc']]);
+    const result = getDataViewAppState(
+      current,
+      next,
+      emptyDefaultColumns,
+      [],
+      [['timefield', 'desc']]
+    );
     expect(result.columns).toEqual([]);
     expect(result.sort).toEqual([['timefield2', 'desc']]);
   });
+
+  // TODO: add tests
 });
diff --git a/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.ts b/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.ts
index 064fe36d974ec2..9597aa85374257 100644
--- a/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.ts
+++ b/src/plugins/discover/public/application/main/utils/get_switch_data_view_app_state.ts
@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+import { uniq } from 'lodash';
 import { isOfAggregateQueryType, Query, AggregateQuery } from '@kbn/es-query';
 import type { DataView } from '@kbn/data-views-plugin/public';
 import type { SortOrder } from '@kbn/saved-search-plugin/public';
@@ -17,20 +18,25 @@ import { getSortArray } from '../../../utils/sorting';
 export function getDataViewAppState(
   currentDataView: DataView,
   nextDataView: DataView,
+  defaultColumns: string[],
   currentColumns: string[],
   currentSort: SortOrder[],
   modifyColumns: boolean = true,
   sortDirection: string = 'desc',
   query?: Query | AggregateQuery
 ) {
-  const nextColumns = modifyColumns
-    ? currentColumns.filter(
-        (column) =>
-          nextDataView.fields.getByName(column) || !currentDataView.fields.getByName(column)
-      )
-    : currentColumns;
+  let columns = currentColumns || [];
+
+  if (modifyColumns) {
+    const currentUnknownColumns = columns.filter(
+      (column) => !currentDataView.fields.getByName(column) && !defaultColumns.includes(column)
+    );
+    const currentColumnsRefreshed = uniq([...columns, ...defaultColumns]);
+    columns = currentColumnsRefreshed.filter(
+      (column) => nextDataView.fields.getByName(column) || currentUnknownColumns.includes(column)
+    );
+  }
 
-  let columns = nextColumns.length ? nextColumns : [];
   if (query && isOfAggregateQueryType(query)) {
     columns = [];
   }
diff --git a/src/plugins/discover/public/application/main/utils/update_saved_search.ts b/src/plugins/discover/public/application/main/utils/update_saved_search.ts
index dc5e5307f5fe0e..fb6ffd66218253 100644
--- a/src/plugins/discover/public/application/main/utils/update_saved_search.ts
+++ b/src/plugins/discover/public/application/main/utils/update_saved_search.ts
@@ -60,26 +60,17 @@ export function updateSavedSearch({
     if (state.grid) {
       savedSearch.grid = state.grid;
     }
-    if (typeof state.hideChart !== 'undefined') {
-      savedSearch.hideChart = state.hideChart;
-    }
-    if (typeof state.rowHeight !== 'undefined') {
-      savedSearch.rowHeight = state.rowHeight;
-    }
+    savedSearch.hideChart = state.hideChart;
+    savedSearch.rowHeight = state.rowHeight;
+    savedSearch.rowsPerPage = state.rowsPerPage;
+    savedSearch.sampleSize = state.sampleSize;
 
     if (state.viewMode) {
       savedSearch.viewMode = state.viewMode;
     }
 
-    if (typeof state.breakdownField !== 'undefined') {
-      savedSearch.breakdownField = state.breakdownField;
-    } else if (savedSearch.breakdownField) {
-      savedSearch.breakdownField = '';
-    }
-
-    if (state.hideAggregatedPreview) {
-      savedSearch.hideAggregatedPreview = state.hideAggregatedPreview;
-    }
+    savedSearch.breakdownField = state.breakdownField || undefined; // `undefined` instead of an empty string
+    savedSearch.hideAggregatedPreview = state.hideAggregatedPreview;
 
     // add a flag here to identify text based language queries
     // these should be filtered out from the visualize editor
diff --git a/src/plugins/discover/public/components/common/error_callout.tsx b/src/plugins/discover/public/components/common/error_callout.tsx
index 1b3e8f02f39a31..9b6aa341d5fdc6 100644
--- a/src/plugins/discover/public/components/common/error_callout.tsx
+++ b/src/plugins/discover/public/components/common/error_callout.tsx
@@ -32,6 +32,7 @@ export const ErrorCallout = ({ title, error }: Props) => {
       iconType="error"
       color="danger"
       title={<h2 data-test-subj="discoverErrorCalloutTitle">{overrideDisplay?.title ?? title}</h2>}
+      actions={overrideDisplay?.actions ?? []}
       body={
         <div
           css={css`
diff --git a/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.test.tsx b/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.test.tsx
index d8c43fd8dedfe2..0f17aec0684a22 100644
--- a/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.test.tsx
+++ b/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.test.tsx
@@ -231,6 +231,19 @@ describe('Discover flyout', function () {
   });
 
   describe('with applied customizations', () => {
+    describe('when title is customized', () => {
+      it('should display the passed string as title', async () => {
+        const customTitle = 'Custom flyout title';
+        mockFlyoutCustomization.title = customTitle;
+
+        const { component } = await mountComponent({});
+
+        const titleNode = findTestSubject(component, 'docTableRowDetailsTitle');
+
+        expect(titleNode.text()).toBe(customTitle);
+      });
+    });
+
     describe('when actions are customized', () => {
       it('should display actions added by getActionItems', async () => {
         mockFlyoutCustomization.actions = {
diff --git a/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.tsx b/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.tsx
index d8c218efba23ae..19cf02b43585c5 100644
--- a/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.tsx
+++ b/src/plugins/discover/public/components/discover_grid_flyout/discover_grid_flyout.tsx
@@ -186,6 +186,15 @@ export function DiscoverGridFlyout({
     renderDefaultContent()
   );
 
+  const defaultFlyoutTitle = isPlainRecord
+    ? i18n.translate('discover.grid.tableRow.textBasedDetailHeading', {
+        defaultMessage: 'Expanded row',
+      })
+    : i18n.translate('discover.grid.tableRow.detailHeading', {
+        defaultMessage: 'Expanded document',
+      });
+  const flyoutTitle = flyoutCustomization?.title ?? defaultFlyoutTitle;
+
   return (
     <EuiPortal>
       <EuiFlyout
@@ -201,15 +210,7 @@ export function DiscoverGridFlyout({
             className="unifiedDataTable__flyoutHeader"
             data-test-subj="docTableRowDetailsTitle"
           >
-            <h2>
-              {isPlainRecord
-                ? i18n.translate('discover.grid.tableRow.textBasedDetailHeading', {
-                    defaultMessage: 'Expanded row',
-                  })
-                : i18n.translate('discover.grid.tableRow.detailHeading', {
-                    defaultMessage: 'Expanded document',
-                  })}
-            </h2>
+            <h2>{flyoutTitle}</h2>
           </EuiTitle>
           <EuiSpacer size="s" />
           <EuiFlexGroup responsive={false} gutterSize="s" alignItems="center">
diff --git a/src/plugins/discover/public/customizations/customization_types/flyout_customization.ts b/src/plugins/discover/public/customizations/customization_types/flyout_customization.ts
index 84f3f277150391..12d032fa6e6ccf 100644
--- a/src/plugins/discover/public/customizations/customization_types/flyout_customization.ts
+++ b/src/plugins/discover/public/customizations/customization_types/flyout_customization.ts
@@ -38,6 +38,7 @@ export interface FlyoutContentProps {
 
 export interface FlyoutCustomization {
   id: 'flyout';
+  title?: string;
   actions: {
     defaultActions?: FlyoutDefaultActions;
     getActionItems?: () => FlyoutActionItem[];
diff --git a/src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts b/src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts
index 4699a4665902f4..d57b898b15111b 100644
--- a/src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts
+++ b/src/plugins/discover/public/customizations/customization_types/top_nav_customization.ts
@@ -6,20 +6,20 @@
  * Side Public License, v 1.
  */
 
-import type { TopNavMenuData } from '@kbn/navigation-plugin/public';
+import type { TopNavMenuData, TopNavMenuBadgeProps } from '@kbn/navigation-plugin/public';
 
-export interface TopNavDefaultMenuItem {
+export interface TopNavDefaultItem {
   disabled?: boolean;
   order?: number;
 }
 
 export interface TopNavDefaultMenu {
-  newItem?: TopNavDefaultMenuItem;
-  openItem?: TopNavDefaultMenuItem;
-  shareItem?: TopNavDefaultMenuItem;
-  alertsItem?: TopNavDefaultMenuItem;
-  inspectItem?: TopNavDefaultMenuItem;
-  saveItem?: TopNavDefaultMenuItem;
+  newItem?: TopNavDefaultItem;
+  openItem?: TopNavDefaultItem;
+  shareItem?: TopNavDefaultItem;
+  alertsItem?: TopNavDefaultItem;
+  inspectItem?: TopNavDefaultItem;
+  saveItem?: TopNavDefaultItem;
 }
 
 export interface TopNavMenuItem {
@@ -27,8 +27,19 @@ export interface TopNavMenuItem {
   order: number;
 }
 
+export interface TopNavDefaultBadges {
+  unsavedChangesBadge?: TopNavDefaultItem;
+}
+
+export interface TopNavBadge {
+  data: TopNavMenuBadgeProps;
+  order: number;
+}
+
 export interface TopNavCustomization {
   id: 'top_nav';
   defaultMenu?: TopNavDefaultMenu;
   getMenuItems?: () => TopNavMenuItem[];
+  defaultBadges?: TopNavDefaultBadges;
+  getBadges?: () => TopNavBadge[];
 }
diff --git a/src/plugins/discover/server/index.ts b/src/plugins/discover/server/index.ts
index f899060f0304c0..1b5a9b5080da9c 100644
--- a/src/plugins/discover/server/index.ts
+++ b/src/plugins/discover/server/index.ts
@@ -9,7 +9,6 @@
 import { KibanaRequest } from '@kbn/core/server';
 import { DataPluginStart } from '@kbn/data-plugin/server/plugin';
 import { ColumnsFromLocatorFn, SearchSourceFromLocatorFn, TitleFromLocatorFn } from './locator';
-import { DiscoverServerPlugin } from './plugin';
 
 export interface DiscoverServerPluginStartDeps {
   data: DataPluginStart;
@@ -29,4 +28,7 @@ export interface DiscoverServerPluginStart {
   locator: DiscoverServerPluginLocatorService;
 }
 
-export const plugin = () => new DiscoverServerPlugin();
+export const plugin = async () => {
+  const { DiscoverServerPlugin } = await import('./plugin');
+  return new DiscoverServerPlugin();
+};
diff --git a/src/plugins/discover/tsconfig.json b/src/plugins/discover/tsconfig.json
index 6fca69dfaea5ce..0a3d7e0947137d 100644
--- a/src/plugins/discover/tsconfig.json
+++ b/src/plugins/discover/tsconfig.json
@@ -74,6 +74,7 @@
     "@kbn/rule-data-utils",
     "@kbn/global-search-plugin",
     "@kbn/resizable-layout",
+    "@kbn/unsaved-changes-badge",
     "@kbn/core-chrome-browser"
   ],
   "exclude": [
diff --git a/src/plugins/embeddable/public/embeddable_panel/embeddable_panel_error.tsx b/src/plugins/embeddable/public/embeddable_panel/embeddable_panel_error.tsx
index 8d7055b342ce24..0a43e14346702f 100644
--- a/src/plugins/embeddable/public/embeddable_panel/embeddable_panel_error.tsx
+++ b/src/plugins/embeddable/public/embeddable_panel/embeddable_panel_error.tsx
@@ -13,7 +13,9 @@ import { EuiButtonEmpty, EuiEmptyPrompt, EuiText } from '@elastic/eui';
 
 import type { MaybePromise } from '@kbn/utility-types';
 import { Markdown } from '@kbn/kibana-react-plugin/public';
+import { getSearchErrorOverrideDisplay } from '@kbn/data-plugin/public';
 import { ErrorLike } from '@kbn/expressions-plugin/common';
+import { core } from '../kibana_services';
 
 import { EditPanelAction } from './panel_actions';
 import { EmbeddableInput, EmbeddableOutput, IEmbeddable } from '../lib/embeddables';
@@ -51,6 +53,20 @@ export function EmbeddablePanelError({
     [label, title]
   );
 
+  const overrideDisplay = getSearchErrorOverrideDisplay({
+    error,
+    application: core.application,
+  });
+
+  const actions = overrideDisplay?.actions ?? [];
+  if (isEditable) {
+    actions.push(
+      <EuiButtonEmpty aria-label={ariaLabel} onClick={handleErrorClick} size="s">
+        {label}
+      </EuiButtonEmpty>
+    );
+  }
+
   useEffect(() => {
     const subscription = merge(embeddable.getInput$(), embeddable.getOutput$())
       .pipe(
@@ -65,25 +81,21 @@ export function EmbeddablePanelError({
   return (
     <EuiEmptyPrompt
       body={
-        <EuiText size="s">
-          <Markdown
-            markdown={error.message}
-            openLinksInNewTab={true}
-            data-test-subj="errorMessageMarkdown"
-          />
-        </EuiText>
+        overrideDisplay?.body ?? (
+          <EuiText size="s">
+            <Markdown
+              markdown={error.message}
+              openLinksInNewTab={true}
+              data-test-subj="errorMessageMarkdown"
+            />
+          </EuiText>
+        )
       }
       data-test-subj="embeddableStackError"
       iconType="warning"
       iconColor="danger"
       layout="vertical"
-      actions={
-        isEditable && (
-          <EuiButtonEmpty aria-label={ariaLabel} onClick={handleErrorClick} size="s">
-            {label}
-          </EuiButtonEmpty>
-        )
-      }
+      actions={actions}
     />
   );
 }
diff --git a/src/plugins/embeddable/public/plugin.tsx b/src/plugins/embeddable/public/plugin.tsx
index c56e4e381ce5c7..d7af8f68817ea3 100644
--- a/src/plugins/embeddable/public/plugin.tsx
+++ b/src/plugins/embeddable/public/plugin.tsx
@@ -54,7 +54,6 @@ import {
   getTelemetryFunction,
 } from '../common/lib';
 import { getAllMigrations } from '../common/lib/get_all_migrations';
-import { setTheme } from './services';
 import { setKibanaServices } from './kibana_services';
 import { CustomTimeRangeBadge, EditPanelAction } from './embeddable_panel/panel_actions';
 
@@ -120,7 +119,6 @@ export class EmbeddablePublicPlugin implements Plugin<EmbeddableSetup, Embeddabl
   constructor(initializerContext: PluginInitializerContext) {}
 
   public setup(core: CoreSetup, { uiActions }: EmbeddableSetupDependencies) {
-    setTheme(core.theme);
     bootstrap(uiActions);
 
     return {
diff --git a/src/plugins/embeddable/server/index.ts b/src/plugins/embeddable/server/index.ts
index 4b93f0838c649c..3ec552bacaa1d5 100644
--- a/src/plugins/embeddable/server/index.ts
+++ b/src/plugins/embeddable/server/index.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { EmbeddableServerPlugin, EmbeddableSetup, EmbeddableStart } from './plugin';
+import { EmbeddableSetup, EmbeddableStart } from './plugin';
 
 export type { EmbeddableSetup, EmbeddableStart };
 
@@ -14,4 +14,7 @@ export type { EnhancementRegistryDefinition } from './types';
 
 export type { EmbeddableRegistryDefinition } from '../common';
 
-export const plugin = () => new EmbeddableServerPlugin();
+export const plugin = async () => {
+  const { EmbeddableServerPlugin } = await import('./plugin');
+  return new EmbeddableServerPlugin();
+};
diff --git a/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx b/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx
index 7ee8b464ce521a..c32fab974a8110 100644
--- a/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx
+++ b/src/plugins/es_ui_shared/public/components/view_api_request_flyout/view_api_request_flyout.tsx
@@ -25,7 +25,7 @@ import {
 } from '@elastic/eui';
 import type { UrlService } from '@kbn/share-plugin/common/url_service';
 import { ApplicationStart, APP_WRAPPER_CLASS } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 type FlyoutProps = Omit<EuiFlyoutProps, 'onClose'>;
 interface ViewApiRequestFlyoutProps {
@@ -133,13 +133,15 @@ export const ApiRequestFlyout: React.FunctionComponent<ViewApiRequestFlyoutProps
 export const ViewApiRequestFlyout = (props: ViewApiRequestFlyoutProps) => {
   if (props.application) {
     return (
-      <RedirectAppLinks
-        application={props.application}
-        className={APP_WRAPPER_CLASS}
-        data-test-subj="apiRequestFlyoutRedirectWrapper"
-      >
-        <ApiRequestFlyout {...props} />
-      </RedirectAppLinks>
+      <div className={APP_WRAPPER_CLASS} data-test-subj="apiRequestFlyoutRedirectWrapper">
+        <RedirectAppLinks
+          coreStart={{
+            application: props.application,
+          }}
+        >
+          <ApiRequestFlyout {...props} />
+        </RedirectAppLinks>
+      </div>
     );
   }
 
diff --git a/src/plugins/es_ui_shared/server/index.ts b/src/plugins/es_ui_shared/server/index.ts
index 6fe8c913875a02..5e5d1010c3b248 100644
--- a/src/plugins/es_ui_shared/server/index.ts
+++ b/src/plugins/es_ui_shared/server/index.ts
@@ -9,7 +9,7 @@
 export { handleEsError, parseEsError } from './errors';
 
 /** dummy plugin*/
-export function plugin() {
+export async function plugin() {
   return new (class EsUiSharedPlugin {
     setup() {}
     start() {}
diff --git a/src/plugins/es_ui_shared/tsconfig.json b/src/plugins/es_ui_shared/tsconfig.json
index b88684db55567d..6e1e4b88f0850a 100644
--- a/src/plugins/es_ui_shared/tsconfig.json
+++ b/src/plugins/es_ui_shared/tsconfig.json
@@ -23,6 +23,7 @@
     "@kbn/kibana-react-plugin",
     "@kbn/safer-lodash-set",
     "@kbn/storybook",
+    "@kbn/shared-ux-link-redirect-app",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/event_annotation/server/index.ts b/src/plugins/event_annotation/server/index.ts
index 84fecda35d4f18..7952fb67d3f881 100644
--- a/src/plugins/event_annotation/server/index.ts
+++ b/src/plugins/event_annotation/server/index.ts
@@ -7,7 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core-plugins-server';
-import { EventAnnotationServerPlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new EventAnnotationServerPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { EventAnnotationServerPlugin } = await import('./plugin');
+  return new EventAnnotationServerPlugin(initializerContext);
+};
diff --git a/src/plugins/expression_image/server/index.ts b/src/plugins/expression_image/server/index.ts
index a4c6ee888d0863..4f0087b6f262dd 100755
--- a/src/plugins/expression_image/server/index.ts
+++ b/src/plugins/expression_image/server/index.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionImagePlugin } from './plugin';
-
 export type { ExpressionImagePluginSetup, ExpressionImagePluginStart } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { ExpressionImagePlugin } = await import('./plugin');
   return new ExpressionImagePlugin();
 }
diff --git a/src/plugins/expression_metric/server/index.ts b/src/plugins/expression_metric/server/index.ts
index 0caafe1b692621..f9eb950b9ceaee 100755
--- a/src/plugins/expression_metric/server/index.ts
+++ b/src/plugins/expression_metric/server/index.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionMetricPlugin } from './plugin';
-
 export type { ExpressionMetricPluginSetup, ExpressionMetricPluginStart } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { ExpressionMetricPlugin } = await import('./plugin');
   return new ExpressionMetricPlugin();
 }
diff --git a/src/plugins/expression_repeat_image/server/index.ts b/src/plugins/expression_repeat_image/server/index.ts
index 07d0df9f78e055..0bc2ce114c5a63 100755
--- a/src/plugins/expression_repeat_image/server/index.ts
+++ b/src/plugins/expression_repeat_image/server/index.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionRepeatImagePlugin } from './plugin';
-
 export type { ExpressionRepeatImagePluginSetup, ExpressionRepeatImagePluginStart } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { ExpressionRepeatImagePlugin } = await import('./plugin');
   return new ExpressionRepeatImagePlugin();
 }
diff --git a/src/plugins/expression_reveal_image/server/index.ts b/src/plugins/expression_reveal_image/server/index.ts
index b86c356974321d..5675e194669d07 100644
--- a/src/plugins/expression_reveal_image/server/index.ts
+++ b/src/plugins/expression_reveal_image/server/index.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionRevealImagePlugin } from './plugin';
-
 export type { ExpressionRevealImagePluginSetup, ExpressionRevealImagePluginStart } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { ExpressionRevealImagePlugin } = await import('./plugin');
   return new ExpressionRevealImagePlugin();
 }
diff --git a/src/plugins/expression_shape/server/index.ts b/src/plugins/expression_shape/server/index.ts
index 79da7a954c5501..8fd3ea9d48fe9a 100644
--- a/src/plugins/expression_shape/server/index.ts
+++ b/src/plugins/expression_shape/server/index.ts
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import { ExpressionShapePlugin } from './plugin';
-
 export type { ExpressionShapePluginSetup, ExpressionShapePluginStart } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { ExpressionShapePlugin } = await import('./plugin');
   return new ExpressionShapePlugin();
 }
diff --git a/src/plugins/expressions/server/index.ts b/src/plugins/expressions/server/index.ts
index 2e087d33c7aa56..b0e6cdc15f81ac 100644
--- a/src/plugins/expressions/server/index.ts
+++ b/src/plugins/expressions/server/index.ts
@@ -7,13 +7,14 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ExpressionsServerPlugin } from './plugin';
+import type { ExpressionsServerPlugin } from './plugin';
 
 export type { ExpressionsServerSetup, ExpressionsServerStart } from './plugin';
 
 // Kibana Platform.
 export { ExpressionsServerPlugin as Plugin };
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ExpressionsServerPlugin } = await import('./plugin');
   return new ExpressionsServerPlugin(initializerContext);
 }
 
diff --git a/src/plugins/expressions/server/mocks.ts b/src/plugins/expressions/server/mocks.ts
index df5232ab5faf50..db6348d1d3fe9f 100644
--- a/src/plugins/expressions/server/mocks.ts
+++ b/src/plugins/expressions/server/mocks.ts
@@ -41,7 +41,7 @@ const createPlugin = async () => {
   const pluginInitializerContext = coreMock.createPluginInitializerContext();
   const coreSetup = coreMock.createSetup();
   const coreStart = coreMock.createStart();
-  const plugin = pluginInitializer(pluginInitializerContext);
+  const plugin = await pluginInitializer(pluginInitializerContext);
   const setup = await plugin.setup(coreSetup);
 
   return {
diff --git a/src/plugins/field_formats/server/index.ts b/src/plugins/field_formats/server/index.ts
index bcc94c38dd0d84..b268665b0fa3f5 100755
--- a/src/plugins/field_formats/server/index.ts
+++ b/src/plugins/field_formats/server/index.ts
@@ -7,10 +7,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { FieldFormatsPlugin } from './plugin';
 export { DateFormat, DateNanosFormat } from './lib/converters';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { FieldFormatsPlugin } = await import('./plugin');
   return new FieldFormatsPlugin(initializerContext);
 }
 
diff --git a/src/plugins/files/common/types.ts b/src/plugins/files/common/types.ts
index 8b6059bdb5637a..e2efdb3bdea336 100644
--- a/src/plugins/files/common/types.ts
+++ b/src/plugins/files/common/types.ts
@@ -20,6 +20,7 @@ import type {
 } from '@kbn/shared-ux-file-types';
 import type { UploadOptions } from '../server/blob_storage_service';
 import type { ES_FIXED_SIZE_INDEX_BLOB_STORE } from './constants';
+import type { SupportedFileHashAlgorithm } from '../server/saved_objects/file';
 
 export type {
   FileKindBase,
@@ -94,6 +95,12 @@ export interface FileKind extends FileKindBase {
      */
     share?: HttpEndpointDefinition;
   };
+
+  /**
+   * A list of hashes to compute for this file kind. The hashes will be computed
+   * during the file upload process and stored in the file metadata.
+   */
+  hashes?: SupportedFileHashAlgorithm[];
 }
 
 /** Definition for an endpoint that the File's service will generate */
diff --git a/src/plugins/files/server/file/file.ts b/src/plugins/files/server/file/file.ts
index eeec150cfc78c6..495d233fd421ba 100644
--- a/src/plugins/files/server/file/file.ts
+++ b/src/plugins/files/server/file/file.ts
@@ -19,7 +19,6 @@ import {
   Observable,
   lastValueFrom,
 } from 'rxjs';
-import { isFileHashTransform } from '../file_client/stream_transforms/file_hash_transform/file_hash_transform';
 import { UploadOptions } from '../blob_storage_service';
 import type { FileShareJSON, FileShareJSONWithToken } from '../../common/types';
 import type { File as IFile, UpdatableFileMetadata, FileJSON } from '../../common';
@@ -72,10 +71,7 @@ export class File<M = unknown> implements IFile {
     return this;
   }
 
-  private upload(
-    content: Readable,
-    options?: Partial<Pick<UploadOptions, 'transforms'>>
-  ): Observable<{ size: number }> {
+  private upload(content: Readable, options?: Partial<Pick<UploadOptions, 'transforms'>>) {
     return defer(() => this.fileClient.upload(this.metadata, content, options));
   }
 
@@ -104,26 +100,17 @@ export class File<M = unknown> implements IFile {
             )
           )
         ),
-        mergeMap(({ size }) => {
+        mergeMap(({ size, hashes }) => {
           const updatedStateAction: Action & { action: 'uploaded' } = {
             action: 'uploaded',
             payload: { size },
           };
 
-          if (options && options.transforms) {
-            options.transforms.some((transform) => {
-              if (isFileHashTransform(transform)) {
-                const fileHash = transform.getFileHash();
-
-                updatedStateAction.payload.hash = {
-                  [fileHash.algorithm]: fileHash.value,
-                };
-
-                return true;
-              }
-
-              return false;
-            });
+          if (hashes && hashes.length) {
+            updatedStateAction.payload.hash = {};
+            for (const { algorithm, value } of hashes) {
+              updatedStateAction.payload.hash[algorithm] = value;
+            }
           }
 
           return this.updateFileState(updatedStateAction);
diff --git a/src/plugins/files/server/file_client/create_es_file_client.ts b/src/plugins/files/server/file_client/create_es_file_client.ts
index 755071d66328c7..f9ada86768c2fc 100644
--- a/src/plugins/files/server/file_client/create_es_file_client.ts
+++ b/src/plugins/files/server/file_client/create_es_file_client.ts
@@ -70,6 +70,7 @@ export function createEsFileClient(arg: CreateEsFileClientArgs): FileClient {
       id: NO_FILE_KIND,
       http: {},
       maxSizeBytes,
+      hashes: ['md5', 'sha1', 'sha256', 'sha512'],
     },
     new EsIndexFilesMetadataClient(metadataIndex, elasticsearchClient, logger, indexIsAlias),
     new ElasticsearchBlobStorageClient(
diff --git a/src/plugins/files/server/file_client/file_client.ts b/src/plugins/files/server/file_client/file_client.ts
index 3bce97f6bcade5..26dbc90a44b90f 100644
--- a/src/plugins/files/server/file_client/file_client.ts
+++ b/src/plugins/files/server/file_client/file_client.ts
@@ -40,6 +40,9 @@ import {
   withReportPerformanceMetric,
   FILE_DOWNLOAD_PERFORMANCE_EVENT_NAME,
 } from '../performance';
+import { createFileHashTransform } from './stream_transforms/file_hash_transform';
+import { isFileHashTransform } from './stream_transforms/file_hash_transform/file_hash_transform';
+import { SupportedFileHashAlgorithm } from '../saved_objects/file';
 
 export type UploadOptions = Omit<BlobUploadOptions, 'id'>;
 
@@ -216,8 +219,8 @@ export class FileClientImpl implements FileClient {
     file: FileJSON,
     rs: Readable,
     options?: UploadOptions
-  ): ReturnType<BlobStorageClient['upload']> => {
-    const { maxSizeBytes } = this.fileKindDescriptor;
+  ): Promise<UploadResult> => {
+    const { maxSizeBytes, hashes } = this.fileKindDescriptor;
     const { transforms = [], ...blobOptions } = options || {};
 
     let maxFileSize: number = typeof maxSizeBytes === 'number' ? maxSizeBytes : fourMiB;
@@ -231,11 +234,30 @@ export class FileClientImpl implements FileClient {
 
     transforms.push(enforceMaxByteSizeTransform(maxFileSize));
 
-    return this.blobStorageClient.upload(rs, {
+    if (hashes && hashes.length) {
+      for (const hash of hashes) {
+        transforms.push(createFileHashTransform(hash));
+      }
+    }
+
+    const uploadResult = await this.blobStorageClient.upload(rs, {
       ...blobOptions,
       transforms,
       id: file.id,
     });
+
+    const result: UploadResult = { ...uploadResult, hashes: [] };
+
+    if (transforms && transforms.length) {
+      for (const transform of transforms) {
+        if (isFileHashTransform(transform)) {
+          const fileHash = transform.getFileHash();
+          result.hashes.push(fileHash);
+        }
+      }
+    }
+
+    return result;
   };
 
   public download: BlobStorageClient['download'] = async (args) => {
@@ -300,3 +322,12 @@ export class FileClientImpl implements FileClient {
     return this.internalFileShareService.list(args);
   };
 }
+
+export interface UploadResult {
+  id: string;
+  size: number;
+  hashes: Array<{
+    algorithm: SupportedFileHashAlgorithm;
+    value: string;
+  }>;
+}
diff --git a/src/plugins/files/server/file_client/integration_tests/es_file_client.test.ts b/src/plugins/files/server/file_client/integration_tests/es_file_client.test.ts
index cbe80422e388bf..d4c6d268fa7dc5 100644
--- a/src/plugins/files/server/file_client/integration_tests/es_file_client.test.ts
+++ b/src/plugins/files/server/file_client/integration_tests/es_file_client.test.ts
@@ -97,6 +97,26 @@ describe('ES-index-backed file client', () => {
     await deleteFile({ id: file.id, hasContent: true });
   });
 
+  test('computes file hashes', async () => {
+    const file = await fileClient.create({
+      id: '123',
+      metadata: {
+        name: 'cool name',
+      },
+    });
+    await file.uploadContent(Readable.from([Buffer.from('test')]));
+
+    expect(file.toJSON().hash).toStrictEqual({
+      md5: '098f6bcd4621d373cade4e832627b4f6',
+      sha1: 'a94a8fe5ccb19ba61c4c0873d391e987982fbbd3',
+      sha256: '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08',
+      sha512:
+        'ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff',
+    });
+
+    await deleteFile({ id: file.id, hasContent: true });
+  });
+
   test('searches across files', async () => {
     const { id: id1 } = await fileClient.create({
       id: '123',
diff --git a/src/plugins/files/server/index.ts b/src/plugins/files/server/index.ts
index 181124fc27496e..f02a0164b1f69d 100755
--- a/src/plugins/files/server/index.ts
+++ b/src/plugins/files/server/index.ts
@@ -7,7 +7,6 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { FilesPlugin } from './plugin';
 
 export type {
   FileClient,
@@ -44,6 +43,7 @@ export type {
 } from './file_service';
 export type { FileServiceFactory } from './file_service/file_service_factory';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { FilesPlugin } = await import('./plugin');
   return new FilesPlugin(initializerContext);
 }
diff --git a/src/plugins/files/server/plugin.ts b/src/plugins/files/server/plugin.ts
index ba63e08b2ed211..9e608d8f38a596 100755
--- a/src/plugins/files/server/plugin.ts
+++ b/src/plugins/files/server/plugin.ts
@@ -139,6 +139,7 @@ export class FilesPlugin implements Plugin<FilesSetup, FilesStart, FilesPluginSe
         share: { tags: DefaultImageKind.tags },
         update: { tags: DefaultImageKind.tags },
       },
+      hashes: ['sha256'],
     });
   }
 }
diff --git a/src/plugins/ftr_apis/server/index.ts b/src/plugins/ftr_apis/server/index.ts
index 5c33f6c4a067a6..dfd8f08061931c 100644
--- a/src/plugins/ftr_apis/server/index.ts
+++ b/src/plugins/ftr_apis/server/index.ts
@@ -7,9 +7,9 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { FtrApisPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { FtrApisPlugin } = await import('./plugin');
   return new FtrApisPlugin(initializerContext);
 }
 
diff --git a/src/plugins/guided_onboarding/server/index.ts b/src/plugins/guided_onboarding/server/index.ts
index 823cc4daf35784..01d92ceaf46558 100755
--- a/src/plugins/guided_onboarding/server/index.ts
+++ b/src/plugins/guided_onboarding/server/index.ts
@@ -7,9 +7,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { GuidedOnboardingPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { GuidedOnboardingPlugin } = await import('./plugin');
   return new GuidedOnboardingPlugin(initializerContext);
 }
 
diff --git a/src/plugins/home/public/application/application.tsx b/src/plugins/home/public/application/application.tsx
index 1c28ff0b8fcee8..8458c0300fc75f 100644
--- a/src/plugins/home/public/application/application.tsx
+++ b/src/plugins/home/public/application/application.tsx
@@ -10,11 +10,9 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { ScopedHistory, CoreStart, CoreTheme } from '@kbn/core/public';
 import { Observable } from 'rxjs';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  RedirectAppLinks,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 import { SampleDataTabKibanaProvider } from '@kbn/home-sample-data-tab';
 
@@ -42,7 +40,11 @@ export const renderApp = async (
       .filter(({ id }) => navLinks.find(({ category, hidden }) => !hidden && category?.id === id));
 
     render(
-      <RedirectAppLinks application={coreStart.application}>
+      <RedirectAppLinks
+        coreStart={{
+          application: coreStart.application,
+        }}
+      >
         <KibanaThemeProvider theme$={theme$}>
           <KibanaContextProvider services={{ ...coreStart }}>
             <SampleDataTabKibanaProvider {...{ coreStart, dataViews, trackUiMetric }}>
diff --git a/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap b/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
index a2a43627c695d6..1b76a2d8536466 100644
--- a/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
+++ b/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
@@ -42,11 +42,13 @@ exports[`AddData render 1`] = `
           grow={false}
         >
           <RedirectAppLinks
-            application={
+            coreStart={
               Object {
-                "capabilities": Object {
-                  "navLinks": Object {
-                    "integrations": true,
+                "application": Object {
+                  "capabilities": Object {
+                    "navLinks": Object {
+                      "integrations": true,
+                    },
                   },
                 },
               }
diff --git a/src/plugins/home/public/application/components/add_data/add_data.tsx b/src/plugins/home/public/application/components/add_data/add_data.tsx
index 5440ad09d2c156..20e9d60ffc8723 100644
--- a/src/plugins/home/public/application/components/add_data/add_data.tsx
+++ b/src/plugins/home/public/application/components/add_data/add_data.tsx
@@ -22,7 +22,7 @@ import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { METRIC_TYPE } from '@kbn/analytics';
 import { ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { MoveData } from '../move_data';
 import { createAppNavigationHandler } from '../app_navigation_handler';
 import { getServices } from '../../kibana_services';
@@ -89,7 +89,11 @@ export const AddData: FC<Props> = ({ addBasePath, application, isDarkMode, isClo
                 </EuiFlexItem>
               )}
               <EuiFlexItem grow={false}>
-                <RedirectAppLinks application={application}>
+                <RedirectAppLinks
+                  coreStart={{
+                    application,
+                  }}
+                >
                   {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
                   <EuiButton
                     data-test-subj="homeAddData"
diff --git a/src/plugins/home/public/application/components/manage_data/__snapshots__/manage_data.test.tsx.snap b/src/plugins/home/public/application/components/manage_data/__snapshots__/manage_data.test.tsx.snap
index 9d9b35b1f88170..6dd3405ced866f 100644
--- a/src/plugins/home/public/application/components/manage_data/__snapshots__/manage_data.test.tsx.snap
+++ b/src/plugins/home/public/application/components/manage_data/__snapshots__/manage_data.test.tsx.snap
@@ -134,12 +134,14 @@ exports[`ManageData render 1`] = `
           grow={false}
         >
           <RedirectAppLinks
-            application={
+            coreStart={
               Object {
-                "capabilities": Object {
-                  "navLinks": Object {
-                    "dev_tools": true,
-                    "management": true,
+                "application": Object {
+                  "capabilities": Object {
+                    "navLinks": Object {
+                      "dev_tools": true,
+                      "management": true,
+                    },
                   },
                 },
               }
@@ -164,12 +166,14 @@ exports[`ManageData render 1`] = `
           grow={false}
         >
           <RedirectAppLinks
-            application={
+            coreStart={
               Object {
-                "capabilities": Object {
-                  "navLinks": Object {
-                    "dev_tools": true,
-                    "management": true,
+                "application": Object {
+                  "capabilities": Object {
+                    "navLinks": Object {
+                      "dev_tools": true,
+                      "management": true,
+                    },
                   },
                 },
               }
diff --git a/src/plugins/home/public/application/components/manage_data/manage_data.tsx b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
index 9ea508a9b871e4..cb64ab7dc09556 100644
--- a/src/plugins/home/public/application/components/manage_data/manage_data.tsx
+++ b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
@@ -12,7 +12,7 @@ import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { METRIC_TYPE } from '@kbn/analytics';
 import { ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { FeatureCatalogueEntry } from '../../../services';
 import { createAppNavigationHandler } from '../app_navigation_handler';
 import { Synopsis } from '../synopsis';
@@ -58,7 +58,11 @@ export const ManageData: FC<Props> = ({ addBasePath, application, features }) =>
                 {/* Check if both the Dev Tools UI and the Console UI are enabled. */}
                 {isDevToolsEnabled && consoleHref !== undefined ? (
                   <EuiFlexItem grow={false}>
-                    <RedirectAppLinks application={application}>
+                    <RedirectAppLinks
+                      coreStart={{
+                        application,
+                      }}
+                    >
                       <EuiButtonEmpty
                         data-test-subj="homeDevTools"
                         className="kbnOverviewPageHeader__actionButton"
@@ -77,7 +81,11 @@ export const ManageData: FC<Props> = ({ addBasePath, application, features }) =>
 
                 {isManagementEnabled ? (
                   <EuiFlexItem grow={false}>
-                    <RedirectAppLinks application={application}>
+                    <RedirectAppLinks
+                      coreStart={{
+                        application,
+                      }}
+                    >
                       <EuiButtonEmpty
                         data-test-subj="homeManage"
                         className="kbnOverviewPageHeader__actionButton"
diff --git a/src/plugins/home/server/index.ts b/src/plugins/home/server/index.ts
index d93f864fb7af4e..d1763b2833b3ee 100644
--- a/src/plugins/home/server/index.ts
+++ b/src/plugins/home/server/index.ts
@@ -23,7 +23,6 @@ export type {
   ScopedTutorialContextFactory,
 } from './services';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { HomeServerPlugin } from './plugin';
 import { configSchema, ConfigSchema } from '../config';
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
@@ -33,6 +32,9 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
 };
 
-export const plugin = (initContext: PluginInitializerContext) => new HomeServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { HomeServerPlugin } = await import('./plugin');
+  return new HomeServerPlugin(initContext);
+};
 
 export { INSTRUCTION_VARIANT } from '../common/instruction_variant';
diff --git a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
index e995510c99feef..f68036496914d2 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/index.ts
@@ -10,7 +10,7 @@ import path from 'path';
 import { i18n } from '@kbn/i18n';
 import { getSavedObjects } from './saved_objects';
 import { fieldMappings } from './field_mappings';
-import { SampleDatasetSchema } from '../../lib/sample_dataset_registry_types';
+import { SampleDatasetProvider } from '../../lib/sample_dataset_registry_types';
 
 const ecommerceName = i18n.translate('home.sampleData.ecommerceSpecTitle', {
   defaultMessage: 'Sample eCommerce orders',
@@ -19,14 +19,17 @@ const ecommerceDescription = i18n.translate('home.sampleData.ecommerceSpecDescri
   defaultMessage: 'Sample data, visualizations, and dashboards for tracking eCommerce orders.',
 });
 
-export const ecommerceSpecProvider = function (): SampleDatasetSchema {
+export const ecommerceSpecProvider: SampleDatasetProvider = ({ staticAssets }) => {
   return {
     id: 'ecommerce',
     name: ecommerceName,
     description: ecommerceDescription,
-    previewImagePath: '/plugins/home/assets/sample_data_resources/ecommerce/dashboard.webp',
-    darkPreviewImagePath:
-      '/plugins/home/assets/sample_data_resources/ecommerce/dashboard_dark.webp',
+    previewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/ecommerce/dashboard.webp'
+    ),
+    darkPreviewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/ecommerce/dashboard_dark.webp'
+    ),
     overviewDashboard: '722b74f0-b882-11e8-a6d9-e546fe2bba5f',
     defaultIndex: 'ff959d40-b880-11e8-a6d9-e546fe2bba5f',
     savedObjects: getSavedObjects(),
@@ -41,6 +44,6 @@ export const ecommerceSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
-    iconPath: '/plugins/home/assets/sample_data_resources/ecommerce/icon.svg',
+    iconPath: staticAssets.getPluginAssetHref('/sample_data_resources/ecommerce/icon.svg'),
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts b/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
index 691ac8334cbc3a..7481f4cd507217 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/flights/index.ts
@@ -10,7 +10,7 @@ import path from 'path';
 import { i18n } from '@kbn/i18n';
 import { getSavedObjects } from './saved_objects';
 import { fieldMappings } from './field_mappings';
-import { SampleDatasetSchema } from '../../lib/sample_dataset_registry_types';
+import { SampleDatasetProvider } from '../../lib/sample_dataset_registry_types';
 
 const flightsName = i18n.translate('home.sampleData.flightsSpecTitle', {
   defaultMessage: 'Sample flight data',
@@ -19,13 +19,17 @@ const flightsDescription = i18n.translate('home.sampleData.flightsSpecDescriptio
   defaultMessage: 'Sample data, visualizations, and dashboards for monitoring flight routes.',
 });
 
-export const flightsSpecProvider = function (): SampleDatasetSchema {
+export const flightsSpecProvider: SampleDatasetProvider = ({ staticAssets }) => {
   return {
     id: 'flights',
     name: flightsName,
     description: flightsDescription,
-    previewImagePath: '/plugins/home/assets/sample_data_resources/flights/dashboard.webp',
-    darkPreviewImagePath: '/plugins/home/assets/sample_data_resources/flights/dashboard_dark.webp',
+    previewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/flights/dashboard.webp'
+    ),
+    darkPreviewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/flights/dashboard_dark.webp'
+    ),
     overviewDashboard: '7adfa750-4c81-11e8-b3d7-01146121b73d',
     defaultIndex: 'd3d7af60-4c81-11e8-b3d7-01146121b73d',
     savedObjects: getSavedObjects(),
@@ -40,6 +44,6 @@ export const flightsSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
-    iconPath: '/plugins/home/assets/sample_data_resources/flights/icon.svg',
+    iconPath: staticAssets.getPluginAssetHref('/sample_data_resources/flights/icon.svg'),
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts b/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
index 219b7ea2cc9d05..6f001e85c6151b 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/logs/index.ts
@@ -10,7 +10,7 @@ import path from 'path';
 import { i18n } from '@kbn/i18n';
 import { getSavedObjects } from './saved_objects';
 import { fieldMappings } from './field_mappings';
-import { SampleDatasetSchema } from '../../lib/sample_dataset_registry_types';
+import { SampleDatasetProvider } from '../../lib/sample_dataset_registry_types';
 
 const logsName = i18n.translate('home.sampleData.logsSpecTitle', {
   defaultMessage: 'Sample web logs',
@@ -20,13 +20,15 @@ const logsDescription = i18n.translate('home.sampleData.logsSpecDescription', {
 });
 
 export const GLOBE_ICON_PATH = '/plugins/home/assets/sample_data_resources/logs/icon.svg';
-export const logsSpecProvider = function (): SampleDatasetSchema {
+export const logsSpecProvider: SampleDatasetProvider = ({ staticAssets }) => {
   return {
     id: 'logs',
     name: logsName,
     description: logsDescription,
-    previewImagePath: '/plugins/home/assets/sample_data_resources/logs/dashboard.webp',
-    darkPreviewImagePath: '/plugins/home/assets/sample_data_resources/logs/dashboard_dark.webp',
+    previewImagePath: staticAssets.getPluginAssetHref('/sample_data_resources/logs/dashboard.webp'),
+    darkPreviewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/logs/dashboard_dark.webp'
+    ),
     overviewDashboard: 'edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b',
     defaultIndex: '90943e30-9a47-11e8-b64d-95841ca0b247',
     savedObjects: getSavedObjects(),
@@ -42,6 +44,6 @@ export const logsSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
-    iconPath: GLOBE_ICON_PATH,
+    iconPath: staticAssets.getPluginAssetHref('/sample_data_resources/logs/icon.svg'),
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/data_sets/logs_tsdb/index.ts b/src/plugins/home/server/services/sample_data/data_sets/logs_tsdb/index.ts
index bfc4ec45541911..39dc153eb2b196 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/logs_tsdb/index.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/logs_tsdb/index.ts
@@ -10,7 +10,7 @@ import path from 'path';
 import { i18n } from '@kbn/i18n';
 import { getSavedObjects } from './saved_objects';
 import { fieldMappings } from './field_mappings';
-import { SampleDatasetSchema } from '../../lib/sample_dataset_registry_types';
+import { SampleDatasetProvider } from '../../lib/sample_dataset_registry_types';
 
 const logsName = i18n.translate('home.sampleData.logsTsdbSpecTitle', {
   defaultMessage: 'Sample web logs (TSDB)',
@@ -20,7 +20,7 @@ const logsDescription = i18n.translate('home.sampleData.logsTsdbSpecDescription'
 });
 
 export const GLOBE_ICON_PATH = '/plugins/home/assets/sample_data_resources/logs/icon.svg';
-export const logsTSDBSpecProvider = function (): SampleDatasetSchema {
+export const logsTSDBSpecProvider: SampleDatasetProvider = ({ staticAssets }) => {
   const startDate = new Date();
   const endDate = new Date();
   startDate.setMonth(startDate.getMonth() - 1);
@@ -29,8 +29,10 @@ export const logsTSDBSpecProvider = function (): SampleDatasetSchema {
     id: 'logstsdb',
     name: logsName,
     description: logsDescription,
-    previewImagePath: '/plugins/home/assets/sample_data_resources/logs/dashboard.webp',
-    darkPreviewImagePath: '/plugins/home/assets/sample_data_resources/logs/dashboard_dark.webp',
+    previewImagePath: staticAssets.getPluginAssetHref('/sample_data_resources/logs/dashboard.webp'),
+    darkPreviewImagePath: staticAssets.getPluginAssetHref(
+      '/sample_data_resources/logs/dashboard_dark.webp'
+    ),
     overviewDashboard: 'edf84fe0-e1a0-11e7-b6d5-4dc382ef8f5b',
     defaultIndex: '90943e30-9a47-11e8-b64d-95841ca0c247',
     savedObjects: getSavedObjects(),
@@ -53,6 +55,6 @@ export const logsTSDBSpecProvider = function (): SampleDatasetSchema {
       },
     ],
     status: 'not_installed',
-    iconPath: GLOBE_ICON_PATH,
+    iconPath: staticAssets.getPluginAssetHref('/sample_data_resources/logs/icon.svg'),
   };
 };
diff --git a/src/plugins/home/server/services/sample_data/lib/sample_dataset_registry_types.ts b/src/plugins/home/server/services/sample_data/lib/sample_dataset_registry_types.ts
index 9b1212e13b0245..eb248cc4d40786 100644
--- a/src/plugins/home/server/services/sample_data/lib/sample_dataset_registry_types.ts
+++ b/src/plugins/home/server/services/sample_data/lib/sample_dataset_registry_types.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import type { IStaticAssets } from '@kbn/core/server';
 import type { SampleDatasetSchema } from './sample_dataset_schema';
 export type { SampleDatasetSchema, DataIndexSchema } from './sample_dataset_schema';
 
@@ -27,7 +28,11 @@ export enum EmbeddableTypes {
   SEARCH_EMBEDDABLE_TYPE = 'search',
   VISUALIZE_EMBEDDABLE_TYPE = 'visualization',
 }
-export type SampleDatasetProvider = () => SampleDatasetSchema;
+
+export interface SampleDatasetProviderContext {
+  staticAssets: IStaticAssets;
+}
+export type SampleDatasetProvider = (context: SampleDatasetProviderContext) => SampleDatasetSchema;
 
 /** This type is used to identify an object in a sample dataset. */
 export interface SampleObject {
diff --git a/src/plugins/home/server/services/sample_data/sample_data_registry.ts b/src/plugins/home/server/services/sample_data/sample_data_registry.ts
index 47ddc122f82cb9..1f96cbe20def2e 100644
--- a/src/plugins/home/server/services/sample_data/sample_data_registry.ts
+++ b/src/plugins/home/server/services/sample_data/sample_data_registry.ts
@@ -15,6 +15,7 @@ import {
   SampleDatasetSchema,
   SampleDatasetDashboardPanel,
   AppLinkData,
+  SampleDatasetProviderContext,
 } from './lib/sample_dataset_registry_types';
 import { sampleDataSchema } from './lib/sample_dataset_schema';
 
@@ -34,11 +35,15 @@ export class SampleDataRegistry {
 
   private readonly sampleDatasets: SampleDatasetSchema[] = [];
   private readonly appLinksMap = new Map<string, AppLinkData[]>();
+  private sampleDataProviderContext?: SampleDatasetProviderContext;
 
   private registerSampleDataSet(specProvider: SampleDatasetProvider) {
+    if (!this.sampleDataProviderContext) {
+      throw new Error('#registerSampleDataSet called before #setup');
+    }
     let value: SampleDatasetSchema;
     try {
-      value = sampleDataSchema.validate(specProvider());
+      value = sampleDataSchema.validate(specProvider(this.sampleDataProviderContext));
     } catch (error) {
       throw new Error(`Unable to register sample dataset spec because it's invalid. ${error}`);
     }
@@ -83,6 +88,10 @@ export class SampleDataRegistry {
     createInstallRoute(router, this.sampleDatasets, logger, usageTracker, core.analytics);
     createUninstallRoute(router, this.sampleDatasets, logger, usageTracker, core.analytics);
 
+    this.sampleDataProviderContext = {
+      staticAssets: core.http.staticAssets,
+    };
+
     this.registerSampleDataSet(flightsSpecProvider);
     this.registerSampleDataSet(logsSpecProvider);
     this.registerSampleDataSet(ecommerceSpecProvider);
diff --git a/src/plugins/home/server/services/tutorials/lib/tutorials_registry_types.ts b/src/plugins/home/server/services/tutorials/lib/tutorials_registry_types.ts
index f0746764f46411..dd625c60867170 100644
--- a/src/plugins/home/server/services/tutorials/lib/tutorials_registry_types.ts
+++ b/src/plugins/home/server/services/tutorials/lib/tutorials_registry_types.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import type { KibanaRequest } from '@kbn/core/server';
+import type { KibanaRequest, IStaticAssets } from '@kbn/core/server';
 import type { TutorialSchema } from './tutorial_schema';
 export { TutorialsCategory } from '../../../../common/constants';
 
@@ -25,6 +25,7 @@ export type Platform = 'WINDOWS' | 'OSX' | 'DEB' | 'RPM';
 
 export interface TutorialContext {
   kibanaBranch: string;
+  staticAssets: IStaticAssets;
   [key: string]: unknown;
 }
 export type TutorialProvider = (context: TutorialContext) => TutorialSchema;
diff --git a/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts b/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
index 5a8c6dc55bda46..c8d9fa9d27aec2 100644
--- a/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
+++ b/src/plugins/home/server/services/tutorials/tutorials_registry.test.ts
@@ -166,10 +166,9 @@ describe('TutorialsRegistry', () => {
 
   describe('start', () => {
     test('exposes proper contract', () => {
-      const start = new TutorialsRegistry(mockInitContext).start(
-        coreMock.createStart(),
-        mockCustomIntegrationsPluginSetup
-      );
+      const registry = new TutorialsRegistry(mockInitContext);
+      registry.setup(mockCoreSetup, mockCustomIntegrationsPluginSetup);
+      const start = registry.start(coreMock.createStart(), mockCustomIntegrationsPluginSetup);
       expect(start).toBeDefined();
     });
   });
diff --git a/src/plugins/home/server/services/tutorials/tutorials_registry.ts b/src/plugins/home/server/services/tutorials/tutorials_registry.ts
index 0ef800f63228bb..eb3c6e931ff601 100644
--- a/src/plugins/home/server/services/tutorials/tutorials_registry.ts
+++ b/src/plugins/home/server/services/tutorials/tutorials_registry.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { CoreSetup, CoreStart, PluginInitializerContext } from '@kbn/core/server';
+import { CoreSetup, CoreStart, PluginInitializerContext, IStaticAssets } from '@kbn/core/server';
 import { CustomIntegrationsPluginSetup } from '@kbn/custom-integrations-plugin/server';
 import { IntegrationCategory } from '@kbn/custom-integrations-plugin/common';
 import {
@@ -71,10 +71,13 @@ function registerBeatsTutorialsWithCustomIntegrations(
 export class TutorialsRegistry {
   private tutorialProviders: TutorialProvider[] = []; // pre-register all the tutorials we know we want in here
   private readonly scopedTutorialContextFactories: TutorialContextFactory[] = [];
+  private staticAssets!: IStaticAssets;
 
   constructor(private readonly initContext: PluginInitializerContext) {}
 
   public setup(core: CoreSetup, customIntegrations?: CustomIntegrationsPluginSetup) {
+    this.staticAssets = core.http.staticAssets;
+
     const router = core.http.createRouter();
     router.get(
       { path: '/api/kibana/home/tutorials', validate: false },
@@ -143,7 +146,10 @@ export class TutorialsRegistry {
   }
 
   private get baseTutorialContext(): TutorialContext {
-    return { kibanaBranch: this.initContext.env.packageInfo.branch };
+    return {
+      kibanaBranch: this.initContext.env.packageInfo.branch,
+      staticAssets: this.staticAssets,
+    };
   }
 }
 
diff --git a/src/plugins/home/server/tutorials/activemq_logs/index.ts b/src/plugins/home/server/tutorials/activemq_logs/index.ts
index af1a79e445fd8a..b152d760bd60f9 100644
--- a/src/plugins/home/server/tutorials/activemq_logs/index.ts
+++ b/src/plugins/home/server/tutorials/activemq_logs/index.ts
@@ -38,7 +38,7 @@ export function activemqLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-activemq.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/activemq.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/activemq.svg'),
     artifacts: {
       dashboards: [
         {
@@ -54,7 +54,7 @@ export function activemqLogsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/activemq_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/activemq_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/activemq_metrics/index.ts b/src/plugins/home/server/tutorials/activemq_metrics/index.ts
index c5c68ba0fe0eae..a255a85fa69601 100644
--- a/src/plugins/home/server/tutorials/activemq_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/activemq_metrics/index.ts
@@ -38,7 +38,7 @@ export function activemqMetricsSpecProvider(context: TutorialContext): TutorialS
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-activemq.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/activemq.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/activemq.svg'),
     isBeta: true,
     artifacts: {
       application: {
diff --git a/src/plugins/home/server/tutorials/apache_logs/index.ts b/src/plugins/home/server/tutorials/apache_logs/index.ts
index 2d729daefdc658..3bd77f587f09d8 100644
--- a/src/plugins/home/server/tutorials/apache_logs/index.ts
+++ b/src/plugins/home/server/tutorials/apache_logs/index.ts
@@ -55,7 +55,7 @@ export function apacheLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/apache_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/apache_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/apache_metrics/index.ts b/src/plugins/home/server/tutorials/apache_metrics/index.ts
index 114483f7414de4..a021401890503c 100644
--- a/src/plugins/home/server/tutorials/apache_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/apache_metrics/index.ts
@@ -54,7 +54,7 @@ export function apacheMetricsSpecProvider(context: TutorialContext): TutorialSch
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/apache_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/apache_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/auditbeat/index.ts b/src/plugins/home/server/tutorials/auditbeat/index.ts
index e315398578781b..fe9928ff368bb3 100644
--- a/src/plugins/home/server/tutorials/auditbeat/index.ts
+++ b/src/plugins/home/server/tutorials/auditbeat/index.ts
@@ -54,7 +54,7 @@ processes, users, logins, sockets information, file accesses, and more. \
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/auditbeat/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/auditbeat/screenshot.webp'),
     onPrem: onPremInstructions(platforms, context),
     elasticCloud: cloudInstructions(platforms, context),
     onPremElasticCloud: onPremCloudInstructions(platforms, context),
diff --git a/src/plugins/home/server/tutorials/auditd_logs/index.ts b/src/plugins/home/server/tutorials/auditd_logs/index.ts
index 383eb46d83a7a9..438e847efe3371 100644
--- a/src/plugins/home/server/tutorials/auditd_logs/index.ts
+++ b/src/plugins/home/server/tutorials/auditd_logs/index.ts
@@ -39,7 +39,7 @@ export function auditdLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-auditd.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/linux.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/linux.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function auditdLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/auditd_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/auditd_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/aws_logs/index.ts b/src/plugins/home/server/tutorials/aws_logs/index.ts
index dd20d8d282f104..e8c178c040ad33 100644
--- a/src/plugins/home/server/tutorials/aws_logs/index.ts
+++ b/src/plugins/home/server/tutorials/aws_logs/index.ts
@@ -55,7 +55,7 @@ export function awsLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/aws_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/aws_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/aws_metrics/index.ts b/src/plugins/home/server/tutorials/aws_metrics/index.ts
index cdc4a3970b426c..d5bf865b79026e 100644
--- a/src/plugins/home/server/tutorials/aws_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/aws_metrics/index.ts
@@ -56,7 +56,7 @@ export function awsMetricsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/aws_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/aws_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/azure_logs/index.ts b/src/plugins/home/server/tutorials/azure_logs/index.ts
index 8efa2cea888ec7..62f75a3eb05374 100644
--- a/src/plugins/home/server/tutorials/azure_logs/index.ts
+++ b/src/plugins/home/server/tutorials/azure_logs/index.ts
@@ -56,7 +56,7 @@ export function azureLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/azure_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/azure_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/azure_metrics/index.ts b/src/plugins/home/server/tutorials/azure_metrics/index.ts
index 32f9840b9ed651..59492f6704ac85 100644
--- a/src/plugins/home/server/tutorials/azure_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/azure_metrics/index.ts
@@ -55,7 +55,7 @@ export function azureMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/azure_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/azure_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/barracuda_logs/index.ts b/src/plugins/home/server/tutorials/barracuda_logs/index.ts
index 70daca5656a66c..d91b77495dca2f 100644
--- a/src/plugins/home/server/tutorials/barracuda_logs/index.ts
+++ b/src/plugins/home/server/tutorials/barracuda_logs/index.ts
@@ -40,7 +40,7 @@ export function barracudaLogsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-barracuda.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/barracuda.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/barracuda.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/checkpoint_logs/index.ts b/src/plugins/home/server/tutorials/checkpoint_logs/index.ts
index 3fa333c218396f..bd7457f0157f54 100644
--- a/src/plugins/home/server/tutorials/checkpoint_logs/index.ts
+++ b/src/plugins/home/server/tutorials/checkpoint_logs/index.ts
@@ -39,7 +39,7 @@ export function checkpointLogsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-checkpoint.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/checkpoint.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/checkpoint.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/cisco_logs/index.ts b/src/plugins/home/server/tutorials/cisco_logs/index.ts
index 098819c14297fa..c125c283702d9c 100644
--- a/src/plugins/home/server/tutorials/cisco_logs/index.ts
+++ b/src/plugins/home/server/tutorials/cisco_logs/index.ts
@@ -39,7 +39,7 @@ export function ciscoLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-cisco.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/cisco.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/cisco.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function ciscoLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/cisco_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/cisco_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/cockroachdb_metrics/index.ts b/src/plugins/home/server/tutorials/cockroachdb_metrics/index.ts
index 1d5cbd95d67f5b..14c1d2c1b9c198 100644
--- a/src/plugins/home/server/tutorials/cockroachdb_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/cockroachdb_metrics/index.ts
@@ -38,7 +38,7 @@ export function cockroachdbMetricsSpecProvider(context: TutorialContext): Tutori
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-cockroachdb.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/cockroachdb.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/cockroachdb.svg'),
     artifacts: {
       dashboards: [
         {
@@ -57,7 +57,9 @@ export function cockroachdbMetricsSpecProvider(context: TutorialContext): Tutori
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/cockroachdb_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref(
+      '/cockroachdb_metrics/screenshot.webp'
+    ),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/consul_metrics/index.ts b/src/plugins/home/server/tutorials/consul_metrics/index.ts
index bc1d1b6f1d1ea0..64b7cb80e8813c 100644
--- a/src/plugins/home/server/tutorials/consul_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/consul_metrics/index.ts
@@ -38,7 +38,7 @@ export function consulMetricsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-consul.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/consul.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/consul.svg'),
     artifacts: {
       dashboards: [
         {
@@ -54,7 +54,7 @@ export function consulMetricsSpecProvider(context: TutorialContext): TutorialSch
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/consul_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/consul_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/coredns_logs/index.ts b/src/plugins/home/server/tutorials/coredns_logs/index.ts
index fedea213c00872..a740144e074004 100644
--- a/src/plugins/home/server/tutorials/coredns_logs/index.ts
+++ b/src/plugins/home/server/tutorials/coredns_logs/index.ts
@@ -39,7 +39,7 @@ export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-coredns.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/coredns.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/coredns.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchem
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/coredns_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/coredns_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/coredns_metrics/index.ts b/src/plugins/home/server/tutorials/coredns_metrics/index.ts
index b3e5de7fb58a87..82f1205971aac6 100644
--- a/src/plugins/home/server/tutorials/coredns_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/coredns_metrics/index.ts
@@ -38,7 +38,7 @@ export function corednsMetricsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-coredns.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/coredns.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/coredns.svg'),
     artifacts: {
       application: {
         label: i18n.translate('home.tutorials.corednsMetrics.artifacts.application.label', {
@@ -52,7 +52,7 @@ export function corednsMetricsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/coredns_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/coredns_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/couchdb_metrics/index.ts b/src/plugins/home/server/tutorials/couchdb_metrics/index.ts
index 59f8431fe6a085..c63d9a045f5908 100644
--- a/src/plugins/home/server/tutorials/couchdb_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/couchdb_metrics/index.ts
@@ -38,7 +38,7 @@ export function couchdbMetricsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-couchdb.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/couchdb.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/couchdb.svg'),
     artifacts: {
       dashboards: [
         {
@@ -57,7 +57,7 @@ export function couchdbMetricsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/couchdb_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/couchdb_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts b/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts
index f55d84e7b58c94..566624d8252b1d 100644
--- a/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts
+++ b/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts
@@ -43,7 +43,7 @@ export function crowdstrikeLogsSpecProvider(context: TutorialContext): TutorialS
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-crowdstrike.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/crowdstrike.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/crowdstrike.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/cylance_logs/index.ts b/src/plugins/home/server/tutorials/cylance_logs/index.ts
index 805391dc4d3640..e1781fa69df5dc 100644
--- a/src/plugins/home/server/tutorials/cylance_logs/index.ts
+++ b/src/plugins/home/server/tutorials/cylance_logs/index.ts
@@ -39,7 +39,7 @@ export function cylanceLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-cylance.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/cylance.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/cylance.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/docker_metrics/index.ts b/src/plugins/home/server/tutorials/docker_metrics/index.ts
index 180723079acba1..6f683c7eb9b77f 100644
--- a/src/plugins/home/server/tutorials/docker_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/docker_metrics/index.ts
@@ -54,7 +54,7 @@ export function dockerMetricsSpecProvider(context: TutorialContext): TutorialSch
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/docker_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/docker_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts b/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts
index bdcc65ead41825..1763a434d49063 100644
--- a/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts
+++ b/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts
@@ -54,7 +54,9 @@ export function elasticsearchLogsSpecProvider(context: TutorialContext): Tutoria
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/elasticsearch_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref(
+      '/elasticsearch_logs/screenshot.webp'
+    ),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts b/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts
index 06f0587e1021d8..aa071297ed9782 100644
--- a/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts
+++ b/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts
@@ -39,7 +39,7 @@ export function envoyproxyLogsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-envoyproxy.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/envoyproxy.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/envoyproxy.svg'),
     artifacts: {
       dashboards: [
         {
@@ -58,7 +58,7 @@ export function envoyproxyLogsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/envoyproxy_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/envoyproxy_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/envoyproxy_metrics/index.ts b/src/plugins/home/server/tutorials/envoyproxy_metrics/index.ts
index 03bc5d13baf9c1..8c4396ff90ba03 100644
--- a/src/plugins/home/server/tutorials/envoyproxy_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/envoyproxy_metrics/index.ts
@@ -38,7 +38,7 @@ export function envoyproxyMetricsSpecProvider(context: TutorialContext): Tutoria
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-envoyproxy.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/envoyproxy.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/envoyproxy.svg'),
     artifacts: {
       dashboards: [],
       exportedFields: {
diff --git a/src/plugins/home/server/tutorials/f5_logs/index.ts b/src/plugins/home/server/tutorials/f5_logs/index.ts
index ae596b52a538b9..e79018c6b58e44 100644
--- a/src/plugins/home/server/tutorials/f5_logs/index.ts
+++ b/src/plugins/home/server/tutorials/f5_logs/index.ts
@@ -39,7 +39,7 @@ export function f5LogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-f5.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/f5.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/f5.svg'),
     artifacts: {
       dashboards: [],
       application: {
@@ -53,7 +53,7 @@ export function f5LogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/f5_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/f5_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/fortinet_logs/index.ts b/src/plugins/home/server/tutorials/fortinet_logs/index.ts
index 32338480fb0099..4128f7460b90d5 100644
--- a/src/plugins/home/server/tutorials/fortinet_logs/index.ts
+++ b/src/plugins/home/server/tutorials/fortinet_logs/index.ts
@@ -39,7 +39,7 @@ export function fortinetLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-fortinet.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/fortinet.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/fortinet.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/gcp_logs/index.ts b/src/plugins/home/server/tutorials/gcp_logs/index.ts
index 6c33ac1fbaa0b0..bc0fa1de8184e9 100644
--- a/src/plugins/home/server/tutorials/gcp_logs/index.ts
+++ b/src/plugins/home/server/tutorials/gcp_logs/index.ts
@@ -57,7 +57,7 @@ export function gcpLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/gcp_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/gcp_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/gcp_metrics/index.ts b/src/plugins/home/server/tutorials/gcp_metrics/index.ts
index 649fd54dbde52c..4b9fc9c23e7907 100644
--- a/src/plugins/home/server/tutorials/gcp_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/gcp_metrics/index.ts
@@ -55,7 +55,7 @@ export function gcpMetricsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/gcp_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/gcp_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/haproxy_logs/index.ts b/src/plugins/home/server/tutorials/haproxy_logs/index.ts
index 6d83b9c5449949..4cfa85570d8f52 100644
--- a/src/plugins/home/server/tutorials/haproxy_logs/index.ts
+++ b/src/plugins/home/server/tutorials/haproxy_logs/index.ts
@@ -55,7 +55,7 @@ export function haproxyLogsSpecProvider(context: TutorialContext): TutorialSchem
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/haproxy_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/haproxy_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/ibmmq_logs/index.ts b/src/plugins/home/server/tutorials/ibmmq_logs/index.ts
index fd3327a555b41b..0ca37ece3584ca 100644
--- a/src/plugins/home/server/tutorials/ibmmq_logs/index.ts
+++ b/src/plugins/home/server/tutorials/ibmmq_logs/index.ts
@@ -38,7 +38,7 @@ export function ibmmqLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-ibmmq.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/ibmmq.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/ibmmq.svg'),
     artifacts: {
       dashboards: [
         {
@@ -54,7 +54,7 @@ export function ibmmqLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/ibmmq_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/ibmmq_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/ibmmq_metrics/index.ts b/src/plugins/home/server/tutorials/ibmmq_metrics/index.ts
index 6b81919ce28149..b6411f1b0bff1f 100644
--- a/src/plugins/home/server/tutorials/ibmmq_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/ibmmq_metrics/index.ts
@@ -38,7 +38,7 @@ export function ibmmqMetricsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-ibmmq.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/ibmmq.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/ibmmq.svg'),
     isBeta: true,
     artifacts: {
       application: {
@@ -53,7 +53,7 @@ export function ibmmqMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/ibmmq_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/ibmmq_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/icinga_logs/index.ts b/src/plugins/home/server/tutorials/icinga_logs/index.ts
index b8d51b1a1809fd..c1cf3085434292 100644
--- a/src/plugins/home/server/tutorials/icinga_logs/index.ts
+++ b/src/plugins/home/server/tutorials/icinga_logs/index.ts
@@ -39,7 +39,7 @@ export function icingaLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-icinga.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/icinga.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/icinga.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function icingaLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/icinga_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/icinga_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/iis_logs/index.ts b/src/plugins/home/server/tutorials/iis_logs/index.ts
index 1b7af958d4f9e3..1ce2657b509233 100644
--- a/src/plugins/home/server/tutorials/iis_logs/index.ts
+++ b/src/plugins/home/server/tutorials/iis_logs/index.ts
@@ -40,7 +40,7 @@ export function iisLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-iis.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/iis.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/iis.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ export function iisLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/iis_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/iis_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/iis_metrics/index.ts b/src/plugins/home/server/tutorials/iis_metrics/index.ts
index 68f167c7be04d9..052b90c0719bbf 100644
--- a/src/plugins/home/server/tutorials/iis_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/iis_metrics/index.ts
@@ -39,7 +39,7 @@ export function iisMetricsSpecProvider(context: TutorialContext): TutorialSchema
       },
     }),
     isBeta: true,
-    euiIconType: '/plugins/home/assets/logos/iis.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/iis.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function iisMetricsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/iis_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/iis_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/infoblox_logs/index.ts b/src/plugins/home/server/tutorials/infoblox_logs/index.ts
index ad82d25993dcad..f86ccbf0084b6c 100644
--- a/src/plugins/home/server/tutorials/infoblox_logs/index.ts
+++ b/src/plugins/home/server/tutorials/infoblox_logs/index.ts
@@ -39,7 +39,7 @@ export function infobloxLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-infoblox.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/infoblox.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/infoblox.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/iptables_logs/index.ts b/src/plugins/home/server/tutorials/iptables_logs/index.ts
index 082b0a239714a3..856a8b03314820 100644
--- a/src/plugins/home/server/tutorials/iptables_logs/index.ts
+++ b/src/plugins/home/server/tutorials/iptables_logs/index.ts
@@ -42,7 +42,7 @@ export function iptablesLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-iptables.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/linux.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/linux.svg'),
     artifacts: {
       dashboards: [
         {
@@ -58,7 +58,7 @@ export function iptablesLogsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/iptables_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/iptables_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/juniper_logs/index.ts b/src/plugins/home/server/tutorials/juniper_logs/index.ts
index a6d34d1e8447f7..04d2e708aeab34 100644
--- a/src/plugins/home/server/tutorials/juniper_logs/index.ts
+++ b/src/plugins/home/server/tutorials/juniper_logs/index.ts
@@ -39,7 +39,7 @@ export function juniperLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-juniper.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/juniper.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/juniper.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/kafka_logs/index.ts b/src/plugins/home/server/tutorials/kafka_logs/index.ts
index cb78ffbaeaea71..a4918995965c60 100644
--- a/src/plugins/home/server/tutorials/kafka_logs/index.ts
+++ b/src/plugins/home/server/tutorials/kafka_logs/index.ts
@@ -55,7 +55,7 @@ export function kafkaLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/kafka_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/kafka_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/kubernetes_metrics/index.ts b/src/plugins/home/server/tutorials/kubernetes_metrics/index.ts
index bb40e88e7541db..6db2731349e238 100644
--- a/src/plugins/home/server/tutorials/kubernetes_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/kubernetes_metrics/index.ts
@@ -57,7 +57,9 @@ export function kubernetesMetricsSpecProvider(context: TutorialContext): Tutoria
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/kubernetes_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref(
+      '/kubernetes_metrics/screenshot.webp'
+    ),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/microsoft_logs/index.ts b/src/plugins/home/server/tutorials/microsoft_logs/index.ts
index fc8926df084203..bc7eb73f606250 100644
--- a/src/plugins/home/server/tutorials/microsoft_logs/index.ts
+++ b/src/plugins/home/server/tutorials/microsoft_logs/index.ts
@@ -39,7 +39,7 @@ export function microsoftLogsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-microsoft.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/microsoft.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/microsoft.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function microsoftLogsSpecProvider(context: TutorialContext): TutorialSch
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/microsoft_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/microsoft_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/misp_logs/index.ts b/src/plugins/home/server/tutorials/misp_logs/index.ts
index 7cb31f8db3a461..3fcd6f35faae93 100644
--- a/src/plugins/home/server/tutorials/misp_logs/index.ts
+++ b/src/plugins/home/server/tutorials/misp_logs/index.ts
@@ -39,7 +39,7 @@ export function mispLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-misp.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/misp.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/misp.svg'),
     artifacts: {
       dashboards: [
         {
@@ -55,7 +55,7 @@ export function mispLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/misp_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/misp_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/mongodb_logs/index.ts b/src/plugins/home/server/tutorials/mongodb_logs/index.ts
index 3f2618d15c8449..4cd48e2af715cd 100644
--- a/src/plugins/home/server/tutorials/mongodb_logs/index.ts
+++ b/src/plugins/home/server/tutorials/mongodb_logs/index.ts
@@ -55,7 +55,7 @@ export function mongodbLogsSpecProvider(context: TutorialContext): TutorialSchem
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/mongodb_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/mongodb_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/mongodb_metrics/index.ts b/src/plugins/home/server/tutorials/mongodb_metrics/index.ts
index c4b56cef60d17b..441ede88c5c380 100644
--- a/src/plugins/home/server/tutorials/mongodb_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/mongodb_metrics/index.ts
@@ -57,7 +57,7 @@ export function mongodbMetricsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/mongodb_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/mongodb_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/mssql_logs/index.ts b/src/plugins/home/server/tutorials/mssql_logs/index.ts
index 2add9281860bd2..ab8363afd25b69 100644
--- a/src/plugins/home/server/tutorials/mssql_logs/index.ts
+++ b/src/plugins/home/server/tutorials/mssql_logs/index.ts
@@ -39,7 +39,7 @@ export function mssqlLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-mssql.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/microsoft.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/microsoft.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/mssql_metrics/index.ts b/src/plugins/home/server/tutorials/mssql_metrics/index.ts
index 5dd6bca41a812c..33091b6b04504f 100644
--- a/src/plugins/home/server/tutorials/mssql_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/mssql_metrics/index.ts
@@ -38,7 +38,7 @@ export function mssqlMetricsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-mssql.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/mssql.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/mssql.svg'),
     isBeta: false,
     artifacts: {
       dashboards: [
@@ -55,7 +55,7 @@ export function mssqlMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/mssql_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/mssql_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/munin_metrics/index.ts b/src/plugins/home/server/tutorials/munin_metrics/index.ts
index 1e3e091ab0b8e1..aa9ba8e72ddd39 100644
--- a/src/plugins/home/server/tutorials/munin_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/munin_metrics/index.ts
@@ -26,7 +26,7 @@ export function muninMetricsSpecProvider(context: TutorialContext): TutorialSche
       defaultMessage: 'Munin Metrics',
     }),
     moduleName,
-    euiIconType: '/plugins/home/assets/logos/munin.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/munin.svg'),
     isBeta: true,
     category: TutorialsCategory.METRICS,
     shortDescription: i18n.translate('home.tutorials.muninMetrics.shortDescription', {
diff --git a/src/plugins/home/server/tutorials/mysql_logs/index.ts b/src/plugins/home/server/tutorials/mysql_logs/index.ts
index 5ca657283d5144..776926d9bd74d9 100644
--- a/src/plugins/home/server/tutorials/mysql_logs/index.ts
+++ b/src/plugins/home/server/tutorials/mysql_logs/index.ts
@@ -55,7 +55,7 @@ export function mysqlLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/mysql_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/mysql_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/mysql_metrics/index.ts b/src/plugins/home/server/tutorials/mysql_metrics/index.ts
index 8710fb70a4e2fe..61f6d936f88e81 100644
--- a/src/plugins/home/server/tutorials/mysql_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/mysql_metrics/index.ts
@@ -54,7 +54,7 @@ export function mysqlMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/mysql_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/mysql_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/nats_logs/index.ts b/src/plugins/home/server/tutorials/nats_logs/index.ts
index d72a6df5e7104b..2695edaf993800 100644
--- a/src/plugins/home/server/tutorials/nats_logs/index.ts
+++ b/src/plugins/home/server/tutorials/nats_logs/index.ts
@@ -40,7 +40,7 @@ export function natsLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-nats.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/nats.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/nats.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ export function natsLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/nats_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/nats_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/nats_metrics/index.ts b/src/plugins/home/server/tutorials/nats_metrics/index.ts
index 1aab107a612101..e9226331b5ec31 100644
--- a/src/plugins/home/server/tutorials/nats_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/nats_metrics/index.ts
@@ -38,7 +38,7 @@ export function natsMetricsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-nats.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/nats.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/nats.svg'),
     artifacts: {
       dashboards: [
         {
@@ -54,7 +54,7 @@ export function natsMetricsSpecProvider(context: TutorialContext): TutorialSchem
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/nats_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/nats_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/netscout_logs/index.ts b/src/plugins/home/server/tutorials/netscout_logs/index.ts
index 9418a787be5d3e..64e7fb351fff81 100644
--- a/src/plugins/home/server/tutorials/netscout_logs/index.ts
+++ b/src/plugins/home/server/tutorials/netscout_logs/index.ts
@@ -39,7 +39,7 @@ export function netscoutLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-netscout.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/netscout.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/netscout.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/nginx_logs/index.ts b/src/plugins/home/server/tutorials/nginx_logs/index.ts
index 451d1b8acbabb3..5a08a6ebcddf44 100644
--- a/src/plugins/home/server/tutorials/nginx_logs/index.ts
+++ b/src/plugins/home/server/tutorials/nginx_logs/index.ts
@@ -55,7 +55,7 @@ export function nginxLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/nginx_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/nginx_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/nginx_metrics/index.ts b/src/plugins/home/server/tutorials/nginx_metrics/index.ts
index 9441f59bbe56be..d133af96d03e05 100644
--- a/src/plugins/home/server/tutorials/nginx_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/nginx_metrics/index.ts
@@ -59,7 +59,7 @@ which must be enabled in your Nginx installation. \
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/nginx_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/nginx_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/o365_logs/index.ts b/src/plugins/home/server/tutorials/o365_logs/index.ts
index c3cecbef325041..87dd8e7dcf2463 100644
--- a/src/plugins/home/server/tutorials/o365_logs/index.ts
+++ b/src/plugins/home/server/tutorials/o365_logs/index.ts
@@ -42,7 +42,7 @@ export function o365LogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-o365.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/o365.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/o365.svg'),
     artifacts: {
       dashboards: [
         {
@@ -58,7 +58,7 @@ export function o365LogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/o365_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/o365_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/okta_logs/index.ts b/src/plugins/home/server/tutorials/okta_logs/index.ts
index c3929cff09099e..4e4206ce953181 100644
--- a/src/plugins/home/server/tutorials/okta_logs/index.ts
+++ b/src/plugins/home/server/tutorials/okta_logs/index.ts
@@ -40,7 +40,7 @@ export function oktaLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-okta.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/okta.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/okta.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ export function oktaLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/okta_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/okta_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/openmetrics_metrics/index.ts b/src/plugins/home/server/tutorials/openmetrics_metrics/index.ts
index 9c0f6e89b6fa62..56db28fb0e9e26 100644
--- a/src/plugins/home/server/tutorials/openmetrics_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/openmetrics_metrics/index.ts
@@ -39,7 +39,7 @@ export function openmetricsMetricsSpecProvider(context: TutorialContext): Tutori
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-openmetrics.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/openmetrics.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/openmetrics.svg'),
     artifacts: {
       dashboards: [],
       exportedFields: {
diff --git a/src/plugins/home/server/tutorials/oracle_metrics/index.ts b/src/plugins/home/server/tutorials/oracle_metrics/index.ts
index 14f8dd0c397748..71cdedc6bb3ba4 100644
--- a/src/plugins/home/server/tutorials/oracle_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/oracle_metrics/index.ts
@@ -40,7 +40,7 @@ export function oracleMetricsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-' + moduleName + '.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/oracle.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/oracle.svg'),
     artifacts: {
       application: {
         label: i18n.translate('home.tutorials.oracleMetrics.artifacts.application.label', {
diff --git a/src/plugins/home/server/tutorials/osquery_logs/index.ts b/src/plugins/home/server/tutorials/osquery_logs/index.ts
index 8bf4ba94e9497d..e73eb7e544df8b 100644
--- a/src/plugins/home/server/tutorials/osquery_logs/index.ts
+++ b/src/plugins/home/server/tutorials/osquery_logs/index.ts
@@ -43,7 +43,7 @@ export function osqueryLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-osquery.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/osquery.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/osquery.svg'),
     artifacts: {
       dashboards: [
         {
diff --git a/src/plugins/home/server/tutorials/panw_logs/index.ts b/src/plugins/home/server/tutorials/panw_logs/index.ts
index 1279b0ebaf5a61..2aa4d6ebb6f2a0 100644
--- a/src/plugins/home/server/tutorials/panw_logs/index.ts
+++ b/src/plugins/home/server/tutorials/panw_logs/index.ts
@@ -42,7 +42,7 @@ export function panwLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-panw.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/paloalto.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/paloalto.svg'),
     artifacts: {
       dashboards: [
         {
@@ -58,7 +58,7 @@ export function panwLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/panw_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/panw_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/postgresql_logs/index.ts b/src/plugins/home/server/tutorials/postgresql_logs/index.ts
index 0338d33d9851a5..2f8d6acc10f934 100644
--- a/src/plugins/home/server/tutorials/postgresql_logs/index.ts
+++ b/src/plugins/home/server/tutorials/postgresql_logs/index.ts
@@ -58,7 +58,7 @@ export function postgresqlLogsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/postgresql_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/postgresql_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts b/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts
index 49ca87b1fbaa0a..5cfa4d9a7fedce 100644
--- a/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts
+++ b/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts
@@ -39,7 +39,7 @@ export function rabbitmqLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-rabbitmq.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/rabbitmq.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/rabbitmq.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/rabbitmq_metrics/index.ts b/src/plugins/home/server/tutorials/rabbitmq_metrics/index.ts
index 49b4abb6bf8366..c3c955e4658a4e 100644
--- a/src/plugins/home/server/tutorials/rabbitmq_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/rabbitmq_metrics/index.ts
@@ -58,7 +58,7 @@ export function rabbitmqMetricsSpecProvider(context: TutorialContext): TutorialS
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/rabbitmq_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/rabbitmq_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/radware_logs/index.ts b/src/plugins/home/server/tutorials/radware_logs/index.ts
index 4abd897c0aff38..607fe2fa601498 100644
--- a/src/plugins/home/server/tutorials/radware_logs/index.ts
+++ b/src/plugins/home/server/tutorials/radware_logs/index.ts
@@ -39,7 +39,7 @@ export function radwareLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-radware.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/radware.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/radware.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/redis_logs/index.ts b/src/plugins/home/server/tutorials/redis_logs/index.ts
index f0110b1e4f3604..5a278706f75309 100644
--- a/src/plugins/home/server/tutorials/redis_logs/index.ts
+++ b/src/plugins/home/server/tutorials/redis_logs/index.ts
@@ -61,7 +61,7 @@ Note that the `slowlog` fileset is experimental. \
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/redis_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/redis_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/redis_metrics/index.ts b/src/plugins/home/server/tutorials/redis_metrics/index.ts
index 1b541226ca24dd..bef4dcf6b07782 100644
--- a/src/plugins/home/server/tutorials/redis_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/redis_metrics/index.ts
@@ -54,7 +54,7 @@ export function redisMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/redis_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/redis_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/redisenterprise_metrics/index.ts b/src/plugins/home/server/tutorials/redisenterprise_metrics/index.ts
index 608ce867727d36..fd1c26f4da16ba 100644
--- a/src/plugins/home/server/tutorials/redisenterprise_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/redisenterprise_metrics/index.ts
@@ -53,7 +53,9 @@ export function redisenterpriseMetricsSpecProvider(context: TutorialContext): Tu
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/redisenterprise_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref(
+      '/redisenterprise_metrics/screenshot.webp'
+    ),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/santa_logs/index.ts b/src/plugins/home/server/tutorials/santa_logs/index.ts
index eda644458ba3e8..292c1b20c41d62 100644
--- a/src/plugins/home/server/tutorials/santa_logs/index.ts
+++ b/src/plugins/home/server/tutorials/santa_logs/index.ts
@@ -56,7 +56,7 @@ export function santaLogsSpecProvider(context: TutorialContext): TutorialSchema
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/santa_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/santa_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/sonicwall_logs/index.ts b/src/plugins/home/server/tutorials/sonicwall_logs/index.ts
index 5e88eb03d75d2c..00995b6767abf9 100644
--- a/src/plugins/home/server/tutorials/sonicwall_logs/index.ts
+++ b/src/plugins/home/server/tutorials/sonicwall_logs/index.ts
@@ -39,7 +39,7 @@ export function sonicwallLogsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-sonicwall.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/sonicwall.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/sonicwall.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/sophos_logs/index.ts b/src/plugins/home/server/tutorials/sophos_logs/index.ts
index a504ae2a30802e..5f43d0bccaf579 100644
--- a/src/plugins/home/server/tutorials/sophos_logs/index.ts
+++ b/src/plugins/home/server/tutorials/sophos_logs/index.ts
@@ -39,7 +39,7 @@ export function sophosLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-sophos.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/sophos.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/sophos.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/stan_metrics/index.ts b/src/plugins/home/server/tutorials/stan_metrics/index.ts
index ca0be2097af134..c83b405e2058a5 100644
--- a/src/plugins/home/server/tutorials/stan_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/stan_metrics/index.ts
@@ -38,7 +38,7 @@ export function stanMetricsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-stan.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/stan.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/stan.svg'),
     artifacts: {
       dashboards: [
         {
@@ -54,7 +54,7 @@ export function stanMetricsSpecProvider(context: TutorialContext): TutorialSchem
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/stan_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/stan_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/statsd_metrics/index.ts b/src/plugins/home/server/tutorials/statsd_metrics/index.ts
index a7c8a27aa7afd3..695c890bb449d2 100644
--- a/src/plugins/home/server/tutorials/statsd_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/statsd_metrics/index.ts
@@ -35,7 +35,7 @@ export function statsdMetricsSpecProvider(context: TutorialContext): TutorialSch
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-statsd.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/statsd.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/statsd.svg'),
     artifacts: {
       dashboards: [],
       exportedFields: {
diff --git a/src/plugins/home/server/tutorials/suricata_logs/index.ts b/src/plugins/home/server/tutorials/suricata_logs/index.ts
index dfff18cd8f196c..aa8a24a843c6df 100644
--- a/src/plugins/home/server/tutorials/suricata_logs/index.ts
+++ b/src/plugins/home/server/tutorials/suricata_logs/index.ts
@@ -40,7 +40,7 @@ export function suricataLogsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-suricata.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/suricata.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/suricata.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ export function suricataLogsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/suricata_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/suricata_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/system_metrics/index.ts b/src/plugins/home/server/tutorials/system_metrics/index.ts
index b9d607c9fc59ce..1db7e1e335337e 100644
--- a/src/plugins/home/server/tutorials/system_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/system_metrics/index.ts
@@ -40,7 +40,7 @@ It collects system wide statistics and statistics per process and filesystem. \
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-system.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/system.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/system.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ It collects system wide statistics and statistics per process and filesystem. \
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/system_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/system_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/tomcat_logs/index.ts b/src/plugins/home/server/tutorials/tomcat_logs/index.ts
index 99198f835402c9..6694f54428c99d 100644
--- a/src/plugins/home/server/tutorials/tomcat_logs/index.ts
+++ b/src/plugins/home/server/tutorials/tomcat_logs/index.ts
@@ -39,7 +39,7 @@ export function tomcatLogsSpecProvider(context: TutorialContext): TutorialSchema
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-tomcat.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/tomcat.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/tomcat.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/server/tutorials/traefik_logs/index.ts b/src/plugins/home/server/tutorials/traefik_logs/index.ts
index 7c096f68aabfb3..13a1c448c876ac 100644
--- a/src/plugins/home/server/tutorials/traefik_logs/index.ts
+++ b/src/plugins/home/server/tutorials/traefik_logs/index.ts
@@ -39,7 +39,7 @@ export function traefikLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-traefik.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/traefik.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/traefik.svg'),
     artifacts: {
       dashboards: [
         {
diff --git a/src/plugins/home/server/tutorials/traefik_metrics/index.ts b/src/plugins/home/server/tutorials/traefik_metrics/index.ts
index 1bba0718fbd998..daa83e051bd289 100644
--- a/src/plugins/home/server/tutorials/traefik_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/traefik_metrics/index.ts
@@ -35,7 +35,7 @@ export function traefikMetricsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-traefik.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/traefik.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/traefik.svg'),
     artifacts: {
       dashboards: [],
       exportedFields: {
diff --git a/src/plugins/home/server/tutorials/uptime_monitors/index.ts b/src/plugins/home/server/tutorials/uptime_monitors/index.ts
index 86b3e99e11057e..653cf939108b34 100644
--- a/src/plugins/home/server/tutorials/uptime_monitors/index.ts
+++ b/src/plugins/home/server/tutorials/uptime_monitors/index.ts
@@ -53,7 +53,7 @@ export function uptimeMonitorsSpecProvider(context: TutorialContext): TutorialSc
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/uptime_monitors/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/uptime_monitors/screenshot.webp'),
     onPrem: onPremInstructions([], context),
     elasticCloud: cloudInstructions(context),
     onPremElasticCloud: onPremCloudInstructions(context),
diff --git a/src/plugins/home/server/tutorials/uwsgi_metrics/index.ts b/src/plugins/home/server/tutorials/uwsgi_metrics/index.ts
index 4fb6725255e0a8..fedc37523baaed 100644
--- a/src/plugins/home/server/tutorials/uwsgi_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/uwsgi_metrics/index.ts
@@ -38,7 +38,7 @@ export function uwsgiMetricsSpecProvider(context: TutorialContext): TutorialSche
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-uwsgi.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/uwsgi.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/uwsgi.svg'),
     isBeta: false,
     artifacts: {
       dashboards: [
@@ -55,7 +55,7 @@ export function uwsgiMetricsSpecProvider(context: TutorialContext): TutorialSche
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/uwsgi_metrics/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/uwsgi_metrics/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, context),
     elasticCloud: cloudInstructions(moduleName, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, context),
diff --git a/src/plugins/home/server/tutorials/vsphere_metrics/index.ts b/src/plugins/home/server/tutorials/vsphere_metrics/index.ts
index 946da1b884a808..66359772a14c58 100644
--- a/src/plugins/home/server/tutorials/vsphere_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/vsphere_metrics/index.ts
@@ -38,7 +38,7 @@ export function vSphereMetricsSpecProvider(context: TutorialContext): TutorialSc
         learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-vsphere.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/vsphere.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/vsphere.svg'),
     isBeta: true,
     artifacts: {
       application: {
diff --git a/src/plugins/home/server/tutorials/zeek_logs/index.ts b/src/plugins/home/server/tutorials/zeek_logs/index.ts
index 387f1041f49741..1460fb6acf9b48 100644
--- a/src/plugins/home/server/tutorials/zeek_logs/index.ts
+++ b/src/plugins/home/server/tutorials/zeek_logs/index.ts
@@ -40,7 +40,7 @@ export function zeekLogsSpecProvider(context: TutorialContext): TutorialSchema {
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-zeek.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/zeek.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/zeek.svg'),
     artifacts: {
       dashboards: [
         {
@@ -56,7 +56,7 @@ export function zeekLogsSpecProvider(context: TutorialContext): TutorialSchema {
       },
     },
     completionTimeMinutes: 10,
-    previewImagePath: '/plugins/home/assets/zeek_logs/screenshot.webp',
+    previewImagePath: context.staticAssets.getPluginAssetHref('/zeek_logs/screenshot.webp'),
     onPrem: onPremInstructions(moduleName, platforms, context),
     elasticCloud: cloudInstructions(moduleName, platforms, context),
     onPremElasticCloud: onPremCloudInstructions(moduleName, platforms, context),
diff --git a/src/plugins/home/server/tutorials/zookeeper_metrics/index.ts b/src/plugins/home/server/tutorials/zookeeper_metrics/index.ts
index dd65f61a78b3c5..2479650a5198d1 100644
--- a/src/plugins/home/server/tutorials/zookeeper_metrics/index.ts
+++ b/src/plugins/home/server/tutorials/zookeeper_metrics/index.ts
@@ -26,7 +26,7 @@ export function zookeeperMetricsSpecProvider(context: TutorialContext): Tutorial
       defaultMessage: 'Zookeeper Metrics',
     }),
     moduleName,
-    euiIconType: '/plugins/home/assets/logos/zookeeper.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/zookeeper.svg'),
     isBeta: false,
     category: TutorialsCategory.METRICS,
     shortDescription: i18n.translate('home.tutorials.zookeeperMetrics.shortDescription', {
diff --git a/src/plugins/home/server/tutorials/zscaler_logs/index.ts b/src/plugins/home/server/tutorials/zscaler_logs/index.ts
index 316590c74fd769..47be9df4cdf5c4 100644
--- a/src/plugins/home/server/tutorials/zscaler_logs/index.ts
+++ b/src/plugins/home/server/tutorials/zscaler_logs/index.ts
@@ -39,7 +39,7 @@ export function zscalerLogsSpecProvider(context: TutorialContext): TutorialSchem
         learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-zscaler.html',
       },
     }),
-    euiIconType: '/plugins/home/assets/logos/zscaler.svg',
+    euiIconType: context.staticAssets.getPluginAssetHref('/logos/zscaler.svg'),
     artifacts: {
       dashboards: [],
       application: {
diff --git a/src/plugins/home/tsconfig.json b/src/plugins/home/tsconfig.json
index 62c62ea8ca9a22..87137d6c7166e4 100644
--- a/src/plugins/home/tsconfig.json
+++ b/src/plugins/home/tsconfig.json
@@ -32,6 +32,7 @@
     "@kbn/storybook",
     "@kbn/shared-ux-router",
     "@kbn/core-http-common",
+    "@kbn/shared-ux-link-redirect-app",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/input_control_vis/server/index.ts b/src/plugins/input_control_vis/server/index.ts
index 5054ac1ea2db59..46f04d5a4bbdf0 100644
--- a/src/plugins/input_control_vis/server/index.ts
+++ b/src/plugins/input_control_vis/server/index.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { CoreSetup, PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
+import type { CoreSetup, PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import type { VisualizationsServerSetup } from '@kbn/visualizations-plugin/server';
 
 import { configSchema, InputControlConfig } from '../config';
@@ -22,7 +22,7 @@ interface PluginSetupDependencies {
   visualizations: VisualizationsServerSetup;
 }
 
-export const plugin = (initializerContext: PluginInitializerContext) => ({
+export const plugin = async (initializerContext: PluginInitializerContext) => ({
   setup(core: CoreSetup, plugins: PluginSetupDependencies) {
     const { readOnly } = initializerContext.config.get<InputControlConfig>();
     if (readOnly) {
diff --git a/src/plugins/inspector/public/views/requests/components/details/clusters_view/clusters_view.tsx b/src/plugins/inspector/public/views/requests/components/details/clusters_view/clusters_view.tsx
index 1e35e0276139e5..8a96847832dc88 100644
--- a/src/plugins/inspector/public/views/requests/components/details/clusters_view/clusters_view.tsx
+++ b/src/plugins/inspector/public/views/requests/components/details/clusters_view/clusters_view.tsx
@@ -45,7 +45,7 @@ export class ClustersView extends Component<DetailViewProps> {
       <>
         <EuiSpacer size="m" />
         {Object.keys(clusters).length > 1 ? <ClustersHealth clusters={clusters} /> : null}
-        <ClustersTable clusters={clusters} />
+        <ClustersTable key={this.props.request.id} clusters={clusters} />
       </>
     ) : null;
   }
diff --git a/src/plugins/interactive_setup/server/index.ts b/src/plugins/interactive_setup/server/index.ts
index 885a4f4afa544d..fc8c7fdd40b44d 100644
--- a/src/plugins/interactive_setup/server/index.ts
+++ b/src/plugins/interactive_setup/server/index.ts
@@ -14,12 +14,14 @@ import type {
 } from '@kbn/core/server';
 
 import { ConfigSchema } from './config';
-import { InteractiveSetupPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
   schema: ConfigSchema,
 };
 
-export const plugin: PluginInitializer<void, never> = (
+export const plugin: PluginInitializer<void, never> = async (
   initializerContext: PluginInitializerContext
-) => new InteractiveSetupPlugin(initializerContext);
+) => {
+  const { InteractiveSetupPlugin } = await import('./plugin');
+  return new InteractiveSetupPlugin(initializerContext);
+};
diff --git a/src/plugins/kibana_overview/public/components/_overview.scss b/src/plugins/kibana_overview/public/components/_overview.scss
index 3cc4a6627eb244..85eebd7da29596 100644
--- a/src/plugins/kibana_overview/public/components/_overview.scss
+++ b/src/plugins/kibana_overview/public/components/_overview.scss
@@ -1,14 +1,3 @@
-.kbnOverviewApps__item,
-.kbnOverviewMore__item {
-  // Ensure card heights are stretched equally when wrapped with this element
-  .kbnRedirectCrossAppLinks {
-    align-items: flex-start;
-    display: flex;
-    flex: 1;
-    flex-direction: column;
-  }
-}
-
 .kbnOverviewApps__item {
   .kbnOverviewApps__group--primary & {
     @include euiBreakpoint('m', 'l', 'xl') {
diff --git a/src/plugins/kibana_overview/public/components/add_data/__snapshots__/add_data.test.tsx.snap b/src/plugins/kibana_overview/public/components/add_data/__snapshots__/add_data.test.tsx.snap
index fb32d2814c0fea..4c83d40af96bc8 100644
--- a/src/plugins/kibana_overview/public/components/add_data/__snapshots__/add_data.test.tsx.snap
+++ b/src/plugins/kibana_overview/public/components/add_data/__snapshots__/add_data.test.tsx.snap
@@ -55,7 +55,13 @@ exports[`AddData render 1`] = `
     <EuiFlexItem
       key="home_tutorial_directory"
     >
-      <RedirectAppLinks>
+      <RedirectAppLinks
+        coreStart={
+          Object {
+            "application": undefined,
+          }
+        }
+      >
         <Synopsis
           description="Ingest data from popular apps and services."
           iconType="indexOpen"
@@ -71,7 +77,13 @@ exports[`AddData render 1`] = `
     <EuiFlexItem
       key="ingestManager"
     >
-      <RedirectAppLinks>
+      <RedirectAppLinks
+        coreStart={
+          Object {
+            "application": undefined,
+          }
+        }
+      >
         <Synopsis
           description="Add and manage your fleet of Elastic Agents and integrations."
           iconType="indexManagementApp"
@@ -87,7 +99,13 @@ exports[`AddData render 1`] = `
     <EuiFlexItem
       key="ml_file_data_visualizer"
     >
-      <RedirectAppLinks>
+      <RedirectAppLinks
+        coreStart={
+          Object {
+            "application": undefined,
+          }
+        }
+      >
         <Synopsis
           description="Import your own CSV, NDJSON, or log file"
           iconType="document"
diff --git a/src/plugins/kibana_overview/public/components/add_data/add_data.tsx b/src/plugins/kibana_overview/public/components/add_data/add_data.tsx
index 6720f87c31175e..6fb10ccb0f8d55 100644
--- a/src/plugins/kibana_overview/public/components/add_data/add_data.tsx
+++ b/src/plugins/kibana_overview/public/components/add_data/add_data.tsx
@@ -11,7 +11,8 @@ import PropTypes from 'prop-types';
 import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { CoreStart } from '@kbn/core/public';
-import { RedirectAppLinks, useKibana } from '@kbn/kibana-react-plugin/public';
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { FeatureCatalogueEntry } from '@kbn/home-plugin/public';
 import { Synopsis } from '../synopsis';
 import { METRIC_TYPE, trackUiMetric } from '../../lib/ui_metric';
@@ -57,13 +58,15 @@ export const AddData: FC<Props> = ({ addBasePath, features }) => {
           </div>
         </EuiFlexItem>
       </EuiFlexGroup>
-
       <EuiSpacer size="m" />
-
       <EuiFlexGroup className="kbnOverviewDataAdd__content">
         {features.map((feature) => (
           <EuiFlexItem key={feature.id}>
-            <RedirectAppLinks application={application}>
+            <RedirectAppLinks
+              coreStart={{
+                application,
+              }}
+            >
               <Synopsis
                 id={feature.id}
                 description={feature.description}
diff --git a/src/plugins/kibana_overview/public/components/manage_data/__snapshots__/manage_data.test.tsx.snap b/src/plugins/kibana_overview/public/components/manage_data/__snapshots__/manage_data.test.tsx.snap
index 9abb7c9c12147b..9670a4f56d1526 100644
--- a/src/plugins/kibana_overview/public/components/manage_data/__snapshots__/manage_data.test.tsx.snap
+++ b/src/plugins/kibana_overview/public/components/manage_data/__snapshots__/manage_data.test.tsx.snap
@@ -35,7 +35,13 @@ exports[`ManageData render 1`] = `
         className="kbnOverviewDataManage__item"
         key="security"
       >
-        <RedirectAppLinks>
+        <RedirectAppLinks
+          coreStart={
+            Object {
+              "application": undefined,
+            }
+          }
+        >
           <Synopsis
             description="Control who has access and what tasks they can perform."
             iconType="securityApp"
@@ -52,7 +58,13 @@ exports[`ManageData render 1`] = `
         className="kbnOverviewDataManage__item"
         key="monitoring"
       >
-        <RedirectAppLinks>
+        <RedirectAppLinks
+          coreStart={
+            Object {
+              "application": undefined,
+            }
+          }
+        >
           <Synopsis
             description="Track the real-time health and performance of your deployment."
             iconType="monitoringApp"
@@ -69,7 +81,13 @@ exports[`ManageData render 1`] = `
         className="kbnOverviewDataManage__item"
         key="snapshot_restore"
       >
-        <RedirectAppLinks>
+        <RedirectAppLinks
+          coreStart={
+            Object {
+              "application": undefined,
+            }
+          }
+        >
           <Synopsis
             description="Save snapshots to a backup repository, and restore to recover index and cluster state."
             iconType="storage"
@@ -86,7 +104,13 @@ exports[`ManageData render 1`] = `
         className="kbnOverviewDataManage__item"
         key="index_lifecycle_management"
       >
-        <RedirectAppLinks>
+        <RedirectAppLinks
+          coreStart={
+            Object {
+              "application": undefined,
+            }
+          }
+        >
           <Synopsis
             description="Define lifecycle policies to automatically perform operations as an index ages."
             iconType="indexSettings"
diff --git a/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx b/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx
index 9d3d6476db9c50..ea8e2714370410 100644
--- a/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx
+++ b/src/plugins/kibana_overview/public/components/manage_data/manage_data.tsx
@@ -11,7 +11,8 @@ import PropTypes from 'prop-types';
 import { EuiFlexGroup, EuiFlexItem, EuiHorizontalRule, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { CoreStart } from '@kbn/core/public';
-import { RedirectAppLinks, useKibana } from '@kbn/kibana-react-plugin/public';
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { FeatureCatalogueEntry } from '@kbn/home-plugin/public';
 import { Synopsis } from '../synopsis';
 import { METRIC_TYPE, trackUiMetric } from '../../lib/ui_metric';
@@ -28,7 +29,6 @@ export const ManageData: FC<Props> = ({ addBasePath, features }) => {
   return (
     <>
       {features.length > 1 ? <EuiHorizontalRule margin="xl" aria-hidden="true" /> : null}
-
       {features.length > 0 ? (
         <section
           className="kbnOverviewDataManage"
@@ -49,7 +49,11 @@ export const ManageData: FC<Props> = ({ addBasePath, features }) => {
           <EuiFlexGroup className="kbnOverviewDataManage__content" wrap>
             {features.map((feature) => (
               <EuiFlexItem className="kbnOverviewDataManage__item" key={feature.id}>
-                <RedirectAppLinks application={application}>
+                <RedirectAppLinks
+                  coreStart={{
+                    application,
+                  }}
+                >
                   <Synopsis
                     id={feature.id}
                     description={feature.description}
diff --git a/src/plugins/kibana_react/public/app_links/click_handler.test.ts b/src/plugins/kibana_react/public/app_links/click_handler.test.ts
deleted file mode 100644
index 868e3d91d1218e..00000000000000
--- a/src/plugins/kibana_react/public/app_links/click_handler.test.ts
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { MouseEvent } from 'react';
-import { ApplicationStart } from '@kbn/core/public';
-import { createNavigateToUrlClickHandler } from './click_handler';
-
-const createLink = ({
-  href = '/base-path/app/targetApp',
-  target = '',
-}: { href?: string; target?: string } = {}): HTMLAnchorElement => {
-  const el = document.createElement('a');
-  if (href) {
-    el.href = href;
-  }
-  el.target = target;
-  return el;
-};
-
-const createEvent = ({
-  target = createLink(),
-  button = 0,
-  defaultPrevented = false,
-  modifierKey = false,
-}: {
-  target?: HTMLElement;
-  button?: number;
-  defaultPrevented?: boolean;
-  modifierKey?: boolean;
-}): MouseEvent<HTMLElement> => {
-  return {
-    target,
-    button,
-    defaultPrevented,
-    ctrlKey: modifierKey,
-    preventDefault: jest.fn(),
-  } as unknown as MouseEvent<HTMLElement>;
-};
-
-describe('createNavigateToUrlClickHandler', () => {
-  let container: HTMLElement;
-  let navigateToUrl: jest.MockedFunction<ApplicationStart['navigateToUrl']>;
-
-  const createHandler = () =>
-    createNavigateToUrlClickHandler({
-      container,
-      navigateToUrl,
-    });
-
-  beforeEach(() => {
-    container = document.createElement('div');
-    navigateToUrl = jest.fn();
-  });
-
-  it('calls `navigateToUrl` with the link url', () => {
-    const handler = createHandler();
-
-    const event = createEvent({
-      target: createLink({ href: '/base-path/app/targetApp' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledWith('http://localhost/base-path/app/targetApp');
-  });
-
-  it('is triggered if a non-link target has a parent link', () => {
-    const handler = createHandler();
-
-    const link = createLink();
-    const target = document.createElement('span');
-    link.appendChild(target);
-
-    const event = createEvent({ target });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledWith('http://localhost/base-path/app/targetApp');
-  });
-
-  it('is not triggered if a non-link target has no parent link', () => {
-    const handler = createHandler();
-
-    const parent = document.createElement('div');
-    const target = document.createElement('span');
-    parent.appendChild(target);
-
-    const event = createEvent({ target });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-  });
-
-  it('is not triggered when the link has no href', () => {
-    const handler = createHandler();
-
-    const event = createEvent({
-      target: createLink({ href: '' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-  });
-
-  it('is only triggered when the link does not have an external target', () => {
-    const handler = createHandler();
-
-    let event = createEvent({
-      target: createLink({ target: '_blank' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({
-      target: createLink({ target: 'some-target' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({
-      target: createLink({ target: '_self' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledTimes(1);
-
-    event = createEvent({
-      target: createLink({ target: '' }),
-    });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledTimes(2);
-  });
-
-  it('is only triggered from left clicks', () => {
-    const handler = createHandler();
-
-    let event = createEvent({
-      button: 1,
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({
-      button: 12,
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({
-      button: 0,
-    });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledTimes(1);
-  });
-
-  it('is not triggered if the event default is prevented', () => {
-    const handler = createHandler();
-
-    let event = createEvent({
-      defaultPrevented: true,
-    });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({
-      defaultPrevented: false,
-    });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledTimes(1);
-  });
-
-  it('is not triggered if any modifier key is pressed', () => {
-    const handler = createHandler();
-
-    let event = createEvent({ modifierKey: true });
-    handler(event);
-
-    expect(event.preventDefault).not.toHaveBeenCalled();
-    expect(navigateToUrl).not.toHaveBeenCalled();
-
-    event = createEvent({ modifierKey: false });
-    handler(event);
-
-    expect(event.preventDefault).toHaveBeenCalledTimes(1);
-    expect(navigateToUrl).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/src/plugins/kibana_react/public/app_links/click_handler.ts b/src/plugins/kibana_react/public/app_links/click_handler.ts
deleted file mode 100644
index 05ef24009d6127..00000000000000
--- a/src/plugins/kibana_react/public/app_links/click_handler.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { ApplicationStart } from '@kbn/core/public';
-import { getClosestLink, hasActiveModifierKey } from './utils';
-
-interface CreateCrossAppClickHandlerOptions {
-  container: HTMLElement;
-  navigateToUrl: ApplicationStart['navigateToUrl'];
-}
-
-export const createNavigateToUrlClickHandler = ({
-  container,
-  navigateToUrl,
-}: CreateCrossAppClickHandlerOptions): React.MouseEventHandler<HTMLElement> => {
-  return (e) => {
-    if (container == null) {
-      return;
-    }
-    // see https://github.com/DefinitelyTyped/DefinitelyTyped/pull/12239
-    const target = e.target as HTMLElement;
-
-    const link = getClosestLink(target, container);
-    if (!link) {
-      return;
-    }
-
-    if (
-      link.href && // ignore links with empty hrefs
-      (link.target === '' || link.target === '_self') && // ignore links having a target
-      e.button === 0 && // ignore everything but left clicks
-      !e.defaultPrevented && // ignore default prevented events
-      !hasActiveModifierKey(e) // ignore clicks with modifier keys
-    ) {
-      e.preventDefault();
-      navigateToUrl(link.href);
-    }
-  };
-};
diff --git a/src/plugins/kibana_react/public/app_links/redirect_app_link.test.tsx b/src/plugins/kibana_react/public/app_links/redirect_app_link.test.tsx
deleted file mode 100644
index f4ce0d3ff80d30..00000000000000
--- a/src/plugins/kibana_react/public/app_links/redirect_app_link.test.tsx
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { MouseEvent } from 'react';
-import { mount } from 'enzyme';
-import { applicationServiceMock } from '@kbn/core/public/mocks';
-/** @deprecated Use `RedirectAppLinks` from `@kbn/shared-ux-link-redirect-app` */
-import { RedirectAppLinks } from './redirect_app_link';
-import { BehaviorSubject } from 'rxjs';
-
-/* eslint-disable jsx-a11y/click-events-have-key-events */
-
-describe('RedirectAppLinks', () => {
-  let application: ReturnType<typeof applicationServiceMock.createStartContract>;
-
-  beforeEach(() => {
-    application = applicationServiceMock.createStartContract();
-    application.currentAppId$ = new BehaviorSubject<string>('currentApp');
-  });
-
-  it('intercept click events on children link elements', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <div>
-            <a href="/mocked-anyway">content</a>
-          </div>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('a').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToUrl).toHaveBeenCalledTimes(1);
-    expect(event!.defaultPrevented).toBe(true);
-  });
-
-  it('intercept click events on children inside link elements', async () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <a href="/mocked-anyway">
-            <span>content</span>
-          </a>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('span').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToUrl).toHaveBeenCalledTimes(1);
-    expect(event!.defaultPrevented).toBe(true);
-  });
-
-  it('does not intercept click events when the target is not inside a link', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <span>
-            <a href="/mocked-anyway">content</a>
-          </span>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('span').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(false);
-  });
-
-  it('does not intercept click events when the link is a parent of the container', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <a href="/mocked-anyway">
-          <RedirectAppLinks application={application}>
-            <span>content</span>
-          </RedirectAppLinks>
-        </a>
-      </div>
-    );
-
-    component.find('span').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(false);
-  });
-
-  it('does not intercept click events when the link has an external target', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <a href="/mocked-anyway" target="_blank">
-            content
-          </a>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('a').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(false);
-  });
-
-  it('does not intercept click events when the event is already defaultPrevented', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <a href="/mocked-anyway" target="_blank">
-            <span onClick={(e) => e.preventDefault()}>content</span>
-          </a>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('span').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(true);
-  });
-
-  it('does not intercept click events when the event propagation is stopped', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <a href="/mocked-anyway" target="_blank" onClick={(e) => e.stopPropagation()}>
-            content
-          </a>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('a').simulate('click', { button: 0, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!).toBe(undefined);
-  });
-
-  it('does not intercept click events when the event is not triggered from the left button', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <div>
-            <a href="/mocked-anyway">content</a>
-          </div>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('a').simulate('click', { button: 1, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(false);
-  });
-
-  it('does not intercept click events when the event has a modifier key enabled', () => {
-    let event: MouseEvent;
-
-    const component = mount(
-      <div
-        onClick={(e) => {
-          event = e;
-        }}
-      >
-        <RedirectAppLinks application={application}>
-          <div>
-            <a href="/mocked-anyway">content</a>
-          </div>
-        </RedirectAppLinks>
-      </div>
-    );
-
-    component.find('a').simulate('click', { button: 0, ctrlKey: true, defaultPrevented: false });
-
-    expect(application.navigateToApp).not.toHaveBeenCalled();
-    expect(event!.defaultPrevented).toBe(false);
-  });
-});
diff --git a/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx b/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx
deleted file mode 100644
index 6df1c43dbc5c6a..00000000000000
--- a/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { FunctionComponent, useRef, useMemo } from 'react';
-import classNames from 'classnames';
-import useObservable from 'react-use/lib/useObservable';
-import { ApplicationStart } from '@kbn/core/public';
-import { createNavigateToUrlClickHandler } from './click_handler';
-
-interface RedirectCrossAppLinksProps extends React.HTMLAttributes<HTMLDivElement> {
-  application: ApplicationStart;
-  className?: string;
-  'data-test-subj'?: string;
-}
-
-/**
- * Utility component that will intercept click events on children anchor (`<a>`) elements to call
- * `application.navigateToUrl` with the link's href. This will trigger SPA friendly navigation
- * when the link points to a valid Kibana app.
- *
- * @example
- * ```tsx
- * <RedirectCrossAppLinks application={application}>
- *   <a href="/base-path/app/another-app/some-path">Go to another-app</a>
- * </RedirectCrossAppLinks>
- * ```
- *
- * @remarks
- * It is recommended to use the component at the highest possible level of the component tree that would
- * require to handle the links. A good practice is to consider it as a context provider and to use it
- * at the root level of an application or of the page that require the feature.
- *
- * @deprecated use `RedirectAppLinks` from `@kbn/shared-ux-link-redirect-app`
- */
-
-export const RedirectAppLinks: FunctionComponent<RedirectCrossAppLinksProps> = ({
-  application,
-  children,
-  className,
-  ...otherProps
-}) => {
-  const currentAppId = useObservable(application.currentAppId$, undefined);
-  const containerRef = useRef<HTMLDivElement>(null);
-
-  const clickHandler = useMemo(
-    () =>
-      containerRef.current && currentAppId
-        ? createNavigateToUrlClickHandler({
-            container: containerRef.current,
-            navigateToUrl: application.navigateToUrl,
-          })
-        : undefined,
-    [containerRef.current, application, currentAppId]
-  );
-
-  return (
-    // eslint-disable-next-line jsx-a11y/click-events-have-key-events
-    <div
-      ref={containerRef}
-      className={classNames(className, 'kbnRedirectCrossAppLinks')}
-      onClick={clickHandler}
-      {...otherProps}
-    >
-      {children}
-    </div>
-  );
-};
diff --git a/src/plugins/kibana_react/public/app_links/utils.test.ts b/src/plugins/kibana_react/public/app_links/utils.test.ts
deleted file mode 100644
index 2c04038d253a74..00000000000000
--- a/src/plugins/kibana_react/public/app_links/utils.test.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { getClosestLink } from './utils';
-
-const createBranch = (...tags: string[]): HTMLElement[] => {
-  const elements: HTMLElement[] = [];
-  let parent: HTMLElement | undefined;
-  for (const tag of tags) {
-    const element = document.createElement(tag);
-    elements.push(element);
-    if (parent) {
-      parent.appendChild(element);
-    }
-    parent = element;
-  }
-
-  return elements;
-};
-
-describe('getClosestLink', () => {
-  it(`returns the element itself if it's a link`, () => {
-    const [target] = createBranch('A');
-    expect(getClosestLink(target)).toBe(target);
-  });
-
-  it('returns the closest parent that is a link', () => {
-    const [, , link, , target] = createBranch('A', 'DIV', 'A', 'DIV', 'SPAN');
-    expect(getClosestLink(target)).toBe(link);
-  });
-
-  it('returns undefined if the closest link is further than the container', () => {
-    const [, container, target] = createBranch('A', 'DIV', 'SPAN');
-    expect(getClosestLink(target, container)).toBe(undefined);
-  });
-});
diff --git a/src/plugins/kibana_react/public/app_links/utils.ts b/src/plugins/kibana_react/public/app_links/utils.ts
deleted file mode 100644
index 13188ac1b2b071..00000000000000
--- a/src/plugins/kibana_react/public/app_links/utils.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-/**
- * Returns true if any modifier key is active on the event, false otherwise.
- */
-export const hasActiveModifierKey = (event: React.MouseEvent): boolean => {
-  return event.metaKey || event.altKey || event.ctrlKey || event.shiftKey;
-};
-
-/**
- * Returns the closest anchor (`<a>`) element in the element parents (self included) up to the given container (excluded), or undefined if none is found.
- */
-export const getClosestLink = (
-  element: HTMLElement,
-  container?: HTMLElement
-): HTMLAnchorElement | undefined => {
-  let current = element;
-  while (true) {
-    if (current.tagName.toLowerCase() === 'a') {
-      return current as HTMLAnchorElement;
-    }
-    const parent = current.parentElement;
-    if (!parent || parent === document.body || parent === container) {
-      break;
-    }
-    current = parent;
-  }
-  return undefined;
-};
diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts
index e7244459a5c725..05abdbd84e91c6 100644
--- a/src/plugins/kibana_react/public/index.ts
+++ b/src/plugins/kibana_react/public/index.ts
@@ -44,10 +44,6 @@ export {
 
 export { useExecutionContext } from './use_execution_context';
 
-export type { ToolbarButtonProps } from './toolbar_button';
-/** @deprecated ToolbarButton - use `ToolbarButton` from `@kbn/shared-ux-button-toolbar` */
-export { POSITIONS, WEIGHTS, TOOLBAR_BUTTON_SIZES, ToolbarButton } from './toolbar_button';
-
 export { reactRouterNavigate, reactRouterOnClickHandler } from './react_router_navigate';
 
 export type {
@@ -76,9 +72,6 @@ export { Markdown, MarkdownSimple } from './markdown';
 export { toMountPoint } from './util';
 export type { ToMountPointOptions } from './util';
 
-/** @deprecated Use `RedirectAppLinks` from `@kbn/shared-ux-link-redirect-app` */
-export { RedirectAppLinks } from './app_links';
-
 /** @deprecated Use `KibanaThemeProvider`, `wrapWithTheme` from `@kbn/react-kibana-context-theme`  */
 export { KibanaThemeProvider, wrapWithTheme, type KibanaThemeProviderProps } from './theme';
 
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_actions/__snapshots__/overview_page_actions.test.tsx.snap b/src/plugins/kibana_react/public/overview_page/overview_page_actions/__snapshots__/overview_page_actions.test.tsx.snap
index 241dbb7b3303e7..ef67fc5e0cf332 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_actions/__snapshots__/overview_page_actions.test.tsx.snap
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_actions/__snapshots__/overview_page_actions.test.tsx.snap
@@ -3,12 +3,14 @@
 exports[`overviewPageActions all buttons 1`] = `
 Array [
   <mockConstructor
-    application={
+    coreStart={
       Object {
-        "capabilities": Object {
-          "navLinks": Object {
-            "dev_tools": true,
-            "management": true,
+        "application": Object {
+          "capabilities": Object {
+            "navLinks": Object {
+              "dev_tools": true,
+              "management": true,
+            },
           },
         },
       }
@@ -32,12 +34,14 @@ exports[`overviewPageActions no buttons 1`] = `Array []`;
 exports[`overviewPageActions only add data button 1`] = `
 Array [
   <mockConstructor
-    application={
+    coreStart={
       Object {
-        "capabilities": Object {
-          "navLinks": Object {
-            "dev_tools": true,
-            "management": true,
+        "application": Object {
+          "capabilities": Object {
+            "navLinks": Object {
+              "dev_tools": true,
+              "management": true,
+            },
           },
         },
       }
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.test.tsx b/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.test.tsx
index cb5d60fd330fdc..1c8b7e3a6f29e4 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.test.tsx
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.test.tsx
@@ -9,7 +9,7 @@
 import { overviewPageActions } from './overview_page_actions';
 import { ApplicationStart } from '@kbn/core/public';
 
-jest.mock('../../app_links', () => ({
+jest.mock('@kbn/shared-ux-link-redirect-app', () => ({
   RedirectAppLinks: jest.fn((element: JSX.Element) => element),
 }));
 
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.tsx b/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.tsx
index 9101224f60e13a..9654f3ccdd7dd8 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.tsx
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_actions/overview_page_actions.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '../../app_links';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 interface Props {
   addDataHref: string;
@@ -35,7 +35,11 @@ export const overviewPageActions = ({
     application.capabilities.navLinks;
 
   const actionAddData = (
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <EuiButtonEmpty
         data-test-subj="homeAddData"
         className="kbnOverviewPageHeader__actionButton"
@@ -52,7 +56,11 @@ export const overviewPageActions = ({
 
   const actionStackManagement =
     managementHref && showManagementLink && isManagementEnabled ? (
-      <RedirectAppLinks application={application}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
         <EuiButtonEmpty
           data-test-subj="homeManage"
           className="kbnOverviewPageHeader__actionButton"
@@ -69,7 +77,11 @@ export const overviewPageActions = ({
 
   const actionDevTools =
     devToolsHref && showDevToolsLink && isDevToolsEnabled ? (
-      <RedirectAppLinks application={application}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
         <EuiButtonEmpty
           data-test-subj="homeDevTools"
           className="kbnOverviewPageHeader__actionButton"
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.test.tsx b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.test.tsx
index ec48d3fda4c73d..97d12ba403ee16 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.test.tsx
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { OverviewPageFooter } from './overview_page_footer';
 import { shallowWithIntl } from '@kbn/test-jest-helpers';
 
-jest.mock('../../app_links', () => ({
+jest.mock('@kbn/shared-ux-link-redirect-app', () => ({
   RedirectAppLinks: jest.fn((element: JSX.Element) => element),
 }));
 
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
index 30023b47a80db3..6e0a0160e8c1a6 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
@@ -11,7 +11,7 @@ import { EuiPageTemplate, EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@ela
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 import { CoreStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '../../app_links';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { useKibana } from '../../context';
 import { useUiSetting$ } from '../../ui_settings';
 
@@ -43,7 +43,11 @@ export const OverviewPageFooter: FC<Props> = ({
   if (!show && !save) return <></>;
 
   const defaultRouteButton = defaultRoute.includes(path) ? (
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <EuiButtonEmpty
         className="kbnOverviewPageFooter__button"
         flush="both"
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
index 0e2ef6aaa3c9eb..9782a4cf1da650 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
@@ -2,11 +2,13 @@
 
 exports[`ElasticAgentCard props button 1`] = `
 <RedirectAppLinks
-  application={
+  coreStart={
     Object {
-      "capabilities": Object {
-        "navLinks": Object {
-          "integrations": true,
+      "application": Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
         },
       },
     }
@@ -51,11 +53,13 @@ exports[`ElasticAgentCard props button 1`] = `
 
 exports[`ElasticAgentCard props category 1`] = `
 <RedirectAppLinks
-  application={
+  coreStart={
     Object {
-      "capabilities": Object {
-        "navLinks": Object {
-          "integrations": true,
+      "application": Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
         },
       },
     }
@@ -100,11 +104,13 @@ exports[`ElasticAgentCard props category 1`] = `
 
 exports[`ElasticAgentCard props href 1`] = `
 <RedirectAppLinks
-  application={
+  coreStart={
     Object {
-      "capabilities": Object {
-        "navLinks": Object {
-          "integrations": true,
+      "application": Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
         },
       },
     }
@@ -149,11 +155,13 @@ exports[`ElasticAgentCard props href 1`] = `
 
 exports[`ElasticAgentCard props recommended 1`] = `
 <RedirectAppLinks
-  application={
+  coreStart={
     Object {
-      "capabilities": Object {
-        "navLinks": Object {
-          "integrations": true,
+      "application": Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
         },
       },
     }
@@ -203,11 +211,13 @@ exports[`ElasticAgentCard props recommended 1`] = `
 
 exports[`ElasticAgentCard renders 1`] = `
 <RedirectAppLinks
-  application={
+  coreStart={
     Object {
-      "capabilities": Object {
-        "navLinks": Object {
-          "integrations": true,
+      "application": Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
         },
       },
     }
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
index 10c387f41983c0..46262291104b8f 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
@@ -9,10 +9,10 @@
 import React, { FunctionComponent } from 'react';
 import { i18n } from '@kbn/i18n';
 import { CoreStart } from '@kbn/core/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { EuiButton, EuiCard, EuiTextColor, EuiScreenReaderOnly, EuiImage } from '@elastic/eui';
 import { useKibana } from '../../../context';
 import { NoDataPageActions, NO_DATA_RECOMMENDED } from '../no_data_page';
-import { RedirectAppLinks } from '../../../app_links';
 
 export type ElasticAgentCardProps = NoDataPageActions & {
   solution: string;
@@ -91,7 +91,11 @@ export const ElasticAgentCard: FunctionComponent<ElasticAgentCardProps> = ({
     );
 
   return (
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <EuiCard
         paddingSize="l"
         image={image}
diff --git a/src/plugins/kibana_react/public/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap b/src/plugins/kibana_react/public/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap
deleted file mode 100644
index 753dd8d6fe81fa..00000000000000
--- a/src/plugins/kibana_react/public/toolbar_button/__snapshots__/toolbar_button.test.tsx.snap
+++ /dev/null
@@ -1,199 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`font weights bold is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--bold kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`font weights normal is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`hasArrow is rendered 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`positions center is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--groupCenter kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`positions left is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--groupLeft kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`positions none is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`positions right is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--groupRight kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`sizes m is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--normal kbnToolbarButton--m"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="m"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
-
-exports[`sizes s is applied 1`] = `
-<EuiButton
-  className="kbnToolbarButton kbnToolbarButton--normal kbnToolbarButton--s"
-  color="text"
-  contentProps={
-    Object {
-      "className": "kbnToolbarButton__content",
-    }
-  }
-  data-test-subj=""
-  iconSide="right"
-  iconType="arrowDown"
-  onClick={[Function]}
-  size="s"
-  textProps={
-    Object {
-      "className": "kbnToolbarButton__text",
-    }
-  }
-/>
-`;
diff --git a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss b/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
deleted file mode 100644
index cbf6d853494467..00000000000000
--- a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
+++ /dev/null
@@ -1,61 +0,0 @@
-.kbnToolbarButton {
-  line-height: $euiButtonHeight; // Keeps alignment of text and chart icon
-
-  // Override background color for non-disabled buttons
-  &:not(:disabled) {
-    background-color: $euiColorEmptyShade;
-  }
-
-  // todo: once issue https://github.com/elastic/eui/issues/4730 is merged, this code might be safe to remove
-  // Some toolbar buttons are just icons, but EuiButton comes with margin and min-width that need to be removed
-  min-width: 0;
-  border-width: $euiBorderWidthThin;
-  border-style: solid;
-  border-color: $euiBorderColor; // Lighten the border color for all states
-
-  .kbnToolbarButton__text > svg {
-    margin-top: -1px; // Just some weird alignment issue when icon is the child not the `iconType`
-  }
-
-  .kbnToolbarButton__text:empty {
-    margin: 0;
-  }
-
-  // Toolbar buttons don't look good with centered text when fullWidth
-  &[class*='fullWidth'] {
-    text-align: left;
-
-    .kbnToolbarButton__content {
-      justify-content: space-between;
-    }
-  }
-}
-
-.kbnToolbarButton--groupLeft {
-  border-top-right-radius: 0;
-  border-bottom-right-radius: 0;
-}
-
-.kbnToolbarButton--groupCenter {
-  border-radius: 0;
-  border-left: none;
-}
-
-.kbnToolbarButton--groupRight {
-  border-top-left-radius: 0;
-  border-bottom-left-radius: 0;
-  border-left: none;
-}
-
-.kbnToolbarButton--bold {
-  font-weight: $euiFontWeightBold;
-}
-
-.kbnToolbarButton--normal {
-  font-weight: $euiFontWeightRegular;
-}
-
-.kbnToolbarButton--s {
-  box-shadow: none !important; // sass-lint:disable-line no-important
-  font-size: $euiFontSizeS;
-}
diff --git a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.test.tsx b/src/plugins/kibana_react/public/toolbar_button/toolbar_button.test.tsx
deleted file mode 100644
index 97690e483393f8..00000000000000
--- a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.test.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { shallow } from 'enzyme';
-import { ToolbarButton, POSITIONS, WEIGHTS, TOOLBAR_BUTTON_SIZES } from './toolbar_button';
-
-const noop = () => {};
-
-describe('sizes', () => {
-  TOOLBAR_BUTTON_SIZES.forEach((size) => {
-    test(`${size} is applied`, () => {
-      const component = shallow(<ToolbarButton onClick={noop} size={size} />);
-      expect(component).toMatchSnapshot();
-    });
-  });
-});
-
-describe('positions', () => {
-  POSITIONS.forEach((position) => {
-    test(`${position} is applied`, () => {
-      const component = shallow(<ToolbarButton onClick={noop} groupPosition={position} />);
-      expect(component).toMatchSnapshot();
-    });
-  });
-});
-
-describe('font weights', () => {
-  WEIGHTS.forEach((weight) => {
-    test(`${weight} is applied`, () => {
-      const component = shallow(<ToolbarButton onClick={noop} fontWeight={weight} />);
-      expect(component).toMatchSnapshot();
-    });
-  });
-});
-
-describe('hasArrow', () => {
-  it('is rendered', () => {
-    const component = shallow(<ToolbarButton onClick={noop} hasArrow />);
-    expect(component).toMatchSnapshot();
-  });
-});
diff --git a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx b/src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx
deleted file mode 100644
index 4b22710eef7959..00000000000000
--- a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import './toolbar_button.scss';
-import React from 'react';
-import classNames from 'classnames';
-import { EuiButton, PropsOf, EuiButtonProps } from '@elastic/eui';
-
-const groupPositionToClassMap = {
-  none: null,
-  left: 'kbnToolbarButton--groupLeft',
-  center: 'kbnToolbarButton--groupCenter',
-  right: 'kbnToolbarButton--groupRight',
-};
-
-type ButtonPositions = keyof typeof groupPositionToClassMap;
-export const POSITIONS = Object.keys(groupPositionToClassMap) as ButtonPositions[];
-
-type Weights = 'normal' | 'bold';
-export const WEIGHTS = ['normal', 'bold'] as Weights[];
-
-export const TOOLBAR_BUTTON_SIZES: Array<EuiButtonProps['size']> = ['s', 'm'];
-
-export type ToolbarButtonProps = PropsOf<typeof EuiButton> & {
-  /**
-   * Determines prominence
-   */
-  fontWeight?: Weights;
-  /**
-   * Smaller buttons also remove extra shadow for less prominence
-   */
-  size?: EuiButtonProps['size'];
-  /**
-   * Determines if the button will have a down arrow or not
-   */
-  hasArrow?: boolean;
-  /**
-   * Adjusts the borders for groupings
-   */
-  groupPosition?: ButtonPositions;
-  dataTestSubj?: string;
-};
-
-export const ToolbarButton: React.FunctionComponent<ToolbarButtonProps> = ({
-  children,
-  className,
-  fontWeight = 'normal',
-  size = 'm',
-  hasArrow = true,
-  groupPosition = 'none',
-  dataTestSubj = '',
-  ...rest
-}) => {
-  const classes = classNames(
-    'kbnToolbarButton',
-    groupPositionToClassMap[groupPosition],
-    [`kbnToolbarButton--${fontWeight}`, `kbnToolbarButton--${size}`],
-    className
-  );
-
-  return (
-    <EuiButton
-      data-test-subj={dataTestSubj}
-      className={classes}
-      iconSide="right"
-      iconType={hasArrow ? 'arrowDown' : ''}
-      color="text"
-      contentProps={{
-        className: 'kbnToolbarButton__content',
-      }}
-      textProps={{
-        className: 'kbnToolbarButton__text',
-      }}
-      {...rest}
-      size={size}
-    >
-      {children}
-    </EuiButton>
-  );
-};
diff --git a/src/plugins/kibana_react/tsconfig.json b/src/plugins/kibana_react/tsconfig.json
index cf3a74547e2917..082ecfa5328656 100644
--- a/src/plugins/kibana_react/tsconfig.json
+++ b/src/plugins/kibana_react/tsconfig.json
@@ -25,6 +25,7 @@
     "@kbn/react-kibana-context-styled",
     "@kbn/code-editor",
     "@kbn/core-analytics-browser",
+    "@kbn/shared-ux-link-redirect-app",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.test.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.test.ts
index f83200f56f27ce..c21b922f4142fc 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.test.ts
@@ -34,6 +34,7 @@ describe('getSavedObjectsCounts', () => {
     await getSavedObjectsCounts(soClient, ['type-a', 'type_2']);
     expect(soClient.find).toHaveBeenCalledWith({
       type: ['type-a', 'type_2'],
+      namespaces: ['*'],
       perPage: 0,
       aggs: {
         types: {
@@ -49,9 +50,10 @@ describe('getSavedObjectsCounts', () => {
 
   test('should apply the terms query and aggregation with the size matching the length of the list when `exclusive === true`', async () => {
     soClient.find.mockResolvedValueOnce(soEmptyResponse);
-    await getSavedObjectsCounts(soClient, ['type_one', 'type_two'], true);
+    await getSavedObjectsCounts(soClient, ['type_one', 'type_two'], { exclusive: true });
     expect(soClient.find).toHaveBeenCalledWith({
       type: ['type_one', 'type_two'],
+      namespaces: ['*'],
       perPage: 0,
       aggs: { types: { terms: { field: 'type', size: 2 } } },
     });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.ts
index cdca68e5d60065..d062d3c35b328e 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts/get_saved_object_counts.ts
@@ -41,17 +41,24 @@ export interface SavedObjectsCounts {
  *
  * @param soClient The {@link SavedObjectsClientContract} to use when performing the aggregation.
  * @param soTypes The SO types we want to know about.
- * @param exclusive If `true`, the results will only contain the breakdown for the specified `soTypes`. Otherwise, it'll also return `missing` and `others` bucket.
+ * @param options.exclusive If `true`, the results will only contain the breakdown for the specified `soTypes`. Otherwise, it'll also return `missing` and `others` bucket.
+ * @param options.namespaces array of namespaces to search. Otherwise it'll default to all namespaces ['*'].
  * @returns {@link SavedObjectsCounts}
  */
 export async function getSavedObjectsCounts(
   soClient: SavedObjectsClientContract,
   soTypes: string[],
-  exclusive: boolean = false
+  options?: {
+    exclusive?: boolean;
+    namespaces?: string[];
+  }
 ): Promise<SavedObjectsCounts> {
+  const { exclusive = false, namespaces = ['*'] } = options || {};
+
   const body = await soClient.find<void, { types: estypes.AggregationsStringTermsAggregate }>({
     type: soTypes,
     perPage: 0,
+    namespaces,
     aggs: {
       types: {
         terms: {
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.test.ts
index 7d6e600ded94b3..831bc5a700a00d 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.test.ts
@@ -97,7 +97,7 @@ describe('getKibanaSavedObjectCounts', () => {
     expect(getSavedObjectsCountsMock).toHaveBeenCalledWith(
       soClient,
       ['dashboard', 'visualization', 'search', 'index-pattern', 'graph-workspace'],
-      true
+      { exclusive: true }
     );
   });
 });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.ts
index 8451b3eadeb004..17b8666f9fb831 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/kibana_usage_collector.ts
@@ -28,7 +28,7 @@ const TYPES = ['dashboard', 'visualization', 'search', 'index-pattern', 'graph-w
 export async function getKibanaSavedObjectCounts(
   soClient: SavedObjectsClientContract
 ): Promise<KibanaSavedObjectCounts> {
-  const { per_type: buckets } = await getSavedObjectsCounts(soClient, TYPES, true);
+  const { per_type: buckets } = await getSavedObjectsCounts(soClient, TYPES, { exclusive: true });
 
   const allZeros = Object.fromEntries(
     TYPES.map((type) => [snakeCase(type), { total: 0 }])
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.test.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.test.ts
index 53168be3c34b67..dbce4a57654411 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.test.ts
@@ -16,15 +16,21 @@ import { registerSavedObjectsCountUsageCollector } from './saved_objects_count_c
 describe('saved_objects_count_collector', () => {
   const usageCollectionMock = createUsageCollectionSetupMock();
   const fetchContextMock = createCollectorFetchContextMock();
+  const mockGetSoClientWithHiddenIndices = jest.fn().mockResolvedValue(fetchContextMock.soClient);
 
   beforeAll(() =>
-    registerSavedObjectsCountUsageCollector(usageCollectionMock, () =>
-      Promise.resolve(['type_one', 'type_two', 'type-three', 'type-four'])
+    registerSavedObjectsCountUsageCollector(
+      usageCollectionMock,
+      () => Promise.resolve(['type_one', 'type_two', 'type-three', 'type-four']),
+      mockGetSoClientWithHiddenIndices
     )
   );
   afterAll(() => jest.clearAllTimers());
 
-  afterEach(() => getSavedObjectsCountsMock.mockReset());
+  afterEach(() => {
+    getSavedObjectsCountsMock.mockReset();
+    mockGetSoClientWithHiddenIndices.mockClear();
+  });
 
   test('registered collector is set', () => {
     expect(usageCollectionMock.makeUsageCollector).toHaveBeenCalled();
@@ -48,6 +54,8 @@ describe('saved_objects_count_collector', () => {
       non_registered_types: [],
       others: 0,
     });
+
+    expect(mockGetSoClientWithHiddenIndices).toBeCalledTimes(1);
   });
 
   test('should return some values when the aggregations return something', async () => {
@@ -78,10 +86,11 @@ describe('saved_objects_count_collector', () => {
       total: 153,
     });
 
+    expect(mockGetSoClientWithHiddenIndices).toBeCalledTimes(1);
     expect(getSavedObjectsCountsMock).toHaveBeenCalledWith(
       fetchContextMock.soClient,
       ['type_one', 'type_two', 'type-three', 'type-four'],
-      false
+      { exclusive: false, namespaces: ['*'] }
     );
   });
 });
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.ts
index 49bfb7819389d1..b327c3d5917314 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/saved_objects_count_collector.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
 import type { UsageCollectionSetup } from '@kbn/usage-collection-plugin/server';
 import { getSavedObjectsCounts } from './get_saved_object_counts';
 
@@ -23,7 +24,8 @@ interface SavedObjectsCountUsage {
 
 export function registerSavedObjectsCountUsageCollector(
   usageCollection: UsageCollectionSetup,
-  getAllSavedObjectTypes: () => Promise<string[]>
+  getAllSavedObjectTypes: () => Promise<string[]>,
+  getSoClientWithHiddenIndices: () => Promise<SavedObjectsClientContract>
 ) {
   usageCollection.registerCollector(
     usageCollection.makeUsageCollector<SavedObjectsCountUsage>({
@@ -67,14 +69,19 @@ export function registerSavedObjectsCountUsageCollector(
           },
         },
       },
-      async fetch({ soClient }) {
+      async fetch() {
+        const soClient = await getSoClientWithHiddenIndices();
         const allRegisteredSOTypes = await getAllSavedObjectTypes();
+        const namespaces = ['*'];
         const {
           total,
           per_type: buckets,
           non_expected_types: nonRegisteredTypes,
           others,
-        } = await getSavedObjectsCounts(soClient, allRegisteredSOTypes, false);
+        } = await getSavedObjectsCounts(soClient, allRegisteredSOTypes, {
+          namespaces,
+          exclusive: false,
+        });
         return {
           total,
           by_type: buckets.map(({ key: type, doc_count: count }) => ({ type, count })),
diff --git a/src/plugins/kibana_usage_collection/server/index.ts b/src/plugins/kibana_usage_collection/server/index.ts
index 2a674035ebe298..0b6b06559c2d2e 100644
--- a/src/plugins/kibana_usage_collection/server/index.ts
+++ b/src/plugins/kibana_usage_collection/server/index.ts
@@ -7,11 +7,11 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { KibanaUsageCollectionPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { KibanaUsageCollectionPlugin } = await import('./plugin');
   return new KibanaUsageCollectionPlugin(initializerContext);
 }
diff --git a/src/plugins/kibana_usage_collection/server/plugin.test.ts b/src/plugins/kibana_usage_collection/server/plugin.test.ts
index ef26492c2d6fd1..a798eaa5aa1df9 100644
--- a/src/plugins/kibana_usage_collection/server/plugin.test.ts
+++ b/src/plugins/kibana_usage_collection/server/plugin.test.ts
@@ -17,9 +17,10 @@ import {
 } from '@kbn/usage-collection-plugin/server/mocks';
 import { cloudDetailsMock, registerEbtCountersMock } from './plugin.test.mocks';
 import { plugin } from '.';
+import type { KibanaUsageCollectionPlugin } from './plugin';
 
 describe('kibana_usage_collection', () => {
-  const pluginInstance = plugin(coreMock.createPluginInitializerContext({}));
+  let pluginInstance: KibanaUsageCollectionPlugin;
 
   const usageCollectors: CollectorOptions[] = [];
 
@@ -33,6 +34,10 @@ describe('kibana_usage_collection', () => {
     return createUsageCollectionSetupMock().makeStatsCollector(opts);
   });
 
+  beforeAll(async () => {
+    pluginInstance = await plugin(coreMock.createPluginInitializerContext({}));
+  });
+
   beforeEach(() => {
     cloudDetailsMock.mockClear();
   });
diff --git a/src/plugins/kibana_usage_collection/server/plugin.ts b/src/plugins/kibana_usage_collection/server/plugin.ts
index 5c807e01c0ce0d..ff38116c1de44b 100644
--- a/src/plugins/kibana_usage_collection/server/plugin.ts
+++ b/src/plugins/kibana_usage_collection/server/plugin.ts
@@ -152,7 +152,19 @@ export class KibanaUsageCollectionPlugin implements Plugin {
         .getAllTypes()
         .map(({ name }) => name);
     };
-    registerSavedObjectsCountUsageCollector(usageCollection, getAllSavedObjectTypes);
+
+    const getSoClientWithHiddenIndices = async () => {
+      const coreStart = await coreStartPromise;
+
+      const allSoTypes = await getAllSavedObjectTypes();
+      return coreStart.savedObjects.createInternalRepository(allSoTypes);
+    };
+
+    registerSavedObjectsCountUsageCollector(
+      usageCollection,
+      getAllSavedObjectTypes,
+      getSoClientWithHiddenIndices
+    );
     registerManagementUsageCollector(usageCollection, getUiSettingsClient);
     registerUiMetricUsageCollector(usageCollection, registerType, getSavedObjectsClient);
     registerApplicationUsageCollector(
diff --git a/src/plugins/links/server/index.ts b/src/plugins/links/server/index.ts
index c60d084fa66d23..37ef2afdcb5558 100644
--- a/src/plugins/links/server/index.ts
+++ b/src/plugins/links/server/index.ts
@@ -7,6 +7,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core-plugins-server';
-import { LinksServerPlugin } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) => new LinksServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { LinksServerPlugin } = await import('./plugin');
+  return new LinksServerPlugin(initContext);
+};
diff --git a/src/plugins/management/server/index.ts b/src/plugins/management/server/index.ts
index 5d8ddf53fd0686..5a0ee0a457decb 100644
--- a/src/plugins/management/server/index.ts
+++ b/src/plugins/management/server/index.ts
@@ -7,8 +7,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ManagementServerPlugin } from './plugin';
 export { config } from './config';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new ManagementServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { ManagementServerPlugin } = await import('./plugin');
+  return new ManagementServerPlugin(initContext);
+};
diff --git a/src/plugins/maps_ems/server/index.ts b/src/plugins/maps_ems/server/index.ts
index a0a5cd6c7e72e3..0fea54b0ba9747 100644
--- a/src/plugins/maps_ems/server/index.ts
+++ b/src/plugins/maps_ems/server/index.ts
@@ -6,17 +6,10 @@
  * Side Public License, v 1.
  */
 
-import {
-  CoreSetup,
-  PluginInitializerContext,
-  Plugin,
-  PluginConfigDescriptor,
-} from '@kbn/core/server';
-import { LicensingPluginSetup } from '@kbn/licensing-plugin/server';
-import { ILicense } from '@kbn/licensing-plugin/common/types';
+import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
 import { MapConfig, mapConfigSchema } from '../config';
-import { EMSSettings, LICENSE_CHECK_ID } from '../common';
 export type { EMSSettings } from '../common';
+export type { MapsEmsPluginServerSetup } from './plugin';
 
 export const config: PluginConfigDescriptor<MapConfig> = {
   exposeToBrowser: {
@@ -32,48 +25,7 @@ export const config: PluginConfigDescriptor<MapConfig> = {
   schema: mapConfigSchema,
 };
 
-export interface MapsEmsPluginServerSetup {
-  config: MapConfig;
-  createEMSSettings: () => EMSSettings;
-}
-
-interface MapsEmsSetupServerDependencies {
-  licensing?: LicensingPluginSetup;
-}
-
-export class MapsEmsPlugin implements Plugin<MapsEmsPluginServerSetup> {
-  readonly _initializerContext: PluginInitializerContext<MapConfig>;
-
-  constructor(initializerContext: PluginInitializerContext<MapConfig>) {
-    this._initializerContext = initializerContext;
-  }
-
-  public setup(core: CoreSetup, plugins: MapsEmsSetupServerDependencies) {
-    const mapConfig = this._initializerContext.config.get();
-
-    let isEnterprisePlus = false;
-    if (plugins.licensing) {
-      function updateLicenseState(license: ILicense) {
-        const enterprise = license.check(LICENSE_CHECK_ID, 'enterprise');
-        isEnterprisePlus = enterprise.state === 'valid';
-      }
-
-      plugins.licensing.refresh().then(updateLicenseState);
-      plugins.licensing.license$.subscribe(updateLicenseState);
-    }
-
-    return {
-      config: mapConfig,
-      createEMSSettings: () => {
-        return new EMSSettings(mapConfig, () => {
-          return isEnterprisePlus;
-        });
-      },
-    };
-  }
-
-  public start() {}
-}
-
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new MapsEmsPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { MapsEmsPlugin } = await import('./plugin');
+  return new MapsEmsPlugin(initializerContext);
+};
diff --git a/src/plugins/maps_ems/server/plugin.ts b/src/plugins/maps_ems/server/plugin.ts
new file mode 100644
index 00000000000000..ebdc6814fd6eb5
--- /dev/null
+++ b/src/plugins/maps_ems/server/plugin.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ILicense, LicensingPluginSetup } from '@kbn/licensing-plugin/server';
+import { Plugin, PluginInitializerContext } from '@kbn/core-plugins-server';
+import { CoreSetup } from '@kbn/core-lifecycle-server';
+import { MapConfig } from '../config';
+import { LICENSE_CHECK_ID, EMSSettings } from '../common';
+
+export interface MapsEmsPluginServerSetup {
+  config: MapConfig;
+  createEMSSettings: () => EMSSettings;
+}
+
+interface MapsEmsSetupServerDependencies {
+  licensing?: LicensingPluginSetup;
+}
+
+export class MapsEmsPlugin implements Plugin<MapsEmsPluginServerSetup> {
+  readonly _initializerContext: PluginInitializerContext<MapConfig>;
+
+  constructor(initializerContext: PluginInitializerContext<MapConfig>) {
+    this._initializerContext = initializerContext;
+  }
+
+  public setup(core: CoreSetup, plugins: MapsEmsSetupServerDependencies) {
+    const mapConfig = this._initializerContext.config.get();
+
+    let isEnterprisePlus = false;
+    if (plugins.licensing) {
+      function updateLicenseState(license: ILicense) {
+        const enterprise = license.check(LICENSE_CHECK_ID, 'enterprise');
+        isEnterprisePlus = enterprise.state === 'valid';
+      }
+
+      plugins.licensing.refresh().then(updateLicenseState);
+      plugins.licensing.license$.subscribe(updateLicenseState);
+    }
+
+    return {
+      config: mapConfig,
+      createEMSSettings: () => {
+        return new EMSSettings(mapConfig, () => {
+          return isEnterprisePlus;
+        });
+      },
+    };
+  }
+
+  public start() {}
+}
diff --git a/src/plugins/maps_ems/tsconfig.json b/src/plugins/maps_ems/tsconfig.json
index 7d32dacb6d55ab..e8ed41cf54f367 100644
--- a/src/plugins/maps_ems/tsconfig.json
+++ b/src/plugins/maps_ems/tsconfig.json
@@ -11,6 +11,8 @@
     "@kbn/config-schema",
     "@kbn/config",
     "@kbn/core-http-common",
+    "@kbn/core-plugins-server",
+    "@kbn/core-lifecycle-server",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/navigation/public/index.ts b/src/plugins/navigation/public/index.ts
index 904e4ed2c5e7c7..7db4526995c04c 100644
--- a/src/plugins/navigation/public/index.ts
+++ b/src/plugins/navigation/public/index.ts
@@ -13,7 +13,7 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new NavigationPublicPlugin(initializerContext);
 }
 
-export type { TopNavMenuData, TopNavMenuProps } from './top_nav_menu';
+export type { TopNavMenuData, TopNavMenuProps, TopNavMenuBadgeProps } from './top_nav_menu';
 export { TopNavMenu } from './top_nav_menu';
 
 export type { NavigationPublicPluginSetup, NavigationPublicPluginStart } from './types';
diff --git a/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu.test.tsx.snap b/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu.test.tsx.snap
new file mode 100644
index 00000000000000..08bcceb4c81163
--- /dev/null
+++ b/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu.test.tsx.snap
@@ -0,0 +1,48 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`TopNavMenu when setMenuMountPoint is provided should render badges and search bar 1`] = `
+<div
+  class="euiBadgeGroup kbnTopNavMenu__badgeGroup emotion-euiBadgeGroup-xs"
+>
+  <span
+    class="euiBadge emotion-euiBadge-default"
+    tabindex="0"
+    title="badge1"
+  >
+    <span
+      class="euiBadge__content emotion-euiBadge__content"
+    >
+      <span
+        class="euiBadge__text emotion-euiBadge__text"
+      >
+        badge1
+      </span>
+    </span>
+  </span>
+  <span
+    class="euiToolTipAnchor emotion-euiToolTipAnchor-inlineBlock"
+  >
+    <span
+      class="euiBadge emotion-euiBadge-warning"
+      data-test-subj="test2"
+      tabindex="0"
+      title=""
+    >
+      <span
+        class="euiBadge__content emotion-euiBadge__content"
+      >
+        <span
+          class="euiBadge__text emotion-euiBadge__text"
+        >
+          badge2
+        </span>
+      </span>
+    </span>
+  </span>
+  <div
+    data-test-subj="test3"
+  >
+    badge3
+  </div>
+</div>
+`;
diff --git a/src/plugins/navigation/public/top_nav_menu/index.ts b/src/plugins/navigation/public/top_nav_menu/index.ts
index 16c92aaaaf7122..e6705273c2a1b6 100644
--- a/src/plugins/navigation/public/top_nav_menu/index.ts
+++ b/src/plugins/navigation/public/top_nav_menu/index.ts
@@ -7,7 +7,7 @@
  */
 
 export { createTopNav } from './create_top_nav_menu';
-export type { TopNavMenuProps } from './top_nav_menu';
+export type { TopNavMenuProps, TopNavMenuBadgeProps } from './top_nav_menu';
 export { TopNavMenu } from './top_nav_menu';
 export type { TopNavMenuData } from './top_nav_menu_data';
 export type { TopNavMenuExtensionsRegistrySetup } from './top_nav_menu_extensions_registry';
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
index 127bd6e8482b1d..218c620519cf2c 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.test.tsx
@@ -10,10 +10,11 @@ import React from 'react';
 import { ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { MountPoint } from '@kbn/core/public';
-import { TopNavMenu } from './top_nav_menu';
+import { TopNavMenu, TopNavMenuBadgeProps } from './top_nav_menu';
 import { TopNavMenuData } from './top_nav_menu_data';
 import { shallowWithIntl, mountWithIntl } from '@kbn/test-jest-helpers';
 import type { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
+import { EuiToolTipProps } from '@elastic/eui';
 
 const unifiedSearch = {
   ui: {
@@ -24,6 +25,7 @@ const unifiedSearch = {
 
 describe('TopNavMenu', () => {
   const WRAPPER_SELECTOR = '.kbnTopNavMenu__wrapper';
+  const BADGES_GROUP_SELECTOR = '.kbnTopNavMenu__badgeGroup';
   const TOP_NAV_ITEM_SELECTOR = 'TopNavMenuItem';
   const SEARCH_BAR_SELECTOR = 'AggregateQuerySearchBar';
   const menuItems: TopNavMenuData[] = [
@@ -43,6 +45,25 @@ describe('TopNavMenu', () => {
       run: jest.fn(),
     },
   ];
+  const badges: TopNavMenuBadgeProps[] = [
+    {
+      badgeText: 'badge1',
+    },
+    {
+      'data-test-subj': 'test2',
+      badgeText: 'badge2',
+      title: '',
+      color: 'warning',
+      toolTipProps: {
+        content: 'tooltip content',
+        position: 'bottom',
+      } as EuiToolTipProps,
+    },
+    {
+      badgeText: 'badge3',
+      renderCustomBadge: ({ badgeText }) => <div data-test-subj="test3">{badgeText}</div>,
+    },
+  ];
 
   it('Should render nothing when no config is provided', () => {
     const component = shallowWithIntl(<TopNavMenu appName={'test'} />);
@@ -165,5 +186,26 @@ describe('TopNavMenu', () => {
       // menu is rendered outside of the component
       expect(component.find(TOP_NAV_ITEM_SELECTOR).length).toBe(0);
     });
+
+    it('should render badges and search bar', async () => {
+      const component = mountWithIntl(
+        <TopNavMenu
+          appName={'test'}
+          badges={badges}
+          showSearchBar={true}
+          unifiedSearch={unifiedSearch}
+          setMenuMountPoint={setMountPoint}
+        />
+      );
+
+      act(() => {
+        mountPoint(portalTarget);
+      });
+
+      await refresh();
+
+      expect(component.find(SEARCH_BAR_SELECTOR).length).toBe(1);
+      expect(portalTarget.querySelector(BADGES_GROUP_SELECTOR)).toMatchSnapshot();
+    });
   });
 });
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
index de060db9b6e3b3..9c899cd9d7207f 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { ReactElement } from 'react';
+import React, { ReactElement, Fragment } from 'react';
 import {
   EuiBadge,
   EuiBadgeGroup,
@@ -25,9 +25,10 @@ import { AggregateQuery, Query } from '@kbn/es-query';
 import { TopNavMenuData } from './top_nav_menu_data';
 import { TopNavMenuItem } from './top_nav_menu_item';
 
-type Badge = EuiBadgeProps & {
+export type TopNavMenuBadgeProps = EuiBadgeProps & {
   badgeText: string;
   toolTipProps?: Partial<EuiToolTipProps>;
+  renderCustomBadge?: (props: { badgeText: string }) => ReactElement;
 };
 
 export type TopNavMenuProps<QT extends Query | AggregateQuery = Query> = Omit<
@@ -35,7 +36,7 @@ export type TopNavMenuProps<QT extends Query | AggregateQuery = Query> = Omit<
   'kibana' | 'intl' | 'timeHistory'
 > & {
   config?: TopNavMenuData[];
-  badges?: Badge[];
+  badges?: TopNavMenuBadgeProps[];
   showSearchBar?: boolean;
   showQueryInput?: boolean;
   showDatePicker?: boolean;
@@ -82,14 +83,22 @@ export function TopNavMenu<QT extends AggregateQuery | Query = Query>(
     return null;
   }
 
-  function createBadge({ badgeText, toolTipProps, ...badgeProps }: Badge, i: number): ReactElement {
-    const Badge = ({ key, ...rest }: { key?: string }) => (
-      <EuiBadge key={key} tabIndex={0} {...rest} {...badgeProps}>
+  function createBadge(
+    { badgeText, toolTipProps, renderCustomBadge, ...badgeProps }: TopNavMenuBadgeProps,
+    i: number
+  ): ReactElement {
+    const key = `nav-menu-badge-${i}`;
+
+    const Badge = () => (
+      <EuiBadge tabIndex={0} {...badgeProps}>
         {badgeText}
       </EuiBadge>
     );
 
-    const key = `nav-menu-badge-${i}`;
+    if (renderCustomBadge) {
+      return <Fragment key={key}>{renderCustomBadge({ badgeText })}</Fragment>;
+    }
+
     return toolTipProps ? (
       <EuiToolTip key={key} {...toolTipProps}>
         <Badge />
diff --git a/src/plugins/newsfeed/server/index.ts b/src/plugins/newsfeed/server/index.ts
index 60df08a9b95e1e..fe3acbeb40dacc 100644
--- a/src/plugins/newsfeed/server/index.ts
+++ b/src/plugins/newsfeed/server/index.ts
@@ -7,7 +7,6 @@
  */
 
 import { PluginConfigDescriptor } from '@kbn/core/server';
-import { NewsfeedPlugin } from './plugin';
 import { configSchema, NewsfeedConfigType } from './config';
 
 export const config: PluginConfigDescriptor<NewsfeedConfigType> = {
@@ -19,6 +18,7 @@ export const config: PluginConfigDescriptor<NewsfeedConfigType> = {
   },
 };
 
-export function plugin() {
+export async function plugin() {
+  const { NewsfeedPlugin } = await import('./plugin');
   return new NewsfeedPlugin();
 }
diff --git a/src/plugins/presentation_util/public/components/dashboard_picker/dashboard_picker.tsx b/src/plugins/presentation_util/public/components/dashboard_picker/dashboard_picker.tsx
index b2d8a576ebae82..01b1c8d2210daa 100644
--- a/src/plugins/presentation_util/public/components/dashboard_picker/dashboard_picker.tsx
+++ b/src/plugins/presentation_util/public/components/dashboard_picker/dashboard_picker.tsx
@@ -20,7 +20,7 @@ import {
   EuiHighlight,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { ToolbarButton } from '@kbn/kibana-react-plugin/public';
+import { ToolbarButton } from '@kbn/shared-ux-button-toolbar';
 import { SavedObjectCommon } from '@kbn/saved-objects-finder-plugin/common';
 
 import { pluginServices } from '../../services';
@@ -122,19 +122,20 @@ export function DashboardPicker({ isDisabled, onChange, idsToOmit }: DashboardPi
           isLoading={isLoading}
           data-test-subj="open-dashboard-picker"
           onClick={() => setIsPopoverOpen(!isPopoverOpen)}
-        >
-          <EuiText
-            size="s"
-            css={css`
-              color: ${selectedDashboard ? euiTheme.colors.text : euiTheme.colors.disabledText};
-            `}
-          >
-            {selectedDashboard?.label ??
-              i18n.translate('presentationUtil.dashboardPicker.noDashboardOptionLabel', {
-                defaultMessage: 'Select dashboard',
-              })}
-          </EuiText>
-        </ToolbarButton>
+          label={
+            <EuiText
+              size="s"
+              css={css`
+                color: ${selectedDashboard ? euiTheme.colors.text : euiTheme.colors.disabledText};
+              `}
+            >
+              {selectedDashboard?.label ??
+                i18n.translate('presentationUtil.dashboardPicker.noDashboardOptionLabel', {
+                  defaultMessage: 'Select dashboard',
+                })}
+            </EuiText>
+          }
+        />
       }
       isOpen={isPopoverOpen}
       closePopover={() => setIsPopoverOpen(false)}
diff --git a/src/plugins/presentation_util/public/components/data_view_picker/data_view_picker.tsx b/src/plugins/presentation_util/public/components/data_view_picker/data_view_picker.tsx
index a7ee475cfa5d38..1804a2fcf2046e 100644
--- a/src/plugins/presentation_util/public/components/data_view_picker/data_view_picker.tsx
+++ b/src/plugins/presentation_util/public/components/data_view_picker/data_view_picker.tsx
@@ -10,9 +10,9 @@ import React, { useState } from 'react';
 import { EuiSelectable, EuiInputPopover, EuiSelectableProps } from '@elastic/eui';
 import { DataViewListItem } from '@kbn/data-views-plugin/common';
 
-import { ToolbarButton, ToolbarButtonProps } from '@kbn/kibana-react-plugin/public';
+import { ToolbarButton, ToolbarButtonProps } from '@kbn/shared-ux-button-toolbar';
 
-export type DataViewTriggerProps = ToolbarButtonProps & {
+export type DataViewTriggerProps = Omit<ToolbarButtonProps<'standard'>, 'label'> & {
   label: string;
   title?: string;
 };
@@ -46,15 +46,14 @@ export function DataViewPicker({
     const { label, title, ...rest } = trigger;
     return (
       <ToolbarButton
-        title={title}
+        aria-label={title}
         data-test-subj="open-data-view-picker"
         onClick={() => setPopoverIsOpen(!isPopoverOpen)}
+        label={label}
         fullWidth
         {...colorProp}
         {...rest}
-      >
-        {label}
-      </ToolbarButton>
+      />
     );
   };
 
diff --git a/src/plugins/presentation_util/server/index.ts b/src/plugins/presentation_util/server/index.ts
index d1f9ef6da760af..dad4ef0e8362ee 100644
--- a/src/plugins/presentation_util/server/index.ts
+++ b/src/plugins/presentation_util/server/index.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { PresentationUtilPlugin } from './plugin';
-
 export { SETTING_CATEGORY } from './ui_settings';
-export const plugin = () => new PresentationUtilPlugin();
+export const plugin = async () => {
+  const { PresentationUtilPlugin } = await import('./plugin');
+  return new PresentationUtilPlugin();
+};
diff --git a/src/plugins/presentation_util/tsconfig.json b/src/plugins/presentation_util/tsconfig.json
index 1270c0802dff28..e17fd6cc5a754b 100644
--- a/src/plugins/presentation_util/tsconfig.json
+++ b/src/plugins/presentation_util/tsconfig.json
@@ -30,7 +30,8 @@
     "@kbn/storybook",
     "@kbn/ui-actions-plugin",
     "@kbn/saved-objects-finder-plugin",
-    "@kbn/content-management-plugin"
+    "@kbn/content-management-plugin",
+    "@kbn/shared-ux-button-toolbar"
   ],
   "exclude": ["target/**/*"]
 }
diff --git a/src/plugins/saved_objects_finder/server/index.ts b/src/plugins/saved_objects_finder/server/index.ts
index 5d73b4387c9ff5..fb5abfd46f7d9f 100644
--- a/src/plugins/saved_objects_finder/server/index.ts
+++ b/src/plugins/saved_objects_finder/server/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { SavedObjectsServerPlugin } from './plugin';
-
-export const plugin = () => new SavedObjectsServerPlugin();
+export const plugin = async () => {
+  const { SavedObjectsServerPlugin } = await import('./plugin');
+  return new SavedObjectsServerPlugin();
+};
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
index 30b6ca14bef6a7..92bae41b22e589 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
@@ -102,29 +102,11 @@ exports[`SavedObjectsTable should render normally 1`] = `
     size="l"
   />
   <RedirectAppLinks
-    application={
+    coreStart={
       Object {
-        "applications$": BehaviorSubject {
-          "_value": Map {},
-          "closed": false,
-          "currentObservers": null,
-          "hasError": false,
-          "isStopped": false,
-          "observers": Array [],
-          "thrownError": null,
-        },
-        "capabilities": Object {
-          "catalogue": Object {},
-          "management": Object {},
-          "navLinks": Object {},
-          "savedObjectsManagement": Object {
-            "delete": false,
-            "edit": false,
-            "read": true,
-          },
-        },
-        "currentAppId$": Observable {
-          "source": Subject {
+        "application": Object {
+          "applications$": BehaviorSubject {
+            "_value": Map {},
             "closed": false,
             "currentObservers": null,
             "hasError": false,
@@ -132,20 +114,40 @@ exports[`SavedObjectsTable should render normally 1`] = `
             "observers": Array [],
             "thrownError": null,
           },
-        },
-        "currentLocation$": Observable {
-          "source": Subject {
-            "closed": false,
-            "currentObservers": null,
-            "hasError": false,
-            "isStopped": false,
-            "observers": Array [],
-            "thrownError": null,
+          "capabilities": Object {
+            "catalogue": Object {},
+            "management": Object {},
+            "navLinks": Object {},
+            "savedObjectsManagement": Object {
+              "delete": false,
+              "edit": false,
+              "read": true,
+            },
+          },
+          "currentAppId$": Observable {
+            "source": Subject {
+              "closed": false,
+              "currentObservers": null,
+              "hasError": false,
+              "isStopped": false,
+              "observers": Array [],
+              "thrownError": null,
+            },
+          },
+          "currentLocation$": Observable {
+            "source": Subject {
+              "closed": false,
+              "currentObservers": null,
+              "hasError": false,
+              "isStopped": false,
+              "observers": Array [],
+              "thrownError": null,
+            },
           },
+          "getUrlForApp": [MockFunction],
+          "navigateToApp": [MockFunction],
+          "navigateToUrl": [MockFunction],
         },
-        "getUrlForApp": [MockFunction],
-        "navigateToApp": [MockFunction],
-        "navigateToUrl": [MockFunction],
       }
     }
   >
@@ -186,6 +188,7 @@ exports[`SavedObjectsTable should render normally 1`] = `
       }
       basePath={
         BasePath {
+          "assetsHrefBase": "",
           "basePath": "",
           "get": [Function],
           "prepend": [Function],
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
index 7d4ed131f6eacf..03ba5cf5d9ead2 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/__snapshots__/flyout.test.tsx.snap
@@ -174,6 +174,7 @@ exports[`Flyout conflicts should allow conflict resolution 2`] = `
             "register": [MockFunction],
           },
           "basePath": BasePath {
+            "assetsHrefBase": "",
             "basePath": "",
             "get": [Function],
             "prepend": [Function],
@@ -195,6 +196,9 @@ exports[`Flyout conflicts should allow conflict resolution 2`] = `
           "patch": [MockFunction],
           "post": [MockFunction],
           "put": [MockFunction],
+          "staticAssets": Object {
+            "getPluginAssetHref": [MockFunction],
+          },
         },
         "state": Object {
           "conflictingRecord": undefined,
@@ -401,6 +405,7 @@ exports[`Flyout summary should display summary when import is complete 1`] = `
   allowedTypes={Array []}
   basePath={
     BasePath {
+      "assetsHrefBase": "",
       "basePath": "",
       "get": [Function],
       "prepend": [Function],
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/table.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/table.tsx
index 3e0352f613d7ef..79e4d326431081 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/table.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/table.tsx
@@ -13,7 +13,7 @@ import {
   EuiSearchBar,
   EuiBasicTable,
   EuiButton,
-  EuiIcon,
+  EuiIconTip,
   EuiLink,
   EuiSpacer,
   EuiToolTip,
@@ -245,14 +245,13 @@ export class Table extends PureComponent<TableProps, TableState> {
         render: (type: string, object: SavedObjectWithMetadata) => {
           const typeLabel = getSavedObjectLabel(type, allowedTypes);
           return (
-            <EuiToolTip position="top" content={typeLabel}>
-              <EuiIcon
-                aria-label={typeLabel}
-                type={object.meta.icon || 'apps'}
-                size="s"
-                data-test-subj="objectType"
-              />
-            </EuiToolTip>
+            <EuiIconTip
+              aria-label={typeLabel}
+              type={object.meta.icon || 'apps'}
+              size="s"
+              content={typeLabel}
+              iconProps={{ 'data-test-subj': 'objectType' }}
+            />
           );
         },
       } as EuiTableFieldDataColumnType<SavedObjectWithMetadata<any>>,
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
index 48d428a9f087ff..e84d957f39239e 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
@@ -13,7 +13,7 @@ import { saveAs } from '@elastic/filesaver';
 import { EuiSpacer, Query, CriteriaWithPagination } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { HttpStart, OverlayStart, NotificationsStart, ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { SavedObjectsTaggingApi } from '@kbn/saved-objects-tagging-oss-plugin/public';
 import { DataViewsContract } from '@kbn/data-views-plugin/public';
 import { DataPublicPluginStart } from '@kbn/data-plugin/public';
@@ -706,7 +706,11 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
           filteredCount={filteredItemCount}
         />
         <EuiSpacer size="l" />
-        <RedirectAppLinks application={applications}>
+        <RedirectAppLinks
+          coreStart={{
+            application: applications,
+          }}
+        >
           <Table
             basePath={http.basePath}
             taggingApi={taggingApi}
diff --git a/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx b/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx
index 8a4540a666a4e9..44bd3d5a1d447b 100644
--- a/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/saved_objects_edition_page.tsx
@@ -11,7 +11,7 @@ import { useParams, useLocation } from 'react-router-dom';
 import { parse } from 'query-string';
 import { i18n } from '@kbn/i18n';
 import { CoreStart, ChromeBreadcrumb, ScopedHistory } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { SavedObjectEdition } from './object_view';
 import './saved_objects_edition_page.scss';
 
@@ -49,25 +49,28 @@ const SavedObjectsEditionPage = ({
   }, [setBreadcrumbs, type]);
 
   return (
-    <RedirectAppLinks
-      application={coreStart.application}
-      className="savedObjectsManagementEditionPage"
-    >
-      <SavedObjectEdition
-        id={id}
-        savedObjectType={type}
-        http={coreStart.http}
-        overlays={coreStart.overlays}
-        notifications={coreStart.notifications}
-        capabilities={capabilities}
-        notFoundType={query.notFound as string}
-        uiSettings={coreStart.uiSettings}
-        history={history}
-        docLinks={docLinks}
-        settings={coreStart.settings}
-        theme={coreStart.theme}
-      />
-    </RedirectAppLinks>
+    <div className="savedObjectsManagementEditionPage">
+      <RedirectAppLinks
+        coreStart={{
+          application: coreStart.application,
+        }}
+      >
+        <SavedObjectEdition
+          id={id}
+          savedObjectType={type}
+          http={coreStart.http}
+          overlays={coreStart.overlays}
+          notifications={coreStart.notifications}
+          capabilities={capabilities}
+          notFoundType={query.notFound as string}
+          uiSettings={coreStart.uiSettings}
+          history={history}
+          docLinks={docLinks}
+          settings={coreStart.settings}
+          theme={coreStart.theme}
+        />
+      </RedirectAppLinks>
+    </div>
   );
 };
 
diff --git a/src/plugins/saved_objects_management/server/index.ts b/src/plugins/saved_objects_management/server/index.ts
index 1ec0db16fd62bf..e602a0fdae0f3b 100644
--- a/src/plugins/saved_objects_management/server/index.ts
+++ b/src/plugins/saved_objects_management/server/index.ts
@@ -7,10 +7,11 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SavedObjectsManagementPlugin } from './plugin';
 
-export const plugin = (context: PluginInitializerContext) =>
-  new SavedObjectsManagementPlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { SavedObjectsManagementPlugin } = await import('./plugin');
+  return new SavedObjectsManagementPlugin(context);
+};
 
 export type {
   SavedObjectsManagementPluginSetup,
diff --git a/src/plugins/saved_objects_management/tsconfig.json b/src/plugins/saved_objects_management/tsconfig.json
index 72eb9c29b30c8e..f2c7bea0c33b4f 100644
--- a/src/plugins/saved_objects_management/tsconfig.json
+++ b/src/plugins/saved_objects_management/tsconfig.json
@@ -29,6 +29,7 @@
     "@kbn/core-ui-settings-browser-mocks",
     "@kbn/core-ui-settings-browser",
     "@kbn/core-saved-objects-api-server",
+    "@kbn/shared-ux-link-redirect-app",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/saved_search/server/index.ts b/src/plugins/saved_search/server/index.ts
index 056de3732b4747..6c08bad317b9cf 100644
--- a/src/plugins/saved_search/server/index.ts
+++ b/src/plugins/saved_search/server/index.ts
@@ -7,9 +7,10 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core-plugins-server';
-import { SavedSearchServerPlugin } from './plugin';
 
 export { getSavedSearch } from './services/saved_searches';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new SavedSearchServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { SavedSearchServerPlugin } = await import('./plugin');
+  return new SavedSearchServerPlugin(initContext);
+};
diff --git a/src/plugins/screenshot_mode/server/index.ts b/src/plugins/screenshot_mode/server/index.ts
index cc5d45b7be7327..55dfd3967f4e4c 100644
--- a/src/plugins/screenshot_mode/server/index.ts
+++ b/src/plugins/screenshot_mode/server/index.ts
@@ -6,8 +6,6 @@
  * Side Public License, v 1.
  */
 
-import { ScreenshotModePlugin } from './plugin';
-
 export {
   setScreenshotModeEnabled,
   KBN_SCREENSHOT_MODE_HEADER,
@@ -20,6 +18,7 @@ export type {
   ScreenshotModePluginStart,
 } from './types';
 
-export function plugin() {
+export async function plugin() {
+  const { ScreenshotModePlugin } = await import('./plugin');
   return new ScreenshotModePlugin();
 }
diff --git a/src/plugins/share/server/index.ts b/src/plugins/share/server/index.ts
index c55d91d053b501..d38575a3b7cd4a 100644
--- a/src/plugins/share/server/index.ts
+++ b/src/plugins/share/server/index.ts
@@ -7,12 +7,12 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SharePlugin } from './plugin';
 
 export type { SharePluginSetup, SharePluginStart } from './plugin';
 
 export { CSV_QUOTE_VALUES_SETTING, CSV_SEPARATOR_SETTING } from '../common/constants';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { SharePlugin } = await import('./plugin');
   return new SharePlugin(initializerContext);
 }
diff --git a/src/plugins/telemetry/public/plugin.test.mock.ts b/src/plugins/telemetry/public/plugin.test.mock.ts
new file mode 100644
index 00000000000000..85af98e239a0bf
--- /dev/null
+++ b/src/plugins/telemetry/public/plugin.test.mock.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const isSyntheticsMonitorMock = jest.fn();
+jest.doMock('@kbn/analytics-collection-utils', () => ({
+  isSyntheticsMonitor: isSyntheticsMonitorMock,
+}));
diff --git a/src/plugins/telemetry/public/plugin.test.ts b/src/plugins/telemetry/public/plugin.test.ts
index 13ebb4d999315e..842e11f12cc687 100644
--- a/src/plugins/telemetry/public/plugin.test.ts
+++ b/src/plugins/telemetry/public/plugin.test.ts
@@ -6,12 +6,14 @@
  * Side Public License, v 1.
  */
 
+import { of } from 'rxjs';
 import { ElasticV3BrowserShipper } from '@kbn/analytics-shippers-elastic-v3-browser';
 import { coreMock } from '@kbn/core/public/mocks';
 import { homePluginMock } from '@kbn/home-plugin/public/mocks';
 import { screenshotModePluginMock } from '@kbn/screenshot-mode-plugin/public/mocks';
 import { HomePublicPluginSetup } from '@kbn/home-plugin/public';
 import { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
+import { isSyntheticsMonitorMock } from './plugin.test.mock';
 import { TelemetryPlugin } from './plugin';
 
 describe('TelemetryPlugin', () => {
@@ -21,6 +23,7 @@ describe('TelemetryPlugin', () => {
   beforeEach(() => {
     screenshotMode = screenshotModePluginMock.createSetupContract();
     home = homePluginMock.createSetupContract();
+    isSyntheticsMonitorMock.mockReturnValue(false);
   });
 
   describe('setup', () => {
@@ -82,5 +85,44 @@ describe('TelemetryPlugin', () => {
         );
       });
     });
+
+    it('disables telemetry when in screenshot mode', async () => {
+      const initializerContext = coreMock.createPluginInitializerContext();
+
+      const plugin = new TelemetryPlugin(initializerContext);
+      const isScreenshotModeSpy = jest
+        .spyOn(screenshotMode, 'isScreenshotMode')
+        .mockReturnValue(true);
+      plugin.setup(coreMock.createSetup(), { screenshotMode, home });
+      expect(isScreenshotModeSpy).toBeCalledTimes(1);
+
+      const coreStartMock = coreMock.createStart();
+      coreStartMock.application = { ...coreStartMock.application, currentAppId$: of('some-app') };
+      const optInSpy = jest.spyOn(coreStartMock.analytics, 'optIn');
+      plugin.start(coreStartMock, { screenshotMode });
+      expect(isScreenshotModeSpy).toBeCalledTimes(2);
+      expect(optInSpy).toBeCalledTimes(1);
+      expect(optInSpy).toHaveBeenCalledWith({ global: { enabled: false } });
+    });
+
+    it('disables telemetry when the user agent contains Elastic/Synthetics', async () => {
+      const initializerContext = coreMock.createPluginInitializerContext();
+
+      const plugin = new TelemetryPlugin(initializerContext);
+      const isScreenshotModeSpy = jest
+        .spyOn(screenshotMode, 'isScreenshotMode')
+        .mockReturnValue(false);
+      plugin.setup(coreMock.createSetup(), { screenshotMode, home });
+      expect(isScreenshotModeSpy).toBeCalledTimes(1);
+
+      const coreStartMock = coreMock.createStart();
+      coreStartMock.application = { ...coreStartMock.application, currentAppId$: of('some-app') };
+      isSyntheticsMonitorMock.mockReturnValueOnce(true);
+      const optInSpy = jest.spyOn(coreStartMock.analytics, 'optIn');
+      plugin.start(coreStartMock, { screenshotMode });
+      expect(isScreenshotModeSpy).toBeCalledTimes(2);
+      expect(optInSpy).toBeCalledTimes(1);
+      expect(optInSpy).toHaveBeenCalledWith({ global: { enabled: false } });
+    });
   });
 });
diff --git a/src/plugins/telemetry/public/plugin.ts b/src/plugins/telemetry/public/plugin.ts
index 59ff2d3478c1d6..588a532ffa6a36 100644
--- a/src/plugins/telemetry/public/plugin.ts
+++ b/src/plugins/telemetry/public/plugin.ts
@@ -23,6 +23,7 @@ import type {
 } from '@kbn/screenshot-mode-plugin/public';
 import type { HomePublicPluginSetup } from '@kbn/home-plugin/public';
 import { ElasticV3BrowserShipper } from '@kbn/analytics-shippers-elastic-v3-browser';
+import { isSyntheticsMonitor } from '@kbn/analytics-collection-utils';
 
 import { BehaviorSubject, map, switchMap, tap } from 'rxjs';
 import type { TelemetryConfigLabels } from '../server/config';
@@ -159,7 +160,7 @@ export class TelemetryPlugin
     const currentKibanaVersion = this.currentKibanaVersion;
     this.telemetryService = new TelemetryService({
       config,
-      isScreenshotMode: screenshotMode.isScreenshotMode(),
+      isScreenshotMode: this.shouldSkipTelemetry(screenshotMode),
       http,
       notifications,
       currentKibanaVersion,
@@ -200,7 +201,9 @@ export class TelemetryPlugin
     this.telemetrySender = new TelemetrySender(this.telemetryService, async () => {
       await this.refreshConfig(http);
       analytics.optIn({
-        global: { enabled: this.telemetryService!.isOptedIn && !screenshotMode.isScreenshotMode() },
+        global: {
+          enabled: this.telemetryService!.isOptedIn && !this.shouldSkipTelemetry(screenshotMode),
+        },
       });
     });
 
@@ -249,12 +252,18 @@ export class TelemetryPlugin
     application.currentAppId$
       .pipe(
         switchMap(async () => {
+          // Disable telemetry and terminate early if Kibana is running in a special "skip" mode
+          if (this.shouldSkipTelemetry(screenshotMode)) {
+            analytics.optIn({ global: { enabled: false } });
+            return;
+          }
+
           // Refresh and get telemetry config
           const updatedConfig = await this.refreshConfig(http);
 
           analytics.optIn({
             global: {
-              enabled: this.telemetryService!.isOptedIn && !screenshotMode.isScreenshotMode(),
+              enabled: this.telemetryService!.isOptedIn,
             },
           });
 
@@ -286,6 +295,16 @@ export class TelemetryPlugin
     this.telemetrySender?.stop();
   }
 
+  /**
+   * Kibana should skip telemetry collection if reporting is taking a screenshot
+   * or Synthetics monitoring is navigating Kibana.
+   * @param screenshotMode {@link ScreenshotModePluginSetup}
+   * @private
+   */
+  private shouldSkipTelemetry(screenshotMode: ScreenshotModePluginSetup): boolean {
+    return screenshotMode.isScreenshotMode() || isSyntheticsMonitor();
+  }
+
   private getTelemetryServicePublicApis(): TelemetryServicePublicApis {
     const telemetryService = this.telemetryService!;
     return {
diff --git a/src/plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
index 3c67764953ef47..85096e763259b6 100644
--- a/src/plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -8,13 +8,14 @@
 
 import type { PluginInitializerContext } from '@kbn/core/server';
 import type { TelemetryConfigType } from './config';
-import { TelemetryPlugin } from './plugin';
 
 export { config } from './config';
 export type { TelemetryPluginSetup, TelemetryPluginStart } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext<TelemetryConfigType>) =>
-  new TelemetryPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext<TelemetryConfigType>) => {
+  const { TelemetryPlugin } = await import('./plugin');
+  return new TelemetryPlugin(initializerContext);
+};
 export { getClusterUuids, getLocalStats } from './telemetry_collection';
 
 export type {
diff --git a/src/plugins/telemetry/tsconfig.json b/src/plugins/telemetry/tsconfig.json
index 638bfb4f722a7d..4163f957837a7e 100644
--- a/src/plugins/telemetry/tsconfig.json
+++ b/src/plugins/telemetry/tsconfig.json
@@ -35,6 +35,7 @@
     "@kbn/core-http-browser-mocks",
     "@kbn/core-http-browser",
     "@kbn/core-http-server",
+    "@kbn/analytics-collection-utils",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/telemetry_collection_manager/server/index.ts b/src/plugins/telemetry_collection_manager/server/index.ts
index ededc6abb87dd1..d588a18b4e91f4 100644
--- a/src/plugins/telemetry_collection_manager/server/index.ts
+++ b/src/plugins/telemetry_collection_manager/server/index.ts
@@ -7,12 +7,12 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { TelemetryCollectionManagerPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { TelemetryCollectionManagerPlugin } = await import('./plugin');
   return new TelemetryCollectionManagerPlugin(initializerContext);
 }
 
diff --git a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
index 515add8c29dd46..430cf538779b62 100644
--- a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
+++ b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
@@ -281,6 +281,7 @@ exports[`TelemetryManagementSectionComponent renders null because allowChangingO
           "register": [MockFunction],
         },
         "basePath": BasePath {
+          "assetsHrefBase": "",
           "basePath": "",
           "get": [Function],
           "prepend": [Function],
@@ -302,6 +303,9 @@ exports[`TelemetryManagementSectionComponent renders null because allowChangingO
         "patch": [MockFunction],
         "post": [MockFunction],
         "put": [MockFunction],
+        "staticAssets": Object {
+          "getPluginAssetHref": [MockFunction],
+        },
       },
       "isScreenshotMode": false,
       "notifications": Object {
diff --git a/src/plugins/ui_actions_enhanced/server/index.ts b/src/plugins/ui_actions_enhanced/server/index.ts
index 04df6d4b1e841b..bb62e2b86a19cb 100644
--- a/src/plugins/ui_actions_enhanced/server/index.ts
+++ b/src/plugins/ui_actions_enhanced/server/index.ts
@@ -6,14 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { AdvancedUiActionsServerPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { AdvancedUiActionsServerPlugin } = await import('./plugin');
   return new AdvancedUiActionsServerPlugin();
 }
 
-export { AdvancedUiActionsServerPlugin as Plugin };
 export type {
+  AdvancedUiActionsServerPlugin as Plugin,
   SetupContract as AdvancedUiActionsSetup,
   StartContract as AdvancedUiActionsStart,
 } from './plugin';
diff --git a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
index 3e72aaad9d1795..e3e4059ad3cf51 100644
--- a/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
+++ b/src/plugins/unified_histogram/public/chart/breakdown_field_selector.tsx
@@ -20,6 +20,9 @@ export interface BreakdownFieldSelectorProps {
   onBreakdownFieldChange?: (breakdownField: DataViewField | undefined) => void;
 }
 
+const TRUNCATION_PROPS = { truncation: 'middle' as const };
+const SINGLE_SELECTION = { asPlainText: true };
+
 export const BreakdownFieldSelector = ({
   dataView,
   breakdown,
@@ -56,6 +59,9 @@ export const BreakdownFieldSelector = ({
   const breakdownCss = css`
     width: 100%;
     max-width: ${euiTheme.base * 22}px;
+    &:focus-within {
+      max-width: ${euiTheme.base * 30}px;
+    }
   `;
 
   return (
@@ -75,10 +81,11 @@ export const BreakdownFieldSelector = ({
         aria-label={i18n.translate('unifiedHistogram.breakdownFieldSelectorAriaLabel', {
           defaultMessage: 'Break down by',
         })}
-        singleSelection={{ asPlainText: true }}
+        singleSelection={SINGLE_SELECTION}
         options={fieldOptions}
         selectedOptions={selectedFields}
         onChange={onFieldChange}
+        truncationProps={TRUNCATION_PROPS}
         compressed
         fullWidth={true}
         onFocus={disableFieldPopover}
diff --git a/src/plugins/unified_search/public/filter_badge/filter_badge.tsx b/src/plugins/unified_search/public/filter_badge/filter_badge.tsx
index 9b9e669885cbed..7b20eab971e9c0 100644
--- a/src/plugins/unified_search/public/filter_badge/filter_badge.tsx
+++ b/src/plugins/unified_search/public/filter_badge/filter_badge.tsx
@@ -7,10 +7,11 @@
  */
 
 import React from 'react';
-import { EuiBadge, EuiTextColor, useEuiTheme } from '@elastic/eui';
+import { EuiBadge, EuiTextBlockTruncate, EuiTextColor, useEuiTheme } from '@elastic/eui';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import type { Filter } from '@kbn/es-query';
 import { isCombinedFilter } from '@kbn/es-query';
+import { css } from '@emotion/react';
 import { FilterBadgeGroup } from './filter_badge_group';
 import type { FilterLabelStatus } from '../filter_bar/filter_item/filter_item';
 import { badgePaddingCss, marginLeftLabelCss } from './filter_badge.styles';
@@ -59,24 +60,33 @@ function FilterBadge({
       iconSide="right"
       {...rest}
     >
-      {!hideAlias && filter.meta.alias !== null ? (
-        <>
-          <span className={marginLeftLabelCss(euiTheme)}>
-            {prefix}
-            {filter.meta.alias}
-            {filterLabelStatus && <>: {filterLabelValue}</>}
-          </span>
-        </>
-      ) : (
-        <div>
-          {isCombinedFilter(filter) && prefix}
-          <FilterBadgeGroup
-            filters={[filter]}
-            dataViews={dataViews}
-            filterLabelStatus={valueLabel}
-          />
-        </div>
-      )}
+      <span
+        css={css`
+          white-space: normal;
+          overflow-wrap: break-word;
+        `}
+      >
+        <EuiTextBlockTruncate lines={10}>
+          {!hideAlias && filter.meta.alias !== null ? (
+            <>
+              <span className={marginLeftLabelCss(euiTheme)}>
+                {prefix}
+                {filter.meta.alias}
+                {filterLabelStatus && <>: {filterLabelValue}</>}
+              </span>
+            </>
+          ) : (
+            <div>
+              {isCombinedFilter(filter) && prefix}
+              <FilterBadgeGroup
+                filters={[filter]}
+                dataViews={dataViews}
+                filterLabelStatus={valueLabel}
+              />
+            </div>
+          )}
+        </EuiTextBlockTruncate>
+      </span>
     </EuiBadge>
   );
 }
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx
index fb3acc3daa54cb..f6d539aadfe18b 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx
@@ -56,7 +56,11 @@ import {
 } from './lib/filter_editor_utils';
 import { FiltersBuilder } from '../../filters_builder';
 import { FilterBadgeGroup } from '../../filter_badge/filter_badge_group';
-import { flattenFilters } from './lib/helpers';
+import {
+  MIDDLE_TRUNCATION_PROPS,
+  SINGLE_SELECTION_AS_TEXT_PROPS,
+  flattenFilters,
+} from './lib/helpers';
 import {
   filterBadgeStyle,
   filterPreviewLabelStyle,
@@ -301,9 +305,10 @@ class FilterEditorComponent extends Component<FilterEditorProps, State> {
             selectedOptions={selectedDataView ? [selectedDataView] : []}
             getLabel={(indexPattern) => indexPattern.getName()}
             onChange={this.onIndexPatternChange}
-            singleSelection={{ asPlainText: true }}
             isClearable={false}
             data-test-subj="filterIndexPatternsSelect"
+            singleSelection={SINGLE_SELECTION_AS_TEXT_PROPS}
+            truncationProps={MIDDLE_TRUNCATION_PROPS}
           />
         </EuiFormRow>
         <EuiSpacer size="s" />
@@ -371,7 +376,7 @@ class FilterEditorComponent extends Component<FilterEditorProps, State> {
               </strong>
             }
           >
-            <EuiText size="xs" data-test-subj="filter-preview">
+            <EuiText size="xs" data-test-subj="filter-preview" css={{ overflowWrap: 'break-word' }}>
               <FilterBadgeGroup
                 filters={[localFilter]}
                 dataViews={this.props.indexPatterns}
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/generic_combo_box.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/generic_combo_box.tsx
index aa941fe3957330..65fdbfbd0a977a 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/generic_combo_box.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/generic_combo_box.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { EuiComboBox, EuiComboBoxOptionOption, useEuiTheme } from '@elastic/eui';
+import { EuiComboBox, EuiComboBoxOptionOption, useEuiTheme, EuiComboBoxProps } from '@elastic/eui';
 import React from 'react';
 import { genericComboBoxStyle } from './generic_combo_box.styles';
 
@@ -21,6 +21,7 @@ export interface GenericComboBoxProps<T> {
     OPTION_CONTENT_CLASSNAME: string
   ) => React.ReactNode;
   inputRef?: ((instance: HTMLInputElement | null) => void) | undefined;
+  truncationProps?: EuiComboBoxProps<T>['truncationProps'];
   [propName: string]: any;
 }
 
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/index.ts b/src/plugins/unified_search/public/filter_bar/filter_editor/index.ts
index f1ff6c50b57875..4192f415770bcd 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/index.ts
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/index.ts
@@ -36,7 +36,6 @@ export { PhrasesValuesInput } from './phrases_values_input';
 export { PhraseValueInput } from './phrase_value_input';
 export { RangeValueInput, isRangeParams } from './range_value_input';
 export { ValueInputType } from './value_input_type';
-export { TruncatedLabel } from './truncated_label';
 
 export { FilterEditor } from './filter_editor';
 export type { FilterEditorProps } from './filter_editor';
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/lib/helpers.ts b/src/plugins/unified_search/public/filter_bar/filter_editor/lib/helpers.ts
index 53c36525e1d35e..31c5c5a9656e3b 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/lib/helpers.ts
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/lib/helpers.ts
@@ -63,3 +63,6 @@ export const flattenFilters = (filter: Filter[]) => {
 
   return returnArray;
 };
+
+export const MIDDLE_TRUNCATION_PROPS = { truncation: 'middle' as const };
+export const SINGLE_SELECTION_AS_TEXT_PROPS = { asPlainText: true };
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
index 0a466c61770ce0..62648ae50d26a4 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_value_input.tsx
@@ -10,11 +10,10 @@ import { InjectedIntl, injectI18n } from '@kbn/i18n-react';
 import { uniq } from 'lodash';
 import React from 'react';
 import { withKibana } from '@kbn/kibana-react-plugin/public';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { GenericComboBox, GenericComboBoxProps } from './generic_combo_box';
 import { PhraseSuggestorUI, PhraseSuggestorProps } from './phrase_suggestor';
 import { ValueInputType } from './value_input_type';
-import { TruncatedLabel } from './truncated_label';
+import { MIDDLE_TRUNCATION_PROPS, SINGLE_SELECTION_AS_TEXT_PROPS } from './lib/helpers';
 
 interface PhraseValueInputProps extends PhraseSuggestorProps {
   value?: string;
@@ -26,10 +25,6 @@ interface PhraseValueInputProps extends PhraseSuggestorProps {
   invalid?: boolean;
 }
 
-const DEFAULT_COMBOBOX_WIDTH = 250;
-const COMBOBOX_PADDINGS = 10;
-const DEFAULT_FONT = '14px Inter';
-
 class PhraseValueInputUI extends PhraseSuggestorUI<PhraseValueInputProps> {
   comboBoxWrapperRef = React.createRef<HTMLDivElement>();
   inputRef: HTMLInputElement | null = null;
@@ -92,24 +87,11 @@ class PhraseValueInputUI extends PhraseSuggestorUI<PhraseValueInputProps> {
             });
           }}
           onSearchChange={this.onSearchChange}
-          singleSelection={{ asPlainText: true }}
           onCreateOption={onChange}
           isClearable={false}
           data-test-subj="filterParamsComboBox phraseParamsComboxBox"
-          renderOption={(option, searchValue) => (
-            <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
-              <EuiFlexItem>
-                <TruncatedLabel
-                  defaultComboboxWidth={DEFAULT_COMBOBOX_WIDTH}
-                  defaultFont={DEFAULT_FONT}
-                  comboboxPaddings={COMBOBOX_PADDINGS}
-                  comboBoxWrapperRef={this.comboBoxWrapperRef}
-                  label={option.label}
-                  search={searchValue}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          )}
+          singleSelection={SINGLE_SELECTION_AS_TEXT_PROPS}
+          truncationProps={MIDDLE_TRUNCATION_PROPS}
         />
       </div>
     );
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
index b31e6aad7d4388..513dad14458231 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx
@@ -10,11 +10,11 @@ import { InjectedIntl, injectI18n } from '@kbn/i18n-react';
 import { uniq } from 'lodash';
 import React from 'react';
 import { withKibana } from '@kbn/kibana-react-plugin/public';
-import { EuiFlexGroup, EuiFlexItem, withEuiTheme, WithEuiThemeProps } from '@elastic/eui';
+import { withEuiTheme, WithEuiThemeProps } from '@elastic/eui';
 import { GenericComboBox, GenericComboBoxProps } from './generic_combo_box';
 import { PhraseSuggestorUI, PhraseSuggestorProps } from './phrase_suggestor';
-import { TruncatedLabel } from './truncated_label';
 import { phrasesValuesComboboxCss } from './phrases_values_input.styles';
+import { MIDDLE_TRUNCATION_PROPS } from './lib/helpers';
 
 interface Props {
   values?: string[];
@@ -27,11 +27,6 @@ interface Props {
 }
 
 export type PhrasesValuesInputProps = Props & PhraseSuggestorProps & WithEuiThemeProps;
-
-const DEFAULT_COMBOBOX_WIDTH = 250;
-const COMBOBOX_PADDINGS = 20;
-const DEFAULT_FONT = '14px Inter';
-
 class PhrasesValuesInputUI extends PhraseSuggestorUI<PhrasesValuesInputProps> {
   comboBoxWrapperRef = React.createRef<HTMLDivElement>();
 
@@ -67,20 +62,7 @@ class PhrasesValuesInputUI extends PhraseSuggestorUI<PhrasesValuesInputProps> {
           isClearable={false}
           data-test-subj="filterParamsComboBox phrasesParamsComboxBox"
           isDisabled={disabled}
-          renderOption={(option, searchValue) => (
-            <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
-              <EuiFlexItem>
-                <TruncatedLabel
-                  defaultComboboxWidth={DEFAULT_COMBOBOX_WIDTH}
-                  defaultFont={DEFAULT_FONT}
-                  comboboxPaddings={COMBOBOX_PADDINGS}
-                  comboBoxWrapperRef={this.comboBoxWrapperRef}
-                  label={option.label}
-                  search={searchValue}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          )}
+          truncationProps={MIDDLE_TRUNCATION_PROPS}
         />
       </div>
     );
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.test.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.test.tsx
deleted file mode 100644
index 08236041ab93a0..00000000000000
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.test.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { ComponentProps } from 'react';
-import { mount } from 'enzyme';
-import { TruncatedLabel } from './truncated_label';
-
-describe('truncated_label', () => {
-  const defaultProps: ComponentProps<typeof TruncatedLabel> = {
-    defaultFont: '14px Inter',
-    defaultComboboxWidth: 130,
-    comboboxPaddings: 100,
-    comboBoxWrapperRef: React.createRef<HTMLDivElement>(),
-    search: '',
-    label: 'example_field',
-  };
-  it('displays passed label if shorter than passed labelLength', () => {
-    const wrapper = mount(<TruncatedLabel {...defaultProps} />);
-    expect(wrapper.text()).toEqual('example_field');
-  });
-  it('middle truncates label', () => {
-    const wrapper = mount(
-      <TruncatedLabel {...defaultProps} label="example_space.example_field.subcategory.subfield" />
-    );
-    expect(wrapper.text()).toEqual('example_….subcategory.subfield');
-  });
-  describe('with search value passed', () => {
-    it('constructs truncated label when searching for the string of index = 0', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search="example_space"
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('example_space.example_field.s…');
-      expect(wrapper.find('mark').text()).toEqual('example_space');
-    });
-    it('constructs truncated label when searching for the string in the middle', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'ample_field'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…ample_field.subcategory.subf…');
-      expect(wrapper.find('mark').text()).toEqual('ample_field');
-    });
-    it('constructs truncated label when searching for the string at the end of the label', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'subf'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…le_field.subcategory.subfield');
-      expect(wrapper.find('mark').text()).toEqual('subf');
-    });
-
-    it('constructs truncated label when searching for the string longer than the truncated width and highlights the whole content', () => {
-      const wrapper = mount(
-        <TruncatedLabel
-          {...defaultProps}
-          search={'ample_space.example_field.subcategory.subfie'}
-          label="example_space.example_field.subcategory.subfield"
-        />
-      );
-      expect(wrapper.text()).toEqual('…ample_space.example_field.su…');
-      expect(wrapper.find('mark').text()).toEqual('…ample_space.example_field.su…');
-    });
-  });
-});
diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.tsx
deleted file mode 100644
index 21304ad244edfc..00000000000000
--- a/src/plugins/unified_search/public/filter_bar/filter_editor/truncated_label.tsx
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { RefObject, useMemo } from 'react';
-import useEffectOnce from 'react-use/lib/useEffectOnce';
-import { EuiMark } from '@elastic/eui';
-import { EuiHighlight } from '@elastic/eui';
-import { throttle } from 'lodash';
-
-interface TruncatedLabelProps {
-  label: string;
-  search: string;
-  comboBoxWrapperRef: RefObject<HTMLDivElement | null>;
-  defaultFont: string;
-  defaultComboboxWidth: number;
-  comboboxPaddings: number;
-}
-
-const createContext = () =>
-  document.createElement('canvas').getContext('2d') as CanvasRenderingContext2D;
-
-// extracted from getTextWidth for performance
-const context = createContext();
-
-const getTextWidth = (text: string, font: string) => {
-  const ctx = context ?? createContext();
-  ctx.font = font;
-  const metrics = ctx.measureText(text);
-  return metrics.width;
-};
-
-const truncateLabel = (
-  width: number,
-  font: string,
-  label: string,
-  approximateLength: number,
-  labelFn: (label: string, length: number) => string
-) => {
-  let output = labelFn(label, approximateLength);
-
-  while (getTextWidth(output, font) > width) {
-    approximateLength = approximateLength - 1;
-    const newOutput = labelFn(label, approximateLength);
-    if (newOutput === output) {
-      break;
-    }
-    output = newOutput;
-  }
-  return output;
-};
-
-export const TruncatedLabel = React.memo(function TruncatedLabel({
-  label,
-  comboBoxWrapperRef,
-  search,
-  defaultFont,
-  defaultComboboxWidth,
-  comboboxPaddings,
-}: TruncatedLabelProps) {
-  const [labelProps, setLabelProps] = React.useState<{
-    width: number;
-    font: string;
-  }>({
-    width: defaultComboboxWidth - comboboxPaddings,
-    font: defaultFont,
-  });
-  const computeStyles = (_e: UIEvent | undefined, shouldRecomputeAll = false) => {
-    if (comboBoxWrapperRef.current) {
-      const current = {
-        ...labelProps,
-        width: comboBoxWrapperRef.current.clientWidth - comboboxPaddings,
-      };
-      if (shouldRecomputeAll) {
-        current.font = window.getComputedStyle(comboBoxWrapperRef.current).font;
-      }
-      setLabelProps(current);
-    }
-  };
-
-  const handleResize = throttle((_e: UIEvent | undefined, shouldRecomputeAll = false) => {
-    computeStyles(_e, shouldRecomputeAll);
-  }, 50);
-
-  useEffectOnce(() => {
-    if (comboBoxWrapperRef.current) {
-      handleResize(undefined, true);
-    }
-
-    window.addEventListener('resize', handleResize);
-    return () => {
-      window.removeEventListener('resize', handleResize);
-    };
-  });
-
-  const textWidth = useMemo(() => getTextWidth(label, labelProps.font), [label, labelProps.font]);
-
-  if (textWidth < labelProps.width) {
-    return <EuiHighlight search={search}>{label}</EuiHighlight>;
-  }
-
-  const searchPosition = label.indexOf(search);
-  const approximateLen = Math.round((labelProps.width * label.length) / textWidth);
-  const separator = `…`;
-  let separatorsLength = separator.length;
-  let labelFn;
-
-  if (!search || searchPosition === -1) {
-    labelFn = (text: string, length: number) =>
-      `${text.substr(0, 8)}${separator}${text.substr(text.length - (length - 8))}`;
-  } else if (searchPosition === 0) {
-    // search phrase at the beginning
-    labelFn = (text: string, length: number) => `${text.substr(0, length)}${separator}`;
-  } else if (approximateLen > label.length - searchPosition) {
-    // search phrase close to the end or at the end
-    labelFn = (text: string, length: number) => `${separator}${text.substr(text.length - length)}`;
-  } else {
-    // search phrase is in the middle
-    labelFn = (text: string, length: number) =>
-      `${separator}${text.substr(searchPosition, length)}${separator}`;
-    separatorsLength = 2 * separator.length;
-  }
-
-  const outputLabel = truncateLabel(
-    labelProps.width,
-    labelProps.font,
-    label,
-    approximateLen,
-    labelFn
-  );
-
-  return search.length < outputLabel.length - separatorsLength ? (
-    <EuiHighlight search={search}>{outputLabel}</EuiHighlight>
-  ) : (
-    <EuiMark>{outputLabel}</EuiMark>
-  );
-});
diff --git a/src/plugins/unified_search/public/filter_bar/filter_item/filter_item.tsx b/src/plugins/unified_search/public/filter_bar/filter_item/filter_item.tsx
index 9c25c7eaf06e83..d14891c5fc3ff3 100644
--- a/src/plugins/unified_search/public/filter_bar/filter_item/filter_item.tsx
+++ b/src/plugins/unified_search/public/filter_bar/filter_item/filter_item.tsx
@@ -80,7 +80,7 @@ export type FilterLabelStatus =
   | typeof FILTER_ITEM_WARNING
   | typeof FILTER_ITEM_ERROR;
 
-export const FILTER_EDITOR_WIDTH = 960;
+export const FILTER_EDITOR_WIDTH = 1200;
 
 function FilterItemComponent(props: FilterItemProps) {
   const { onCloseFilterPopover, onLocalFilterCreate, onLocalFilterUpdate } = props;
diff --git a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
index 8c3dc65758c292..540226caef525c 100644
--- a/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
+++ b/src/plugins/unified_search/public/filters_builder/filter_item/field_input.tsx
@@ -11,20 +11,13 @@ import { i18n } from '@kbn/i18n';
 import { FieldIcon } from '@kbn/react-field';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  useGeneratedHtmlId,
-  EuiComboBox,
-  EuiComboBoxOptionOption,
-} from '@elastic/eui';
+import { useGeneratedHtmlId, EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 import { getFilterableFields } from '../../filter_bar/filter_editor';
 import { FiltersBuilderContextType } from '../context';
-import { TruncatedLabel } from '../../filter_bar/filter_editor';
-
-const DEFAULT_COMBOBOX_WIDTH = 205;
-const COMBOBOX_PADDINGS = 100;
-const DEFAULT_FONT = '14px Inter';
+import {
+  MIDDLE_TRUNCATION_PROPS,
+  SINGLE_SELECTION_AS_TEXT_PROPS,
+} from '../../filter_bar/filter_editor/lib/helpers';
 
 export const strings = {
   getFieldSelectPlaceholderLabel: () =>
@@ -62,6 +55,7 @@ export function FieldInput({ field, dataView, onHandleField }: FieldInputProps)
       return {
         label,
         value: dataViewField.type as KBN_FIELD_TYPES,
+        prepend: <FieldIcon type={dataViewField.type} fill="none" className="eui-alignMiddle" />,
       };
     },
     [suggestionsAbstraction]
@@ -103,30 +97,14 @@ export function FieldInput({ field, dataView, onHandleField }: FieldInputProps)
         isDisabled={disabled}
         placeholder={strings.getFieldSelectPlaceholderLabel()}
         sortMatchesBy="startsWith"
-        singleSelection={{ asPlainText: true }}
         aria-label={strings.getFieldSelectPlaceholderLabel()}
         isClearable={false}
         compressed
         fullWidth
         onFocus={handleFocus}
         data-test-subj="filterFieldSuggestionList"
-        renderOption={(option, searchValue) => (
-          <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
-            <EuiFlexItem grow={null}>
-              <FieldIcon type={option.value!} fill="none" />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <TruncatedLabel
-                defaultComboboxWidth={DEFAULT_COMBOBOX_WIDTH}
-                defaultFont={DEFAULT_FONT}
-                comboboxPaddings={COMBOBOX_PADDINGS}
-                comboBoxWrapperRef={comboBoxWrapperRef}
-                label={option.label}
-                search={searchValue}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        )}
+        singleSelection={SINGLE_SELECTION_AS_TEXT_PROPS}
+        truncationProps={MIDDLE_TRUNCATION_PROPS}
       />
     </div>
   );
diff --git a/src/plugins/unified_search/public/query_string_input/query_string_input.tsx b/src/plugins/unified_search/public/query_string_input/query_string_input.tsx
index 386b5c4aa0bd0f..597d5788df60ba 100644
--- a/src/plugins/unified_search/public/query_string_input/query_string_input.tsx
+++ b/src/plugins/unified_search/public/query_string_input/query_string_input.tsx
@@ -29,6 +29,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { compact, debounce, isEmpty, isEqual, isFunction, partition } from 'lodash';
 import { CoreStart, DocLinksStart, Toast } from '@kbn/core/public';
 import type { Query } from '@kbn/es-query';
+import { euiThemeVars } from '@kbn/ui-theme';
 import { DataPublicPluginStart, getQueryLog } from '@kbn/data-plugin/public';
 import { type DataView, DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
 import type { PersistedLog } from '@kbn/data-plugin/public';
@@ -801,7 +802,11 @@ export default class QueryStringInputUI extends PureComponent<QueryStringInputPr
         <EuiOutsideClickDetector onOutsideClick={this.onOutsideClick}>
           <div
             {...ariaCombobox}
-            style={{ position: 'relative', width: '100%' }}
+            style={{
+              position: 'relative',
+              width: '100%',
+              zIndex: euiThemeVars.euiZLevel1,
+            }}
             aria-label={strings.getQueryBarComboboxAriaLabel(this.props.appName)}
             aria-haspopup="true"
             aria-expanded={this.state.isSuggestionsVisible}
diff --git a/src/plugins/unified_search/server/index.ts b/src/plugins/unified_search/server/index.ts
index d1948f32e2fe9e..8f786e0ed10771 100644
--- a/src/plugins/unified_search/server/index.ts
+++ b/src/plugins/unified_search/server/index.ts
@@ -8,7 +8,7 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { ConfigSchema, configSchema } from '../config';
-import {
+import type {
   UnifiedSearchServerPlugin,
   UnifiedSearchServerPluginSetup,
   UnifiedSearchServerPluginStart,
@@ -21,7 +21,8 @@ import { autocompleteConfigDeprecationProvider } from './config_deprecations';
  * @public
  */
 
-export function plugin(initializerContext: PluginInitializerContext<ConfigSchema>) {
+export async function plugin(initializerContext: PluginInitializerContext<ConfigSchema>) {
+  const { UnifiedSearchServerPlugin } = await import('./plugin');
   return new UnifiedSearchServerPlugin(initializerContext);
 }
 
@@ -29,7 +30,7 @@ export type {
   UnifiedSearchServerPluginSetup as PluginSetup,
   UnifiedSearchServerPluginStart as PluginStart,
 };
-export { UnifiedSearchServerPlugin as Plugin };
+export type { UnifiedSearchServerPlugin as Plugin };
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   deprecations: autocompleteConfigDeprecationProvider,
diff --git a/src/plugins/usage_collection/public/plugin.tsx b/src/plugins/usage_collection/public/plugin.tsx
index b4193f44fb8e40..635e33f8fd0b08 100644
--- a/src/plugins/usage_collection/public/plugin.tsx
+++ b/src/plugins/usage_collection/public/plugin.tsx
@@ -18,6 +18,7 @@ import type {
   HttpSetup,
 } from '@kbn/core/public';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
+import { isSyntheticsMonitor } from '@kbn/analytics-collection-utils';
 import type { ScreenshotModePluginStart } from '@kbn/screenshot-mode-plugin/public';
 import { createReporter, trackApplicationUsageChange } from './services';
 import { ApplicationUsageContext } from './components/track_application_view';
@@ -150,7 +151,8 @@ export class UsageCollectionPlugin
     if (
       this.config.uiCounters.enabled &&
       !isUnauthenticated(http) &&
-      !screenshotMode.isScreenshotMode()
+      !screenshotMode.isScreenshotMode() &&
+      !isSyntheticsMonitor()
     ) {
       this.reporter.start();
       this.applicationUsageTracker.start();
diff --git a/src/plugins/usage_collection/server/index.ts b/src/plugins/usage_collection/server/index.ts
index 7e66b1bd323b03..38298b42ed9c19 100644
--- a/src/plugins/usage_collection/server/index.ts
+++ b/src/plugins/usage_collection/server/index.ts
@@ -7,7 +7,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { UsageCollectionPlugin } from './plugin';
 
 export type {
   Collector,
@@ -31,5 +30,7 @@ export { USAGE_COUNTERS_SAVED_OBJECT_TYPE, serializeCounterKey } from './usage_c
 
 export type { UsageCollectionSetup } from './plugin';
 export { config } from './config';
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new UsageCollectionPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { UsageCollectionPlugin } = await import('./plugin');
+  return new UsageCollectionPlugin(initializerContext);
+};
diff --git a/src/plugins/usage_collection/tsconfig.json b/src/plugins/usage_collection/tsconfig.json
index db86bf99273df3..9491794c07f60e 100644
--- a/src/plugins/usage_collection/tsconfig.json
+++ b/src/plugins/usage_collection/tsconfig.json
@@ -21,6 +21,7 @@
     "@kbn/utility-types",
     "@kbn/i18n",
     "@kbn/core-http-server-mocks",
+    "@kbn/analytics-collection-utils",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/vis_type_markdown/server/index.ts b/src/plugins/vis_type_markdown/server/index.ts
index d2deba39e99875..3f3bae7d810d68 100644
--- a/src/plugins/vis_type_markdown/server/index.ts
+++ b/src/plugins/vis_type_markdown/server/index.ts
@@ -17,7 +17,7 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   ],
 };
 
-export const plugin = () => ({
+export const plugin = async () => ({
   setup() {},
   start() {},
 });
diff --git a/src/plugins/vis_types/gauge/server/index.ts b/src/plugins/vis_types/gauge/server/index.ts
index bffab6592194fd..e6d35075c8fb07 100755
--- a/src/plugins/vis_types/gauge/server/index.ts
+++ b/src/plugins/vis_types/gauge/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
 import { configSchema, GaugeConfig } from '../config';
-import { VisTypeGaugeServerPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<GaugeConfig> = {
   exposeToBrowser: {
@@ -17,5 +16,7 @@ export const config: PluginConfigDescriptor<GaugeConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new VisTypeGaugeServerPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { VisTypeGaugeServerPlugin } = await import('./plugin');
+  return new VisTypeGaugeServerPlugin(initializerContext);
+};
diff --git a/src/plugins/vis_types/heatmap/server/index.ts b/src/plugins/vis_types/heatmap/server/index.ts
index 752bf1a381563c..34c3783b62c9be 100644
--- a/src/plugins/vis_types/heatmap/server/index.ts
+++ b/src/plugins/vis_types/heatmap/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { configSchema, HeatmapConfig } from '../config';
-import { VisTypeHeatmapServerPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<HeatmapConfig> = {
   exposeToBrowser: {
@@ -17,5 +16,7 @@ export const config: PluginConfigDescriptor<HeatmapConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new VisTypeHeatmapServerPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { VisTypeHeatmapServerPlugin } = await import('./plugin');
+  return new VisTypeHeatmapServerPlugin(initializerContext);
+};
diff --git a/src/plugins/vis_types/metric/server/index.ts b/src/plugins/vis_types/metric/server/index.ts
index 49359ab970e05f..bc8d0b0f0f6851 100644
--- a/src/plugins/vis_types/metric/server/index.ts
+++ b/src/plugins/vis_types/metric/server/index.ts
@@ -22,7 +22,7 @@ interface PluginSetupDependencies {
   visualizations: VisualizationsServerSetup;
 }
 
-export const plugin = (initializerContext: PluginInitializerContext) => ({
+export const plugin = async (initializerContext: PluginInitializerContext) => ({
   setup(core: CoreSetup, plugins: PluginSetupDependencies) {
     const { readOnly } = initializerContext.config.get<MetricConfig>();
     if (readOnly) {
diff --git a/src/plugins/vis_types/pie/server/index.ts b/src/plugins/vis_types/pie/server/index.ts
index e1b9c6187357d1..6b139e916adc9e 100644
--- a/src/plugins/vis_types/pie/server/index.ts
+++ b/src/plugins/vis_types/pie/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { configSchema, PieConfig } from '../config';
-import { VisTypePieServerPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<PieConfig> = {
   exposeToBrowser: {
@@ -17,5 +16,7 @@ export const config: PluginConfigDescriptor<PieConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new VisTypePieServerPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { VisTypePieServerPlugin } = await import('./plugin');
+  return new VisTypePieServerPlugin(initializerContext);
+};
diff --git a/src/plugins/vis_types/timelion/server/index.ts b/src/plugins/vis_types/timelion/server/index.ts
index bdff2a33c3ab2c..e9b312c8731b0e 100644
--- a/src/plugins/vis_types/timelion/server/index.ts
+++ b/src/plugins/vis_types/timelion/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { configSchema, TimelionConfig } from '../config';
-import { TimelionPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<TimelionConfig> = {
   exposeToBrowser: {
@@ -18,5 +17,7 @@ export const config: PluginConfigDescriptor<TimelionConfig> = {
   deprecations: ({ unused }) => [unused('graphiteUrls', { level: 'warning' })],
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new TimelionPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { TimelionPlugin } = await import('./plugin');
+  return new TimelionPlugin(initializerContext);
+};
diff --git a/src/plugins/vis_types/timeseries/server/index.ts b/src/plugins/vis_types/timeseries/server/index.ts
index 0faecf4c03adc1..9ecb8a92d27d81 100644
--- a/src/plugins/vis_types/timeseries/server/index.ts
+++ b/src/plugins/vis_types/timeseries/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
 import { VisTypeTimeseriesConfig, config as configSchema } from '../config';
-import { VisTypeTimeseriesPlugin } from './plugin';
 
 export type { VisTypeTimeseriesSetup } from './plugin';
 
@@ -21,7 +20,8 @@ export const config: PluginConfigDescriptor<VisTypeTimeseriesConfig> = {
   schema: configSchema,
 };
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { VisTypeTimeseriesPlugin } = await import('./plugin');
   return new VisTypeTimeseriesPlugin(initializerContext);
 }
 
diff --git a/src/plugins/vis_types/vega/server/index.ts b/src/plugins/vis_types/vega/server/index.ts
index 42e03c0ceefc5d..b761d699223724 100644
--- a/src/plugins/vis_types/vega/server/index.ts
+++ b/src/plugins/vis_types/vega/server/index.ts
@@ -9,7 +9,6 @@
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { configSchema, ConfigSchema } from '../config';
-import { VisTypeVegaPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   exposeToBrowser: {
@@ -18,7 +17,8 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
 };
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { VisTypeVegaPlugin } = await import('./plugin');
   return new VisTypeVegaPlugin(initializerContext);
 }
 
diff --git a/src/plugins/vis_types/vislib/server/index.ts b/src/plugins/vis_types/vislib/server/index.ts
index 8c46f2810542d4..03b3d03d7fc252 100644
--- a/src/plugins/vis_types/vislib/server/index.ts
+++ b/src/plugins/vis_types/vislib/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginConfigDescriptor } from '@kbn/core/server';
 import { configSchema, VislibConfig } from '../config';
-import { VisTypeVislibServerPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<VislibConfig> = {
   exposeToBrowser: {
@@ -17,4 +16,7 @@ export const config: PluginConfigDescriptor<VislibConfig> = {
   schema: configSchema,
 };
 
-export const plugin = () => new VisTypeVislibServerPlugin();
+export const plugin = async () => {
+  const { VisTypeVislibServerPlugin } = await import('./plugin');
+  return new VisTypeVislibServerPlugin();
+};
diff --git a/src/plugins/vis_types/xy/server/index.ts b/src/plugins/vis_types/xy/server/index.ts
index d6b73627dd73a5..f0484adf9a5ecc 100644
--- a/src/plugins/vis_types/xy/server/index.ts
+++ b/src/plugins/vis_types/xy/server/index.ts
@@ -8,7 +8,6 @@
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { configSchema, XyConfig } from '../config';
-import { VisTypeXYServerPlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<XyConfig> = {
   exposeToBrowser: {
@@ -17,5 +16,7 @@ export const config: PluginConfigDescriptor<XyConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new VisTypeXYServerPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { VisTypeXYServerPlugin } = await import('./plugin');
+  return new VisTypeXYServerPlugin(initializerContext);
+};
diff --git a/src/plugins/visualizations/server/index.ts b/src/plugins/visualizations/server/index.ts
index f40fb9885388f0..adb65507d409c9 100644
--- a/src/plugins/visualizations/server/index.ts
+++ b/src/plugins/visualizations/server/index.ts
@@ -7,12 +7,12 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { VisualizationsPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { VisualizationsPlugin } = await import('./plugin');
   return new VisualizationsPlugin(initializerContext);
 }
 
diff --git a/test/analytics/plugins/analytics_ftr_helpers/server/index.ts b/test/analytics/plugins/analytics_ftr_helpers/server/index.ts
index 637348226e25c8..190ec73cdd08ed 100644
--- a/test/analytics/plugins/analytics_ftr_helpers/server/index.ts
+++ b/test/analytics/plugins/analytics_ftr_helpers/server/index.ts
@@ -8,4 +8,4 @@
 
 import { AnalyticsFTRHelpers } from './plugin';
 
-export const plugin = () => new AnalyticsFTRHelpers();
+export const plugin = async () => new AnalyticsFTRHelpers();
diff --git a/test/analytics/plugins/analytics_plugin_a/server/index.ts b/test/analytics/plugins/analytics_plugin_a/server/index.ts
index 65d2593c427f56..3decfbd0b42019 100644
--- a/test/analytics/plugins/analytics_plugin_a/server/index.ts
+++ b/test/analytics/plugins/analytics_plugin_a/server/index.ts
@@ -8,4 +8,4 @@
 
 import { AnalyticsPluginAPlugin } from './plugin';
 
-export const plugin = () => new AnalyticsPluginAPlugin();
+export const plugin = async () => new AnalyticsPluginAPlugin();
diff --git a/test/analytics/tests/instrumented_events/from_the_server/core_context_providers.ts b/test/analytics/tests/instrumented_events/from_the_server/core_context_providers.ts
index cf781bed5ad0ea..1d6b187c207f1f 100644
--- a/test/analytics/tests/instrumented_events/from_the_server/core_context_providers.ts
+++ b/test/analytics/tests/instrumented_events/from_the_server/core_context_providers.ts
@@ -17,7 +17,7 @@ export default function ({ getService }: FtrProviderContext) {
   describe('Core Context Providers', () => {
     let event: Event<Record<string, unknown>>;
     before(async () => {
-      let i = 2;
+      let i = 1;
       do {
         // Wait until we get a GREEN "status_changed" event. At that point all the context providers should be set up.
         const events = await ebtServerHelper.getEvents(i, {
diff --git a/test/analytics/tests/instrumented_events/from_the_server/core_overall_status_changed.ts b/test/analytics/tests/instrumented_events/from_the_server/core_overall_status_changed.ts
index 8f904c4c8844c9..aa11e352495097 100644
--- a/test/analytics/tests/instrumented_events/from_the_server/core_overall_status_changed.ts
+++ b/test/analytics/tests/instrumented_events/from_the_server/core_overall_status_changed.ts
@@ -14,39 +14,35 @@ export default function ({ getService }: FtrProviderContext) {
   const ebtServerHelper = getService('kibana_ebt_server');
 
   describe('core-overall_status_changed', () => {
-    let initialEvent: Event<Record<string, unknown>>;
-    let secondEvent: Event<Record<string, unknown>>;
+    let currentEvent: Event<Record<string, unknown>>;
 
     before(async () => {
-      [initialEvent, secondEvent] = await ebtServerHelper.getEvents(2, {
+      [currentEvent] = await ebtServerHelper.getEvents(1, {
         eventTypes: ['core-overall_status_changed'],
       });
     });
 
-    it('should emit the initial "degraded" event with the context set to `initializing`', () => {
+    it('should emit an initial event with the context set to `initializing`', async () => {
+      const initialEvent = currentEvent;
       expect(initialEvent.event_type).to.eql('core-overall_status_changed');
-      expect(initialEvent.context).to.have.property('overall_status_level', 'initializing');
-      expect(initialEvent.context).to.have.property(
-        'overall_status_summary',
-        'Kibana is starting up'
-      );
-      expect(initialEvent.properties).to.have.property('overall_status_level', 'degraded');
-      expect(initialEvent.properties).to.have.property('overall_status_summary');
-      expect(initialEvent.properties.overall_status_summary).to.be.a('string');
+      expect(initialEvent.context.overall_status_level).to.eql('initializing');
+      expect(initialEvent.context.overall_status_summary).to.eql('Kibana is starting up');
     });
 
-    it('should emit the 2nd event as `available` with the context set to the previous values', () => {
-      expect(secondEvent.event_type).to.eql('core-overall_status_changed');
-      expect(secondEvent.context).to.have.property(
-        'overall_status_level',
-        initialEvent.properties.overall_status_level
-      );
-      expect(secondEvent.context).to.have.property(
-        'overall_status_summary',
-        initialEvent.properties.overall_status_summary
-      );
-      expect(secondEvent.properties.overall_status_level).to.be.a('string'); // Ideally we would test it as `available`, but we can't do that as it may result flaky for many side effects in the CI.
-      expect(secondEvent.properties.overall_status_summary).to.be.a('string');
+    it('should emit an event with status `available` eventually', async () => {
+      const isAvailable = (ev: Event<Record<string, unknown>>) =>
+        ev.properties.overall_status_level === 'available';
+
+      for (let i = 2; i <= 10 && !isAvailable(currentEvent); ++i) {
+        currentEvent = (
+          await ebtServerHelper.getEvents(i, {
+            eventTypes: ['core-overall_status_changed'],
+          })
+        ).pop()!;
+      }
+
+      // at this point, Kibana is NOT available after 10 emissions!
+      expect(isAvailable(currentEvent)).to.eql(true);
     });
   });
 }
diff --git a/test/api_integration/apis/ui_counters/ui_counters.ts b/test/api_integration/apis/ui_counters/ui_counters.ts
index 9d3bfa9c25b81f..3016af858d6bea 100644
--- a/test/api_integration/apis/ui_counters/ui_counters.ts
+++ b/test/api_integration/apis/ui_counters/ui_counters.ts
@@ -8,10 +8,11 @@
 
 import expect from '@kbn/expect';
 import { ReportManager, METRIC_TYPE, UiCounterMetricType, Report } from '@kbn/analytics';
-import moment from 'moment';
 import { UsageCountersSavedObject } from '@kbn/usage-collection-plugin/server';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
+const APP_NAME = 'myApp';
+
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -19,7 +20,7 @@ export default function ({ getService }: FtrProviderContext) {
 
   const createUiCounterEvent = (eventName: string, type: UiCounterMetricType, count = 1) => ({
     eventName,
-    appName: 'myApp',
+    appName: APP_NAME,
     type,
     count,
   });
@@ -44,39 +45,54 @@ export default function ({ getService }: FtrProviderContext) {
       .expect(200);
   };
 
-  const getCounterById = (
+  const getCounter = (
     savedObjects: UsageCountersSavedObject[],
-    targetId: string
-  ): UsageCountersSavedObject => {
-    const savedObject = savedObjects.find(({ id }: { id: string }) => id === targetId);
-    if (!savedObject) {
-      throw new Error(`Unable to find savedObject id ${targetId}`);
+    eventName: string,
+    counterType: UiCounterMetricType
+  ): UsageCountersSavedObject[] => {
+    const matchingEventName = savedObjects.filter(
+      ({ attributes }) => attributes.counterName === `${APP_NAME}:${eventName}`
+    );
+    if (!matchingEventName.length) {
+      throw new Error(
+        `Unable to find savedObject with Event Name ${eventName}, got ${JSON.stringify(
+          savedObjects
+        )}`
+      );
+    }
+
+    const matchingCounterType = matchingEventName.filter(
+      ({ attributes }) => attributes.counterType === counterType
+    );
+    if (!matchingCounterType.length) {
+      throw new Error(
+        `Unable to find savedObject with matching Counter type ${counterType}, got ${JSON.stringify(
+          savedObjects
+        )}`
+      );
     }
 
-    return savedObject;
+    return matchingCounterType;
   };
 
-  // FLAKY: https://github.com/elastic/kibana/issues/98240
-  describe.skip('UI Counters API', () => {
-    const dayDate = moment().format('DDMMYYYY');
-    before(async () => await esArchiver.emptyKibanaIndex());
+  describe('UI Counters API', () => {
+    beforeEach(async () => await esArchiver.emptyKibanaIndex());
 
     it('stores ui counter events in usage counters savedObjects', async () => {
       const reportManager = new ReportManager();
+      const eventName = 'my_event';
+      const counterEvent = createUiCounterEvent(eventName, METRIC_TYPE.COUNT);
 
-      const { report } = reportManager.assignReports([
-        createUiCounterEvent('my_event', METRIC_TYPE.COUNT),
-      ]);
+      const { report } = reportManager.assignReports([counterEvent]);
 
       await sendReport(report);
-
       await retry.waitForWithTimeout('reported events to be stored into ES', 8000, async () => {
         const savedObjects = await fetchUsageCountersObjects();
-        const countTypeEvent = getCounterById(
-          savedObjects,
-          `uiCounter:${dayDate}:${METRIC_TYPE.COUNT}:myApp:my_event`
-        );
-        expect(countTypeEvent.attributes.count).to.eql(1);
+
+        const countTypeEvents = getCounter(savedObjects, eventName, METRIC_TYPE.COUNT);
+
+        expect(countTypeEvents.length).to.eql(1);
+        expect(countTypeEvents[0].attributes.count).to.eql(1);
         return true;
       });
     });
@@ -85,33 +101,40 @@ export default function ({ getService }: FtrProviderContext) {
       const reportManager = new ReportManager();
       const hrTime = process.hrtime();
       const nano = hrTime[0] * 1000000000 + hrTime[1];
-      const uniqueEventName = `my_event_${nano}`;
+      const firstUniqueEventName = `my_event_${nano}`;
+      const secondUniqueEventName = `my_event_${nano}_2`;
       const { report } = reportManager.assignReports([
-        createUiCounterEvent(uniqueEventName, METRIC_TYPE.COUNT),
-        createUiCounterEvent(`${uniqueEventName}_2`, METRIC_TYPE.COUNT),
-        createUiCounterEvent(uniqueEventName, METRIC_TYPE.CLICK, 2),
+        createUiCounterEvent(firstUniqueEventName, METRIC_TYPE.COUNT),
+        createUiCounterEvent(secondUniqueEventName, METRIC_TYPE.COUNT),
+        createUiCounterEvent(firstUniqueEventName, METRIC_TYPE.CLICK, 2),
       ]);
 
       await sendReport(report);
       await retry.waitForWithTimeout('reported events to be stored into ES', 8000, async () => {
         const savedObjects = await fetchUsageCountersObjects();
-        const countTypeEvent = getCounterById(
+        const firstEventWithCountTypeEvents = getCounter(
           savedObjects,
-          `uiCounter:${dayDate}:${METRIC_TYPE.COUNT}:myApp:${uniqueEventName}`
+          firstUniqueEventName,
+          METRIC_TYPE.COUNT
         );
-        expect(countTypeEvent.attributes.count).to.eql(1);
+        expect(firstEventWithCountTypeEvents.length).to.eql(1);
+        expect(firstEventWithCountTypeEvents[0].attributes.count).to.eql(1);
 
-        const clickTypeEvent = getCounterById(
+        const firstEventWithClickTypeEvents = getCounter(
           savedObjects,
-          `uiCounter:${dayDate}:${METRIC_TYPE.CLICK}:myApp:${uniqueEventName}`
+          firstUniqueEventName,
+          METRIC_TYPE.CLICK
         );
-        expect(clickTypeEvent.attributes.count).to.eql(2);
+        expect(firstEventWithClickTypeEvents.length).to.eql(1);
+        expect(firstEventWithClickTypeEvents[0].attributes.count).to.eql(2);
 
-        const secondEvent = getCounterById(
+        const secondEventWithCountTypeEvents = getCounter(
           savedObjects,
-          `uiCounter:${dayDate}:${METRIC_TYPE.COUNT}:myApp:${uniqueEventName}_2`
+          secondUniqueEventName,
+          METRIC_TYPE.COUNT
         );
-        expect(secondEvent.attributes.count).to.eql(1);
+        expect(secondEventWithCountTypeEvents.length).to.eql(1);
+        expect(secondEventWithCountTypeEvents[0].attributes.count).to.eql(1);
         return true;
       });
     });
diff --git a/test/common/plugins/newsfeed/server/index.ts b/test/common/plugins/newsfeed/server/index.ts
index 21e28f5435cc20..192de4a3c47e3d 100644
--- a/test/common/plugins/newsfeed/server/index.ts
+++ b/test/common/plugins/newsfeed/server/index.ts
@@ -9,6 +9,6 @@
 import type { PluginInitializerContext } from '@kbn/core/server';
 import { NewsFeedSimulatorPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
   return new NewsFeedSimulatorPlugin(initializerContext);
 }
diff --git a/test/common/plugins/otel_metrics/server/index.ts b/test/common/plugins/otel_metrics/server/index.ts
index eb5f587592cae4..2e542342b04c0d 100644
--- a/test/common/plugins/otel_metrics/server/index.ts
+++ b/test/common/plugins/otel_metrics/server/index.ts
@@ -8,4 +8,4 @@
 
 import { OpenTelemetryUsageTest } from './plugin';
 
-export const plugin = () => new OpenTelemetryUsageTest();
+export const plugin = async () => new OpenTelemetryUsageTest();
diff --git a/test/functional/apps/console/_xjson.ts b/test/functional/apps/console/_xjson.ts
index 445bfa5d42f0aa..6a4f352a3ad013 100644
--- a/test/functional/apps/console/_xjson.ts
+++ b/test/functional/apps/console/_xjson.ts
@@ -15,7 +15,8 @@ export default ({ getService, getPageObjects }: FtrProviderContext) => {
   const log = getService('log');
   const PageObjects = getPageObjects(['common', 'console', 'header']);
 
-  // FLAKY: https://github.com/elastic/kibana/issues/145477
+  // FLAKY: https://github.com/elastic/kibana/issues/171259
+  // FLAKY: https://github.com/elastic/kibana/issues/158484
   describe.skip('XJSON', function testXjson() {
     this.tags('includeFirefox');
     before(async () => {
diff --git a/test/functional/apps/discover/group1/_discover.ts b/test/functional/apps/discover/group1/_discover.ts
index 63f9109ba8bd28..a041939f2b809e 100644
--- a/test/functional/apps/discover/group1/_discover.ts
+++ b/test/functional/apps/discover/group1/_discover.ts
@@ -138,7 +138,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
         // reset to persisted state
         await queryBar.clearQuery();
-        await PageObjects.discover.clickResetSavedSearchButton();
+        await PageObjects.discover.revertUnsavedChanges();
         const expectedHitCount = '14,004';
         await retry.try(async function () {
           expect(await queryBar.getQueryString()).to.be('');
diff --git a/test/functional/apps/discover/group1/_discover_histogram.ts b/test/functional/apps/discover/group1/_discover_histogram.ts
index d69bd153b3d564..43f39b417864cc 100644
--- a/test/functional/apps/discover/group1/_discover_histogram.ts
+++ b/test/functional/apps/discover/group1/_discover_histogram.ts
@@ -320,7 +320,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
       await PageObjects.discover.toggleChartVisibility();
       await PageObjects.discover.waitUntilSearchingHasFinished();
-      await PageObjects.discover.clickResetSavedSearchButton();
+      await PageObjects.discover.revertUnsavedChanges();
       await PageObjects.discover.waitUntilSearchingHasFinished();
       requestData = await testSubjects.getAttribute('unifiedHistogramChart', 'data-request-data');
       expect(JSON.parse(requestData)).to.eql({
diff --git a/test/functional/apps/discover/group2/_data_grid_copy_to_clipboard.ts b/test/functional/apps/discover/group2/_data_grid_copy_to_clipboard.ts
index 06fe279dbd534e..27d847f9c49ce8 100644
--- a/test/functional/apps/discover/group2/_data_grid_copy_to_clipboard.ts
+++ b/test/functional/apps/discover/group2/_data_grid_copy_to_clipboard.ts
@@ -79,7 +79,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await dataGrid.clickCopyColumnName('@timestamp');
       if (canReadClipboard) {
         const copiedTimestampName = await browser.getClipboardValue();
-        expect(copiedTimestampName).to.be('"\'@timestamp"');
+        expect(copiedTimestampName).to.be('@timestamp');
       }
 
       expect(await toasts.getToastCount()).to.be(1);
diff --git a/test/functional/apps/discover/group3/_default_columns.ts b/test/functional/apps/discover/group3/_default_columns.ts
new file mode 100644
index 00000000000000..64028c54a1b19c
--- /dev/null
+++ b/test/functional/apps/discover/group3/_default_columns.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dataGrid = getService('dataGrid');
+  const PageObjects = getPageObjects([
+    'common',
+    'discover',
+    'timePicker',
+    'unifiedFieldList',
+    'unifiedSearch',
+    'header',
+  ]);
+  const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
+  const security = getService('security');
+  const defaultSettings = {
+    defaultIndex: 'logstash-*',
+    defaultColumns: ['message', 'extension', 'DestCountry'],
+    hideAnnouncements: true,
+  };
+
+  describe('discover default columns', function () {
+    before(async () => {
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader']);
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+      await esArchiver.load('test/functional/fixtures/es_archiver/kibana_sample_data_logs_tsdb');
+      await esArchiver.loadIfNeeded(
+        'test/functional/fixtures/es_archiver/kibana_sample_data_flights'
+      );
+      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
+      await kibanaServer.importExport.load(
+        'test/functional/fixtures/kbn_archiver/kibana_sample_data_logs_tsdb'
+      );
+      await kibanaServer.importExport.load(
+        'test/functional/fixtures/kbn_archiver/kibana_sample_data_flights_index_pattern'
+      );
+    });
+
+    after(async () => {
+      await kibanaServer.importExport.unload('test/functional/fixtures/kbn_archiver/discover');
+      await esArchiver.unload('test/functional/fixtures/es_archiver/logstash_functional');
+      await esArchiver.unload('test/functional/fixtures/es_archiver/kibana_sample_data_logs_tsdb');
+      await esArchiver.unload('test/functional/fixtures/es_archiver/kibana_sample_data_flights');
+      await kibanaServer.savedObjects.cleanStandardList();
+    });
+
+    beforeEach(async function () {
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update(defaultSettings);
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+    });
+
+    it('should render default columns', async function () {
+      expect(await dataGrid.getHeaderFields()).to.eql([
+        '@timestamp',
+        'message',
+        'extension',
+        'DestCountry',
+      ]);
+    });
+
+    it('should render only available default columns after switching data views', async function () {
+      expect(await dataGrid.getHeaderFields()).to.eql([
+        '@timestamp',
+        'message',
+        'extension',
+        'DestCountry',
+      ]);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'Kibana Sample Data Logs (TSDB)',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['timestamp', 'message', 'extension']);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'kibana_sample_data_flights',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['timestamp', 'DestCountry']);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'logstash-*',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'extension']);
+    });
+
+    it('should combine selected columns and default columns after switching data views', async function () {
+      await PageObjects.unifiedFieldList.clickFieldListItemAdd('bytes');
+      await PageObjects.unifiedFieldList.clickFieldListItemRemove('DestCountry');
+      await PageObjects.unifiedFieldList.clickFieldListItemRemove('message');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'extension', 'bytes']);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'Kibana Sample Data Logs (TSDB)',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql([
+        'timestamp',
+        'extension',
+        'bytes',
+        'message',
+      ]);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'logstash-*',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'extension', 'bytes']);
+    });
+
+    it('should not change columns if discover:modifyColumnsOnSwitch is off', async function () {
+      await kibanaServer.uiSettings.update({
+        'discover:modifyColumnsOnSwitch': false,
+      });
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      expect(await dataGrid.getHeaderFields()).to.eql([
+        '@timestamp',
+        'message',
+        'extension',
+        'DestCountry',
+      ]);
+
+      await PageObjects.unifiedSearch.switchDataView(
+        'discover-dataView-switch-link',
+        'kibana_sample_data_flights',
+        false
+      );
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.expandTimeRangeAsSuggestedInNoResultsMessage();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql([
+        'timestamp',
+        'message',
+        'extension',
+        'DestCountry',
+      ]);
+    });
+  });
+}
diff --git a/test/functional/apps/discover/group3/_request_counts.ts b/test/functional/apps/discover/group3/_request_counts.ts
index fdee64ada99657..a1038b3f7e4eed 100644
--- a/test/functional/apps/discover/group3/_request_counts.ts
+++ b/test/functional/apps/discover/group3/_request_counts.ts
@@ -156,7 +156,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await queryBar.clickQuerySubmitButton();
         await waitForLoadingToFinish();
         await expectSearches(type, 2, async () => {
-          await PageObjects.discover.clickResetSavedSearchButton();
+          await PageObjects.discover.revertUnsavedChanges();
         });
         // clearing the saved search
         await expectSearches('ese', 2, async () => {
diff --git a/test/functional/apps/discover/group3/_unsaved_changes_badge.ts b/test/functional/apps/discover/group3/_unsaved_changes_badge.ts
new file mode 100644
index 00000000000000..292835b37ef104
--- /dev/null
+++ b/test/functional/apps/discover/group3/_unsaved_changes_badge.ts
@@ -0,0 +1,167 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+const SAVED_SEARCH_NAME = 'test saved search';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
+  const testSubjects = getService('testSubjects');
+  const dataGrid = getService('dataGrid');
+  const PageObjects = getPageObjects([
+    'settings',
+    'common',
+    'discover',
+    'header',
+    'timePicker',
+    'dashboard',
+    'unifiedFieldList',
+  ]);
+  const security = getService('security');
+  const defaultSettings = {
+    defaultIndex: 'logstash-*',
+    hideAnnouncements: true,
+  };
+
+  describe('discover unsaved changes badge', function describeIndexTests() {
+    before(async () => {
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader']);
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
+    });
+
+    after(async () => {
+      await kibanaServer.importExport.unload('test/functional/fixtures/kbn_archiver/discover');
+      await kibanaServer.uiSettings.replace({});
+      await kibanaServer.savedObjects.cleanStandardList();
+    });
+
+    beforeEach(async function () {
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update(defaultSettings);
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+    });
+
+    it('should not show the badge initially nor after changes to a draft saved search', async () => {
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      await PageObjects.unifiedFieldList.clickFieldListItemAdd('bytes');
+
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+    });
+
+    it('should show the badge only after changes to a persisted saved search', async () => {
+      await PageObjects.discover.saveSearch(SAVED_SEARCH_NAME);
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      await PageObjects.unifiedFieldList.clickFieldListItemAdd('bytes');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      await testSubjects.existOrFail('unsavedChangesBadge');
+
+      await PageObjects.discover.saveUnsavedChanges();
+
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+    });
+
+    it('should not show a badge after loading a saved search, only after changes', async () => {
+      await PageObjects.discover.loadSavedSearch(SAVED_SEARCH_NAME);
+
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      await PageObjects.discover.chooseBreakdownField('_index');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+
+      await testSubjects.existOrFail('unsavedChangesBadge');
+    });
+
+    it('should allow to revert changes', async () => {
+      await PageObjects.discover.loadSavedSearch(SAVED_SEARCH_NAME);
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      // test changes to columns
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes']);
+      await PageObjects.unifiedFieldList.clickFieldListItemAdd('extension');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes', 'extension']);
+      await testSubjects.existOrFail('unsavedChangesBadge');
+      await PageObjects.discover.revertUnsavedChanges();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes']);
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      // test changes to sample size
+      await dataGrid.clickGridSettings();
+      expect(await dataGrid.getCurrentSampleSizeValue()).to.be(500);
+      await dataGrid.changeSampleSizeValue(250);
+      await dataGrid.clickGridSettings();
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.existOrFail('unsavedChangesBadge');
+      await dataGrid.clickGridSettings();
+      expect(await dataGrid.getCurrentSampleSizeValue()).to.be(250);
+      await dataGrid.clickGridSettings();
+      await PageObjects.discover.revertUnsavedChanges();
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+      await dataGrid.clickGridSettings();
+      expect(await dataGrid.getCurrentSampleSizeValue()).to.be(500);
+      await dataGrid.clickGridSettings();
+
+      // test changes to rows per page
+      await dataGrid.checkCurrentRowsPerPageToBe(100);
+      await dataGrid.changeRowsPerPageTo(25);
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.existOrFail('unsavedChangesBadge');
+      await dataGrid.checkCurrentRowsPerPageToBe(25);
+      await PageObjects.discover.revertUnsavedChanges();
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+      await dataGrid.checkCurrentRowsPerPageToBe(100);
+    });
+
+    it('should hide the badge once user manually reverts changes', async () => {
+      await PageObjects.discover.loadSavedSearch(SAVED_SEARCH_NAME);
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      // changes to columns
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes']);
+      await PageObjects.unifiedFieldList.clickFieldListItemAdd('extension');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes', 'extension']);
+      await testSubjects.existOrFail('unsavedChangesBadge');
+      await PageObjects.unifiedFieldList.clickFieldListItemRemove('extension');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      expect(await dataGrid.getHeaderFields()).to.eql(['@timestamp', 'bytes']);
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+
+      // test changes to breakdown field
+      await PageObjects.discover.chooseBreakdownField('_index');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.existOrFail('unsavedChangesBadge');
+      await PageObjects.discover.clearBreakdownField();
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.missingOrFail('unsavedChangesBadge');
+    });
+  });
+}
diff --git a/test/functional/apps/discover/group3/index.ts b/test/functional/apps/discover/group3/index.ts
index 5827c1e7ed8052..848bdc84def4d1 100644
--- a/test/functional/apps/discover/group3/index.ts
+++ b/test/functional/apps/discover/group3/index.ts
@@ -20,10 +20,12 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       await esArchiver.unload('test/functional/fixtures/es_archiver/logstash_functional');
     });
 
+    loadTestFile(require.resolve('./_default_columns'));
     loadTestFile(require.resolve('./_drag_drop'));
     loadTestFile(require.resolve('./_sidebar'));
     loadTestFile(require.resolve('./_request_counts'));
     loadTestFile(require.resolve('./_doc_viewer'));
     loadTestFile(require.resolve('./_view_mode_toggle'));
+    loadTestFile(require.resolve('./_unsaved_changes_badge'));
   });
 }
diff --git a/test/functional/apps/kibana_overview/_page_header.ts b/test/functional/apps/kibana_overview/_page_header.ts
index 362b3a97d5ffcb..346aa2f82f2c35 100644
--- a/test/functional/apps/kibana_overview/_page_header.ts
+++ b/test/functional/apps/kibana_overview/_page_header.ts
@@ -34,7 +34,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     it('click on integrations leads to integrations', async () => {
       const header = await find.byCssSelector('.euiPageHeaderContent');
-      const items = await header.findAllByCssSelector('.kbnRedirectCrossAppLinks');
+      const items = await header.findAllByTestSubject('kbnRedirectAppLink');
       expect(items!.length).to.be(3);
 
       const integrations = await items!.at(2);
@@ -47,7 +47,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.header.waitUntilLoadingHasFinished();
 
       const header = await find.byCssSelector('.euiPageHeaderContent');
-      const items = await header.findAllByCssSelector('.kbnRedirectCrossAppLinks');
+      const items = await header.findAllByTestSubject('kbnRedirectAppLink');
 
       const management = await items!.at(1);
       await management!.click();
@@ -59,7 +59,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.header.waitUntilLoadingHasFinished();
 
       const header = await find.byCssSelector('.euiPageHeaderContent');
-      const items = await header.findAllByCssSelector('.kbnRedirectCrossAppLinks');
+      const items = await header.findAllByTestSubject('kbnRedirectAppLink');
 
       const devTools = await items!.at(0);
       await devTools!.click();
diff --git a/test/functional/apps/management/data_views/_data_view_create_delete.ts b/test/functional/apps/management/data_views/_data_view_create_delete.ts
index edf2f000fcb273..e3bc2240887ada 100644
--- a/test/functional/apps/management/data_views/_data_view_create_delete.ts
+++ b/test/functional/apps/management/data_views/_data_view_create_delete.ts
@@ -17,6 +17,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const testSubjects = getService('testSubjects');
   const find = getService('find');
+  const es = getService('es');
   const PageObjects = getPageObjects(['settings', 'common', 'header']);
 
   describe('creating and deleting default data view', function describeIndexTests() {
@@ -250,5 +251,41 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         });
       });
     });
+
+    describe('hidden index support', () => {
+      it('can create data view against hidden index', async () => {
+        const pattern = 'logstash-2015.09.2*';
+
+        await es.transport.request({
+          path: '/logstash-2015.09.2*/_settings',
+          method: 'PUT',
+          body: {
+            index: {
+              hidden: true,
+            },
+          },
+        });
+
+        await PageObjects.settings.createIndexPattern(
+          pattern,
+          '@timestamp',
+          undefined,
+          undefined,
+          undefined,
+          true
+        );
+        const patternName = await PageObjects.settings.getIndexPageHeading();
+        expect(patternName).to.be(pattern);
+
+        // verify that allow hidden persists through reload
+        await browser.refresh();
+
+        await testSubjects.click('editIndexPatternButton');
+        await testSubjects.click('toggleAdvancedSetting');
+        const allowHiddenField = await testSubjects.find('allowHiddenField');
+        const button = await allowHiddenField.findByTagName('button');
+        expect(await button.getAttribute('aria-checked')).to.be('true');
+      });
+    });
   });
 }
diff --git a/test/functional/page_objects/console_page.ts b/test/functional/page_objects/console_page.ts
index a48578a60bc179..2fabe4222ee4ec 100644
--- a/test/functional/page_objects/console_page.ts
+++ b/test/functional/page_objects/console_page.ts
@@ -500,6 +500,7 @@ export class ConsolePageObject extends FtrService {
   }
 
   public async getRequestQueryParams() {
+    await this.sleepForDebouncePeriod();
     const requestEditor = await this.getRequestEditor();
     const requestQueryParams = await requestEditor.findAllByCssSelector('.ace_url.ace_param');
 
@@ -531,6 +532,7 @@ export class ConsolePageObject extends FtrService {
   }
 
   public async getRequestLineHighlighting() {
+    await this.sleepForDebouncePeriod();
     const requestEditor = await this.getRequestEditor();
     const requestLine = await requestEditor.findAllByCssSelector('.ace_line > *');
     const line = [];
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index 47a79132212cca..6005bbd2de7ad5 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -168,10 +168,30 @@ export class DiscoverPageObject extends FtrService {
     await this.testSubjects.click('discoverOpenButton');
   }
 
-  public async clickResetSavedSearchButton() {
-    await this.testSubjects.moveMouseTo('resetSavedSearch');
-    await this.testSubjects.click('resetSavedSearch');
+  public async revertUnsavedChanges() {
+    await this.testSubjects.moveMouseTo('unsavedChangesBadge');
+    await this.testSubjects.click('unsavedChangesBadge');
+    await this.retry.waitFor('popover is open', async () => {
+      return Boolean(await this.testSubjects.find('unsavedChangesBadgeMenuPanel'));
+    });
+    await this.testSubjects.click('revertUnsavedChangesButton');
     await this.header.waitUntilLoadingHasFinished();
+    await this.waitUntilSearchingHasFinished();
+  }
+
+  public async saveUnsavedChanges() {
+    await this.testSubjects.moveMouseTo('unsavedChangesBadge');
+    await this.testSubjects.click('unsavedChangesBadge');
+    await this.retry.waitFor('popover is open', async () => {
+      return Boolean(await this.testSubjects.find('unsavedChangesBadgeMenuPanel'));
+    });
+    await this.testSubjects.click('saveUnsavedChangesButton');
+    await this.retry.waitFor('modal is open', async () => {
+      return Boolean(await this.testSubjects.find('confirmSaveSavedObjectButton'));
+    });
+    await this.testSubjects.click('confirmSaveSavedObjectButton');
+    await this.header.waitUntilLoadingHasFinished();
+    await this.waitUntilSearchingHasFinished();
   }
 
   public async closeLoadSavedSearchPanel() {
@@ -199,6 +219,10 @@ export class DiscoverPageObject extends FtrService {
     await this.comboBox.set('unifiedHistogramBreakdownFieldSelector', field);
   }
 
+  public async clearBreakdownField() {
+    await this.comboBox.clear('unifiedHistogramBreakdownFieldSelector');
+  }
+
   public async chooseLensChart(chart: string) {
     await this.comboBox.set('unifiedHistogramSuggestionSelector', chart);
   }
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index 0a2fd760769145..5172d7d7d0ff48 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -483,13 +483,20 @@ export class SettingsPageObject extends FtrService {
     await customDataViewIdInput.type(value);
   }
 
+  async allowHiddenClick() {
+    await this.testSubjects.click('toggleAdvancedSetting');
+    const allowHiddenField = await this.testSubjects.find('allowHiddenField');
+    (await allowHiddenField.findByTagName('button')).click();
+  }
+
   async createIndexPattern(
     indexPatternName: string,
     // null to bypass default value
     timefield: string | null = '@timestamp',
     isStandardIndexPattern = true,
     customDataViewId?: string,
-    dataViewName?: string
+    dataViewName?: string,
+    allowHidden?: boolean
   ) {
     await this.retry.try(async () => {
       await this.header.waitUntilLoadingHasFinished();
@@ -502,6 +509,11 @@ export class SettingsPageObject extends FtrService {
       } else {
         await this.clickAddNewIndexPatternButton();
       }
+
+      if (allowHidden) {
+        await this.allowHiddenClick();
+      }
+
       await this.header.waitUntilLoadingHasFinished();
       if (!isStandardIndexPattern) {
         await this.selectRollupIndexPatternType();
diff --git a/test/health_gateway/plugins/status/server/index.ts b/test/health_gateway/plugins/status/server/index.ts
index a71049da757d03..d37e063cbe12f4 100644
--- a/test/health_gateway/plugins/status/server/index.ts
+++ b/test/health_gateway/plugins/status/server/index.ts
@@ -8,6 +8,6 @@
 
 import { HealthGatewayStatusPlugin } from './plugin';
 
-export function plugin() {
+export async function plugin() {
   return new HealthGatewayStatusPlugin();
 }
diff --git a/test/interactive_setup_api_integration/plugins/test_endpoints/server/index.ts b/test/interactive_setup_api_integration/plugins/test_endpoints/server/index.ts
index 8af208ce69da94..838998c86d6a85 100644
--- a/test/interactive_setup_api_integration/plugins/test_endpoints/server/index.ts
+++ b/test/interactive_setup_api_integration/plugins/test_endpoints/server/index.ts
@@ -11,7 +11,9 @@ import path from 'path';
 
 import type { PluginInitializer, PrebootPlugin } from '@kbn/core/server';
 
-export const plugin: PluginInitializer<void, never> = (initializerContext): PrebootPlugin => ({
+export const plugin: PluginInitializer<void, never> = async (
+  initializerContext
+): Promise<PrebootPlugin> => ({
   setup: (core) => {
     core.http.registerRoutes('', (router) => {
       router.get(
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/server/index.ts b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/server/index.ts
index 0230677a9d7e1d..004d5bda160f36 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/server/index.ts
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/server/index.ts
@@ -9,4 +9,5 @@
 import { PluginInitializer } from '@kbn/core/server';
 import { TestPlugin, TestPluginSetup, TestPluginStart } from './plugin';
 
-export const plugin: PluginInitializer<TestPluginSetup, TestPluginStart> = () => new TestPlugin();
+export const plugin: PluginInitializer<TestPluginSetup, TestPluginStart> = async () =>
+  new TestPlugin();
diff --git a/test/node_roles_functional/plugins/core_plugin_initializer_context/server/index.ts b/test/node_roles_functional/plugins/core_plugin_initializer_context/server/index.ts
index c074b4997a7f85..fa2e178f6a688d 100644
--- a/test/node_roles_functional/plugins/core_plugin_initializer_context/server/index.ts
+++ b/test/node_roles_functional/plugins/core_plugin_initializer_context/server/index.ts
@@ -9,5 +9,5 @@
 import type { PluginInitializerContext } from '@kbn/core/server';
 import { CorePluginInitializerContextPlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
+export const plugin = async (initializerContext: PluginInitializerContext) =>
   new CorePluginInitializerContextPlugin(initializerContext);
diff --git a/test/plugin_functional/plugins/app_link_test/kibana.jsonc b/test/plugin_functional/plugins/app_link_test/kibana.jsonc
index 26aaff93331d11..ba943b1c6c1aef 100644
--- a/test/plugin_functional/plugins/app_link_test/kibana.jsonc
+++ b/test/plugin_functional/plugins/app_link_test/kibana.jsonc
@@ -5,9 +5,6 @@
   "plugin": {
     "id": "appLinkTest",
     "server": false,
-    "browser": true,
-    "requiredBundles": [
-      "kibanaReact"
-    ]
+    "browser": true
   }
 }
diff --git a/test/plugin_functional/plugins/app_link_test/public/app.tsx b/test/plugin_functional/plugins/app_link_test/public/app.tsx
index 24b851f64aa5f9..40f00c4973e7e1 100644
--- a/test/plugin_functional/plugins/app_link_test/public/app.tsx
+++ b/test/plugin_functional/plugins/app_link_test/public/app.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { AppMountParameters, IBasePath, ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 const FooApp = ({
   appId,
@@ -23,7 +23,11 @@ const FooApp = ({
   application: ApplicationStart;
 }) => (
   <div data-test-subj={`app-${appId}`}>
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <h1>{appId}</h1>
       <div>
         <a data-test-subj="applink-basic-test" href={basePath.prepend(`/app/${targetAppId}`)}>
diff --git a/test/plugin_functional/plugins/app_link_test/tsconfig.json b/test/plugin_functional/plugins/app_link_test/tsconfig.json
index b44abdbe6224d6..1568b5a9e8deaa 100644
--- a/test/plugin_functional/plugins/app_link_test/tsconfig.json
+++ b/test/plugin_functional/plugins/app_link_test/tsconfig.json
@@ -13,7 +13,7 @@
     "target/**/*",
   ],
   "kbn_references": [
-    "@kbn/kibana-react-plugin",
     "@kbn/core",
+    "@kbn/shared-ux-link-redirect-app",
   ]
 }
diff --git a/test/plugin_functional/plugins/core_dynamic_resolving_a/server/index.ts b/test/plugin_functional/plugins/core_dynamic_resolving_a/server/index.ts
index dc204bdfdea9eb..2b673ae30180cf 100644
--- a/test/plugin_functional/plugins/core_dynamic_resolving_a/server/index.ts
+++ b/test/plugin_functional/plugins/core_dynamic_resolving_a/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CoreDynamicResolvingAPlugin } from './plugin';
 
-export const plugin = () => new CoreDynamicResolvingAPlugin();
+export const plugin = async () => new CoreDynamicResolvingAPlugin();
diff --git a/test/plugin_functional/plugins/core_dynamic_resolving_b/server/index.ts b/test/plugin_functional/plugins/core_dynamic_resolving_b/server/index.ts
index ed305f96d7bc97..57797605cd46e6 100644
--- a/test/plugin_functional/plugins/core_dynamic_resolving_b/server/index.ts
+++ b/test/plugin_functional/plugins/core_dynamic_resolving_b/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CoreDynamicResolvingBPlugin } from './plugin';
 
-export const plugin = () => new CoreDynamicResolvingBPlugin();
+export const plugin = async () => new CoreDynamicResolvingBPlugin();
diff --git a/test/plugin_functional/plugins/core_history_block/kibana.jsonc b/test/plugin_functional/plugins/core_history_block/kibana.jsonc
index f64a37a2f6456c..93e4f8291c9622 100644
--- a/test/plugin_functional/plugins/core_history_block/kibana.jsonc
+++ b/test/plugin_functional/plugins/core_history_block/kibana.jsonc
@@ -5,9 +5,6 @@
   "plugin": {
     "id": "coreHistoryBlock",
     "server": false,
-    "browser": true,
-    "requiredBundles": [
-      "kibanaReact"
-    ]
+    "browser": true
   }
 }
diff --git a/test/plugin_functional/plugins/core_history_block/public/app.tsx b/test/plugin_functional/plugins/core_history_block/public/app.tsx
index 1e5b87fc818853..563bbad6517562 100644
--- a/test/plugin_functional/plugins/core_history_block/public/app.tsx
+++ b/test/plugin_functional/plugins/core_history_block/public/app.tsx
@@ -11,7 +11,7 @@ import ReactDOM from 'react-dom';
 import { Prompt } from 'react-router-dom';
 import { Router, Routes, Route } from '@kbn/shared-ux-router';
 import type { AppMountParameters, IBasePath, ApplicationStart } from '@kbn/core/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 const HomePage = ({
   basePath,
@@ -22,7 +22,11 @@ const HomePage = ({
 }) => (
   <div data-test-subj="page-home">
     <Prompt message="Unsaved changes, are you sure you wanna leave?" />
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <h1>HOME PAGE</h1>
       <br /> <br />
       <a data-test-subj="applink-intra-test" href={basePath.prepend(`/app/core_history_block/foo`)}>
@@ -44,7 +48,11 @@ const FooPage = ({
   application: ApplicationStart;
 }) => (
   <div data-test-subj="page-home">
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <h1>FOO PAGE</h1>
       <br /> <br />
       <a data-test-subj="applink-intra-test" href={basePath.prepend(`/app/core_history_block`)}>
diff --git a/test/plugin_functional/plugins/core_history_block/tsconfig.json b/test/plugin_functional/plugins/core_history_block/tsconfig.json
index d92475c6c41974..879d234e69a714 100644
--- a/test/plugin_functional/plugins/core_history_block/tsconfig.json
+++ b/test/plugin_functional/plugins/core_history_block/tsconfig.json
@@ -9,7 +9,7 @@
   ],
   "kbn_references": [
     "@kbn/core",
-    "@kbn/kibana-react-plugin",
-    "@kbn/shared-ux-router"
+    "@kbn/shared-ux-router",
+    "@kbn/shared-ux-link-redirect-app"
   ]
 }
diff --git a/test/plugin_functional/plugins/core_http/server/index.ts b/test/plugin_functional/plugins/core_http/server/index.ts
index 66c2bb9e676f3c..7f95feacaf444f 100644
--- a/test/plugin_functional/plugins/core_http/server/index.ts
+++ b/test/plugin_functional/plugins/core_http/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CoreHttpPlugin } from './plugin';
 
-export const plugin = () => new CoreHttpPlugin();
+export const plugin = async () => new CoreHttpPlugin();
diff --git a/test/plugin_functional/plugins/core_plugin_a/server/index.ts b/test/plugin_functional/plugins/core_plugin_a/server/index.ts
index 7fad3cf7a9e3bb..a64b4f81d205ae 100644
--- a/test/plugin_functional/plugins/core_plugin_a/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_a/server/index.ts
@@ -9,4 +9,4 @@
 import { CorePluginAPlugin } from './plugin';
 export type { PluginAApiRequestContext } from './plugin';
 
-export const plugin = () => new CorePluginAPlugin();
+export const plugin = async () => new CorePluginAPlugin();
diff --git a/test/plugin_functional/plugins/core_plugin_b/server/index.ts b/test/plugin_functional/plugins/core_plugin_b/server/index.ts
index da2c29c64b0bee..e12621c34b3d71 100644
--- a/test/plugin_functional/plugins/core_plugin_b/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_b/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CorePluginBPlugin } from './plugin';
 
-export const plugin = () => new CorePluginBPlugin();
+export const plugin = async () => new CorePluginBPlugin();
diff --git a/test/plugin_functional/plugins/core_plugin_deprecations/server/index.ts b/test/plugin_functional/plugins/core_plugin_deprecations/server/index.ts
index 1968c011a327aa..e7f934ac66a1c8 100644
--- a/test/plugin_functional/plugins/core_plugin_deprecations/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_deprecations/server/index.ts
@@ -9,4 +9,4 @@
 import { CorePluginDeprecationsPlugin } from './plugin';
 
 export { config } from './config';
-export const plugin = () => new CorePluginDeprecationsPlugin();
+export const plugin = async () => new CorePluginDeprecationsPlugin();
diff --git a/test/plugin_functional/plugins/core_plugin_execution_context/server/index.ts b/test/plugin_functional/plugins/core_plugin_execution_context/server/index.ts
index 019e3020967525..029710faab2c7c 100644
--- a/test/plugin_functional/plugins/core_plugin_execution_context/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_execution_context/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CorePluginExecutionContext } from './plugin';
 
-export const plugin = () => new CorePluginExecutionContext();
+export const plugin = async () => new CorePluginExecutionContext();
diff --git a/test/plugin_functional/plugins/core_plugin_route_timeouts/server/index.ts b/test/plugin_functional/plugins/core_plugin_route_timeouts/server/index.ts
index 47dcc66303a4e7..5fbb9113cb59c8 100644
--- a/test/plugin_functional/plugins/core_plugin_route_timeouts/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_route_timeouts/server/index.ts
@@ -8,4 +8,4 @@
 
 import { CorePluginRouteTimeoutsPlugin } from './plugin';
 
-export const plugin = () => new CorePluginRouteTimeoutsPlugin();
+export const plugin = async () => new CorePluginRouteTimeoutsPlugin();
diff --git a/test/plugin_functional/plugins/data_search/server/index.ts b/test/plugin_functional/plugins/data_search/server/index.ts
index f7fb397aaedaaa..8d2412d0192d78 100644
--- a/test/plugin_functional/plugins/data_search/server/index.ts
+++ b/test/plugin_functional/plugins/data_search/server/index.ts
@@ -9,5 +9,5 @@
 import { PluginInitializer } from '@kbn/core/server';
 import { DataSearchTestPlugin, TestPluginSetup, TestPluginStart } from './plugin';
 
-export const plugin: PluginInitializer<TestPluginSetup, TestPluginStart> = () =>
+export const plugin: PluginInitializer<TestPluginSetup, TestPluginStart> = async () =>
   new DataSearchTestPlugin();
diff --git a/test/plugin_functional/plugins/elasticsearch_client_plugin/server/index.ts b/test/plugin_functional/plugins/elasticsearch_client_plugin/server/index.ts
index f484a8e30985a2..6e5b765d3ab189 100644
--- a/test/plugin_functional/plugins/elasticsearch_client_plugin/server/index.ts
+++ b/test/plugin_functional/plugins/elasticsearch_client_plugin/server/index.ts
@@ -8,4 +8,4 @@
 
 import { ElasticsearchClientPlugin } from './plugin';
 
-export const plugin = () => new ElasticsearchClientPlugin();
+export const plugin = async () => new ElasticsearchClientPlugin();
diff --git a/test/plugin_functional/plugins/index_patterns/server/index.ts b/test/plugin_functional/plugins/index_patterns/server/index.ts
index e40b2e7534bfbc..5f723ef27a884d 100644
--- a/test/plugin_functional/plugins/index_patterns/server/index.ts
+++ b/test/plugin_functional/plugins/index_patterns/server/index.ts
@@ -16,4 +16,4 @@ import {
 export const plugin: PluginInitializer<
   IndexPatternsTestPluginSetup,
   IndexPatternsTestPluginStart
-> = () => new IndexPatternsTestPlugin();
+> = async () => new IndexPatternsTestPlugin();
diff --git a/test/plugin_functional/plugins/rendering_plugin/server/index.ts b/test/plugin_functional/plugins/rendering_plugin/server/index.ts
index 9c684205df36ae..156c0ecf3484c8 100644
--- a/test/plugin_functional/plugins/rendering_plugin/server/index.ts
+++ b/test/plugin_functional/plugins/rendering_plugin/server/index.ts
@@ -8,4 +8,4 @@
 
 import { RenderingPlugin } from './plugin';
 
-export const plugin = () => new RenderingPlugin();
+export const plugin = async () => new RenderingPlugin();
diff --git a/test/plugin_functional/plugins/saved_object_export_transforms/server/index.ts b/test/plugin_functional/plugins/saved_object_export_transforms/server/index.ts
index ff622c41ad3678..758620d7a75ba6 100644
--- a/test/plugin_functional/plugins/saved_object_export_transforms/server/index.ts
+++ b/test/plugin_functional/plugins/saved_object_export_transforms/server/index.ts
@@ -8,4 +8,4 @@
 
 import { SavedObjectExportTransformsPlugin } from './plugin';
 
-export const plugin = () => new SavedObjectExportTransformsPlugin();
+export const plugin = async () => new SavedObjectExportTransformsPlugin();
diff --git a/test/plugin_functional/plugins/saved_object_import_warnings/server/index.ts b/test/plugin_functional/plugins/saved_object_import_warnings/server/index.ts
index c6bbdda012b745..9f9d617a6a727a 100644
--- a/test/plugin_functional/plugins/saved_object_import_warnings/server/index.ts
+++ b/test/plugin_functional/plugins/saved_object_import_warnings/server/index.ts
@@ -8,4 +8,4 @@
 
 import { SavedObjectImportWarningsPlugin } from './plugin';
 
-export const plugin = () => new SavedObjectImportWarningsPlugin();
+export const plugin = async () => new SavedObjectImportWarningsPlugin();
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
index 6e0e8ae6554796..af0e09a3ef067a 100644
--- a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
@@ -8,4 +8,4 @@
 
 import { SavedObjectsHiddenFromHttpApisTypePlugin } from './plugin';
 
-export const plugin = () => new SavedObjectsHiddenFromHttpApisTypePlugin();
+export const plugin = async () => new SavedObjectsHiddenFromHttpApisTypePlugin();
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_type/server/index.ts b/test/plugin_functional/plugins/saved_objects_hidden_type/server/index.ts
index 2093b6e8449a46..738bb64d61ec92 100644
--- a/test/plugin_functional/plugins/saved_objects_hidden_type/server/index.ts
+++ b/test/plugin_functional/plugins/saved_objects_hidden_type/server/index.ts
@@ -8,4 +8,4 @@
 
 import { SavedObjectsHiddenTypePlugin } from './plugin';
 
-export const plugin = () => new SavedObjectsHiddenTypePlugin();
+export const plugin = async () => new SavedObjectsHiddenTypePlugin();
diff --git a/test/plugin_functional/plugins/ui_settings_plugin/server/index.ts b/test/plugin_functional/plugins/ui_settings_plugin/server/index.ts
index 581277501a489d..8df0dce5cebf4e 100644
--- a/test/plugin_functional/plugins/ui_settings_plugin/server/index.ts
+++ b/test/plugin_functional/plugins/ui_settings_plugin/server/index.ts
@@ -8,4 +8,4 @@
 
 import { UiSettingsPlugin } from './plugin';
 
-export const plugin = () => new UiSettingsPlugin();
+export const plugin = async () => new UiSettingsPlugin();
diff --git a/test/plugin_functional/plugins/usage_collection/server/index.ts b/test/plugin_functional/plugins/usage_collection/server/index.ts
index 172f8491a1a407..aee68cb614f46d 100644
--- a/test/plugin_functional/plugins/usage_collection/server/index.ts
+++ b/test/plugin_functional/plugins/usage_collection/server/index.ts
@@ -7,4 +7,4 @@
  */
 
 import { UsageCollectionTestPlugin } from './plugin';
-export const plugin = () => new UsageCollectionTestPlugin();
+export const plugin = async () => new UsageCollectionTestPlugin();
diff --git a/test/server_integration/http/platform/config.status.ts b/test/server_integration/http/platform/config.status.ts
index 638d850a8f75c3..53ff1e609f6899 100644
--- a/test/server_integration/http/platform/config.status.ts
+++ b/test/server_integration/http/platform/config.status.ts
@@ -40,7 +40,8 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       runOptions: {
         ...httpConfig.get('kbnTestServer.runOptions'),
         // Don't wait for Kibana to be completely ready so that we can test the status timeouts
-        wait: /Kibana is now unavailable/,
+        // but wait for http service to listen.
+        wait: /\[http\.server\.Kibana\] http server running at/,
         alwaysUseSource: true,
       },
     },
diff --git a/test/server_integration/http/platform/status.ts b/test/server_integration/http/platform/status.ts
index 50c136bfa10279..8ce193c6708490 100644
--- a/test/server_integration/http/platform/status.ts
+++ b/test/server_integration/http/platform/status.ts
@@ -32,7 +32,7 @@ export default function ({ getService }: FtrProviderContext) {
       .expect(200);
 
   describe('status service', () => {
-    // This test must comes first because the timeout only applies to the initial emission
+    // This test must come first because the timeout only applies to the initial emission
     it("returns a timeout for status check that doesn't emit after 30s", async () => {
       let aStatus = await getStatus('statusPluginA');
       expect(aStatus.level).to.eql('unavailable');
diff --git a/test/server_integration/plugins/status_plugin_a/server/index.ts b/test/server_integration/plugins/status_plugin_a/server/index.ts
index cf221c00e32b02..9f001ed0133fec 100644
--- a/test/server_integration/plugins/status_plugin_a/server/index.ts
+++ b/test/server_integration/plugins/status_plugin_a/server/index.ts
@@ -8,4 +8,4 @@
 
 import { StatusPluginAPlugin } from './plugin';
 
-export const plugin = () => new StatusPluginAPlugin();
+export const plugin = async () => new StatusPluginAPlugin();
diff --git a/test/server_integration/plugins/status_plugin_b/server/index.ts b/test/server_integration/plugins/status_plugin_b/server/index.ts
index 2002d234827b94..db400f1a0e23a3 100644
--- a/test/server_integration/plugins/status_plugin_b/server/index.ts
+++ b/test/server_integration/plugins/status_plugin_b/server/index.ts
@@ -8,4 +8,4 @@
 
 import { StatusPluginBPlugin } from './plugin';
 
-export const plugin = () => new StatusPluginBPlugin();
+export const plugin = async () => new StatusPluginBPlugin();
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 40b1ede6643284..a92c90b6aeb384 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -50,6 +50,8 @@
       "@kbn/analytics/*": ["packages/kbn-analytics/*"],
       "@kbn/analytics-client": ["packages/analytics/client"],
       "@kbn/analytics-client/*": ["packages/analytics/client/*"],
+      "@kbn/analytics-collection-utils": ["packages/analytics/utils/analytics_collection_utils"],
+      "@kbn/analytics-collection-utils/*": ["packages/analytics/utils/analytics_collection_utils/*"],
       "@kbn/analytics-ftr-helpers-plugin": ["test/analytics/plugins/analytics_ftr_helpers"],
       "@kbn/analytics-ftr-helpers-plugin/*": ["test/analytics/plugins/analytics_ftr_helpers/*"],
       "@kbn/analytics-plugin-a-plugin": ["test/analytics/plugins/analytics_plugin_a"],
@@ -622,6 +624,8 @@
       "@kbn/data-views-plugin/*": ["src/plugins/data_views/*"],
       "@kbn/data-visualizer-plugin": ["x-pack/plugins/data_visualizer"],
       "@kbn/data-visualizer-plugin/*": ["x-pack/plugins/data_visualizer/*"],
+      "@kbn/dataset-quality-plugin": ["x-pack/plugins/dataset_quality"],
+      "@kbn/dataset-quality-plugin/*": ["x-pack/plugins/dataset_quality/*"],
       "@kbn/datemath": ["packages/kbn-datemath"],
       "@kbn/datemath/*": ["packages/kbn-datemath/*"],
       "@kbn/deeplinks-analytics": ["packages/deeplinks/analytics"],
@@ -828,8 +832,6 @@
       "@kbn/generate-console-definitions/*": ["packages/kbn-generate-console-definitions/*"],
       "@kbn/generate-csv": ["packages/kbn-generate-csv"],
       "@kbn/generate-csv/*": ["packages/kbn-generate-csv/*"],
-      "@kbn/generate-csv-types": ["packages/kbn-generate-csv-types"],
-      "@kbn/generate-csv-types/*": ["packages/kbn-generate-csv-types/*"],
       "@kbn/get-repo-files": ["packages/kbn-get-repo-files"],
       "@kbn/get-repo-files/*": ["packages/kbn-get-repo-files/*"],
       "@kbn/global-search-bar-plugin": ["x-pack/plugins/global_search_bar"],
@@ -1174,8 +1176,26 @@
       "@kbn/reporting-common/*": ["packages/kbn-reporting/common/*"],
       "@kbn/reporting-example-plugin": ["x-pack/examples/reporting_example"],
       "@kbn/reporting-example-plugin/*": ["x-pack/examples/reporting_example/*"],
+      "@kbn/reporting-export-types-csv": ["packages/kbn-reporting/export_types/csv"],
+      "@kbn/reporting-export-types-csv/*": ["packages/kbn-reporting/export_types/csv/*"],
+      "@kbn/reporting-export-types-csv-common": ["packages/kbn-reporting/export_types/csv_common"],
+      "@kbn/reporting-export-types-csv-common/*": ["packages/kbn-reporting/export_types/csv_common/*"],
+      "@kbn/reporting-export-types-pdf": ["packages/kbn-reporting/export_types/pdf"],
+      "@kbn/reporting-export-types-pdf/*": ["packages/kbn-reporting/export_types/pdf/*"],
+      "@kbn/reporting-export-types-pdf-common": ["packages/kbn-reporting/export_types/pdf_common"],
+      "@kbn/reporting-export-types-pdf-common/*": ["packages/kbn-reporting/export_types/pdf_common/*"],
+      "@kbn/reporting-export-types-png": ["packages/kbn-reporting/export_types/png"],
+      "@kbn/reporting-export-types-png/*": ["packages/kbn-reporting/export_types/png/*"],
+      "@kbn/reporting-export-types-png-common": ["packages/kbn-reporting/export_types/png_common"],
+      "@kbn/reporting-export-types-png-common/*": ["packages/kbn-reporting/export_types/png_common/*"],
+      "@kbn/reporting-mocks-server": ["packages/kbn-reporting/mocks_server"],
+      "@kbn/reporting-mocks-server/*": ["packages/kbn-reporting/mocks_server/*"],
       "@kbn/reporting-plugin": ["x-pack/plugins/reporting"],
       "@kbn/reporting-plugin/*": ["x-pack/plugins/reporting/*"],
+      "@kbn/reporting-public": ["packages/kbn-reporting/public"],
+      "@kbn/reporting-public/*": ["packages/kbn-reporting/public/*"],
+      "@kbn/reporting-server": ["packages/kbn-reporting/server"],
+      "@kbn/reporting-server/*": ["packages/kbn-reporting/server/*"],
       "@kbn/resizable-layout": ["packages/kbn-resizable-layout"],
       "@kbn/resizable-layout/*": ["packages/kbn-resizable-layout/*"],
       "@kbn/resizable-layout-examples-plugin": ["examples/resizable_layout_examples"],
@@ -1570,6 +1590,8 @@
       "@kbn/unified-histogram-plugin/*": ["src/plugins/unified_histogram/*"],
       "@kbn/unified-search-plugin": ["src/plugins/unified_search"],
       "@kbn/unified-search-plugin/*": ["src/plugins/unified_search/*"],
+      "@kbn/unsaved-changes-badge": ["packages/kbn-unsaved-changes-badge"],
+      "@kbn/unsaved-changes-badge/*": ["packages/kbn-unsaved-changes-badge/*"],
       "@kbn/upgrade-assistant-plugin": ["x-pack/plugins/upgrade_assistant"],
       "@kbn/upgrade-assistant-plugin/*": ["x-pack/plugins/upgrade_assistant/*"],
       "@kbn/uptime-plugin": ["x-pack/plugins/uptime"],
diff --git a/versions.json b/versions.json
index f904685d127767..a8ff665dcbd052 100644
--- a/versions.json
+++ b/versions.json
@@ -8,13 +8,13 @@
       "currentMinor": true
     },
     {
-      "version": "8.11.1",
+      "version": "8.11.2",
       "branch": "8.11",
       "currentMajor": true,
       "previousMinor": true
     },
     {
-      "version": "7.17.15",
+      "version": "7.17.16",
       "branch": "7.17",
       "previousMajor": true
     }
diff --git a/x-pack/.i18nrc.json b/x-pack/.i18nrc.json
index 923d0cce0759da..bb14c06a53e362 100644
--- a/x-pack/.i18nrc.json
+++ b/x-pack/.i18nrc.json
@@ -20,6 +20,7 @@
     "xpack.csp": "plugins/cloud_security_posture",
     "xpack.customBranding": "plugins/custom_branding",
     "xpack.dashboard": "plugins/dashboard_enhanced",
+    "xpack.datasetQuality": "plugins/dataset_quality",
     "xpack.discover": "plugins/discover_enhanced",
     "xpack.crossClusterReplication": "plugins/cross_cluster_replication",
     "xpack.elasticAssistant": "packages/kbn-elastic-assistant",
diff --git a/x-pack/examples/alerting_example/server/index.ts b/x-pack/examples/alerting_example/server/index.ts
index f14bbe1baac9d6..0dbe94868f43a9 100644
--- a/x-pack/examples/alerting_example/server/index.ts
+++ b/x-pack/examples/alerting_example/server/index.ts
@@ -6,6 +6,8 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import { AlertingExamplePlugin } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () => new AlertingExamplePlugin();
+export const plugin: PluginInitializer<void, void> = async () => {
+  const { AlertingExamplePlugin } = await import('./plugin');
+  return new AlertingExamplePlugin();
+};
diff --git a/x-pack/examples/exploratory_view_example/public/mount.tsx b/x-pack/examples/exploratory_view_example/public/mount.tsx
index f763621e5ef2f4..dd7194e1159c67 100644
--- a/x-pack/examples/exploratory_view_example/public/mount.tsx
+++ b/x-pack/examples/exploratory_view_example/public/mount.tsx
@@ -8,7 +8,8 @@
 import * as React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { CoreSetup, AppMountParameters, APP_WRAPPER_CLASS } from '@kbn/core/public';
-import { KibanaContextProvider, RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { StartDependencies } from './plugin';
 export const mount =
   (coreSetup: CoreSetup<StartDependencies>) =>
@@ -28,9 +29,15 @@ export const mount =
     const reactElement = (
       <KibanaContextProvider services={{ ...coreSetup, ...core, ...plugins }}>
         <i18nCore.Context>
-          <RedirectAppLinks application={core.application} className={APP_WRAPPER_CLASS}>
-            <App {...deps} defaultIndexPattern={defaultIndexPattern} />
-          </RedirectAppLinks>
+          <div className={APP_WRAPPER_CLASS}>
+            <RedirectAppLinks
+              coreStart={{
+                application: core.application,
+              }}
+            >
+              <App {...deps} defaultIndexPattern={defaultIndexPattern} />
+            </RedirectAppLinks>
+          </div>
         </i18nCore.Context>
       </KibanaContextProvider>
     );
diff --git a/x-pack/examples/exploratory_view_example/tsconfig.json b/x-pack/examples/exploratory_view_example/tsconfig.json
index 4da08c412d5a43..aef84f87f91825 100644
--- a/x-pack/examples/exploratory_view_example/tsconfig.json
+++ b/x-pack/examples/exploratory_view_example/tsconfig.json
@@ -21,5 +21,6 @@
     "@kbn/data-views-plugin",
     "@kbn/kibana-react-plugin",
     "@kbn/exploratory-view-plugin",
+    "@kbn/shared-ux-link-redirect-app",
   ]
 }
diff --git a/x-pack/examples/gen_ai_streaming_response_example/server/index.ts b/x-pack/examples/gen_ai_streaming_response_example/server/index.ts
index e85214a01d03dd..e745ea8f51c6c6 100644
--- a/x-pack/examples/gen_ai_streaming_response_example/server/index.ts
+++ b/x-pack/examples/gen_ai_streaming_response_example/server/index.ts
@@ -6,7 +6,8 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import { GenAiStreamingResponseExamplePlugin } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () =>
-  new GenAiStreamingResponseExamplePlugin();
+export const plugin: PluginInitializer<void, void> = async () => {
+  const { GenAiStreamingResponseExamplePlugin } = await import('./plugin');
+  return new GenAiStreamingResponseExamplePlugin();
+};
diff --git a/x-pack/examples/reporting_example/public/containers/main.tsx b/x-pack/examples/reporting_example/public/containers/main.tsx
index ee6b8e69fd62dd..07d727172b58ba 100644
--- a/x-pack/examples/reporting_example/public/containers/main.tsx
+++ b/x-pack/examples/reporting_example/public/containers/main.tsx
@@ -5,6 +5,12 @@
  * 2.0.
  */
 
+import { parsePath } from 'history';
+import moment from 'moment';
+import React, { useEffect, useState } from 'react';
+import * as Rx from 'rxjs';
+import { takeWhile } from 'rxjs/operators';
+
 import {
   EuiButton,
   EuiCard,
@@ -18,27 +24,20 @@ import {
   EuiLink,
   EuiPage,
   EuiPageBody,
-  EuiPageSection,
   EuiPageHeader,
+  EuiPageSection,
   EuiPopover,
   EuiSpacer,
   EuiText,
   EuiTitle,
 } from '@elastic/eui';
 import { I18nProvider } from '@kbn/i18n-react';
-import { parsePath } from 'history';
-import moment from 'moment';
-import React, { useEffect, useState } from 'react';
-import { BrowserRouter as Router, useHistory } from 'react-router-dom';
-import * as Rx from 'rxjs';
-import { takeWhile } from 'rxjs/operators';
-import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
-import type {
-  JobAppParamsPDF,
-  JobParamsPDFV2,
-  JobParamsPNGV2,
-} from '@kbn/reporting-plugin/common/types';
+import { JobParamsPDFDeprecated, JobParamsPDFV2 } from '@kbn/reporting-export-types-pdf-common';
+import { JobParamsPNGV2 } from '@kbn/reporting-export-types-png-common';
 import type { ReportingStart } from '@kbn/reporting-plugin/public';
+import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
+import { BrowserRouter as Router, useHistory } from 'react-router-dom';
+
 import { REPORTING_EXAMPLE_LOCATOR_ID } from '../../common';
 import { useApplicationContext } from '../application_context';
 import { ROUTES } from '../constants';
@@ -81,12 +80,14 @@ export const Main = ({ basename, reporting, screenshotMode }: ReportingExampleAp
       });
   });
 
-  const getPDFJobParamsDefault = (): JobAppParamsPDF => {
+  const getPDFJobParamsDefault = (): JobParamsPDFDeprecated => {
     return {
       layout: { id: 'preserve_layout' },
       relativeUrls: ['/app/reportingExample#/intended-visualization'],
       objectType: 'develeloperExample',
       title: 'Reporting Developer Example',
+      browserTimezone: 'UTC',
+      version: '1',
     };
   };
 
diff --git a/x-pack/examples/reporting_example/tsconfig.json b/x-pack/examples/reporting_example/tsconfig.json
index 6b02e36ce0f9e1..cb91f89dea0138 100644
--- a/x-pack/examples/reporting_example/tsconfig.json
+++ b/x-pack/examples/reporting_example/tsconfig.json
@@ -25,5 +25,7 @@
     "@kbn/i18n-react",
     "@kbn/utility-types",
     "@kbn/shared-ux-router",
+    "@kbn/reporting-export-types-pdf-common",
+    "@kbn/reporting-export-types-png-common",
   ]
 }
diff --git a/x-pack/examples/screenshotting_example/server/index.ts b/x-pack/examples/screenshotting_example/server/index.ts
index 2d9a1d5fbb25b2..a1354eee59af97 100644
--- a/x-pack/examples/screenshotting_example/server/index.ts
+++ b/x-pack/examples/screenshotting_example/server/index.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { ScreenshottingExamplePlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { ScreenshottingExamplePlugin } = await import('./plugin');
   return new ScreenshottingExamplePlugin();
 }
diff --git a/x-pack/examples/third_party_vis_lens_example/server/index.ts b/x-pack/examples/third_party_vis_lens_example/server/index.ts
index cba785e2c37839..ea57af5d4e327f 100644
--- a/x-pack/examples/third_party_vis_lens_example/server/index.ts
+++ b/x-pack/examples/third_party_vis_lens_example/server/index.ts
@@ -6,6 +6,8 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import { ThirdPartyVisLensExamplePlugin } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () => new ThirdPartyVisLensExamplePlugin();
+export const plugin: PluginInitializer<void, void> = async () => {
+  const { ThirdPartyVisLensExamplePlugin } = await import('./plugin');
+  return new ThirdPartyVisLensExamplePlugin();
+};
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.test.tsx b/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.test.tsx
index 7ff86b76310782..f8b1a81387b17a 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.test.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.test.tsx
@@ -63,6 +63,15 @@ describe('NewChatById', () => {
     expect(newChatButton.querySelector('.euiButtonContent__icon')).not.toBeInTheDocument();
   });
 
+  it('renders button icon when iconOnly is true', async () => {
+    render(<NewChatById iconOnly />);
+
+    const newChatButton = screen.getByTestId('newChatById');
+
+    expect(newChatButton.querySelector('[data-euiicon-type="discuss"]')).toBeInTheDocument();
+    expect(newChatButton.textContent).not.toContain('Chat');
+  });
+
   it('calls showAssistantOverlay on click', () => {
     const conversationId = 'test-conversation-id';
     const promptContextId = 'test-prompt-context-id';
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.tsx b/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.tsx
index 721d40118695a7..092e48d6f0bfd2 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/new_chat_by_id/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiButtonEmpty, EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
 
 import { useAssistantContext } from '../assistant_context';
@@ -20,6 +20,8 @@ export interface Props {
   iconType?: string | null;
   /** Optionally specify a well known ID, or default to a UUID */
   promptContextId?: string;
+  /** Defaults to false. If true, shows icon button without text */
+  iconOnly?: boolean;
 }
 
 const NewChatByIdComponent: React.FC<Props> = ({
@@ -27,6 +29,7 @@ const NewChatByIdComponent: React.FC<Props> = ({
   conversationId,
   iconType,
   promptContextId,
+  iconOnly = false,
 }) => {
   const { showAssistantOverlay } = useAssistantContext();
 
@@ -50,12 +53,28 @@ const NewChatByIdComponent: React.FC<Props> = ({
   }, [iconType]);
 
   return useMemo(
-    () => (
-      <EuiButtonEmpty data-test-subj="newChatById" iconType={icon} onClick={showOverlay}>
-        {children}
-      </EuiButtonEmpty>
-    ),
-    [children, icon, showOverlay]
+    () =>
+      iconOnly ? (
+        <EuiToolTip content={i18n.NEW_CHAT}>
+          <EuiButtonIcon
+            data-test-subj="newChatById"
+            iconType={icon ?? 'discuss'}
+            onClick={showOverlay}
+            color={'text'}
+            aria-label={i18n.NEW_CHAT}
+          />
+        </EuiToolTip>
+      ) : (
+        <EuiButtonEmpty
+          data-test-subj="newChatById"
+          iconType={icon}
+          onClick={showOverlay}
+          aria-label={i18n.NEW_CHAT}
+        >
+          {children}
+        </EuiButtonEmpty>
+      ),
+    [children, icon, showOverlay, iconOnly]
   );
 };
 
diff --git a/x-pack/packages/kbn-slo-schema/index.ts b/x-pack/packages/kbn-slo-schema/index.ts
index 3d9e295055a618..98b183d391bb76 100644
--- a/x-pack/packages/kbn-slo-schema/index.ts
+++ b/x-pack/packages/kbn-slo-schema/index.ts
@@ -8,3 +8,4 @@
 export * from './src/schema';
 export * from './src/rest_specs';
 export * from './src/models/duration';
+export * from './src/models/pagination';
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts b/x-pack/packages/kbn-slo-schema/src/models/pagination.ts
similarity index 60%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts
rename to x-pack/packages/kbn-slo-schema/src/models/pagination.ts
index f5c25207c78fa5..815c30f71d4c40 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts
+++ b/x-pack/packages/kbn-slo-schema/src/models/pagination.ts
@@ -4,9 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+export interface Paginated<T> {
+  total: number;
+  page: number;
+  perPage: number;
+  results: T[];
+}
 
-export type {
-  FakeRequest,
-  JobParamsDownloadCSV,
-  SavedObjectServiceError,
-} from '../../../common/types/export_types/csv_searchsource_immediate';
+export interface Pagination {
+  page: number;
+  perPage: number;
+}
diff --git a/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts b/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
index 155fea1aeb6d04..1251e49b56af82 100644
--- a/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
+++ b/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
@@ -6,6 +6,7 @@
  */
 
 import * as t from 'io-ts';
+import { toBooleanRt } from '@kbn/io-ts-utils';
 import {
   allOrAnyString,
   apmTransactionDurationIndicatorSchema,
@@ -105,6 +106,7 @@ const sloResponseSchema = t.intersection([
     groupBy: allOrAnyString,
     createdAt: dateType,
     updatedAt: dateType,
+    version: t.number,
   }),
   t.partial({
     instanceId: allOrAnyString,
@@ -153,6 +155,12 @@ const manageSLOParamsSchema = t.type({
   path: t.type({ id: sloIdSchema }),
 });
 
+const resetSLOParamsSchema = t.type({
+  path: t.type({ id: sloIdSchema }),
+});
+
+const resetSLOResponseSchema = sloResponseSchema;
+
 const updateSLOResponseSchema = sloResponseSchema;
 
 const findSLOResponseSchema = t.type({
@@ -178,23 +186,21 @@ const fetchHistoricalSummaryResponseSchema = t.array(
   })
 );
 
-/**
- * The query params schema for /internal/observability/slo/_definitions
- *
- * @private
- */
-const findSloDefinitionsParamsSchema = t.type({
-  query: t.type({
+const findSloDefinitionsParamsSchema = t.partial({
+  query: t.partial({
     search: t.string,
+    includeOutdatedOnly: toBooleanRt,
+    page: t.string,
+    perPage: t.string,
   }),
 });
 
-/**
- * The response schema for /internal/observability/slo/_definitions
- *
- * @private
- */
-const findSloDefinitionsResponseSchema = t.array(sloResponseSchema);
+const findSloDefinitionsResponseSchema = t.type({
+  page: t.number,
+  perPage: t.number,
+  total: t.number,
+  results: t.array(sloResponseSchema),
+});
 
 const getSLOBurnRatesResponseSchema = t.type({
   burnRates: t.array(
@@ -240,6 +246,9 @@ type GetSLOResponse = t.OutputOf<typeof getSLOResponseSchema>;
 
 type ManageSLOParams = t.TypeOf<typeof manageSLOParamsSchema.props.path>;
 
+type ResetSLOParams = t.TypeOf<typeof resetSLOParamsSchema.props.path>;
+type ResetSLOResponse = t.OutputOf<typeof resetSLOResponseSchema>;
+
 type UpdateSLOInput = t.OutputOf<typeof updateSLOParamsSchema.props.body>;
 type UpdateSLOParams = t.TypeOf<typeof updateSLOParamsSchema.props.body>;
 type UpdateSLOResponse = t.OutputOf<typeof updateSLOResponseSchema>;
@@ -254,12 +263,8 @@ type FetchHistoricalSummaryParams = t.TypeOf<typeof fetchHistoricalSummaryParams
 type FetchHistoricalSummaryResponse = t.OutputOf<typeof fetchHistoricalSummaryResponseSchema>;
 type HistoricalSummaryResponse = t.OutputOf<typeof historicalSummarySchema>;
 
-/**
- * The response type for /internal/observability/slo/_definitions
- *
- * @private
- */
-type FindSloDefinitionsResponse = t.OutputOf<typeof findSloDefinitionsResponseSchema>;
+type FindSLODefinitionsParams = t.TypeOf<typeof findSloDefinitionsParamsSchema.props.query>;
+type FindSLODefinitionsResponse = t.OutputOf<typeof findSloDefinitionsResponseSchema>;
 
 type GetPreviewDataParams = t.TypeOf<typeof getPreviewDataParamsSchema.props.body>;
 type GetPreviewDataResponse = t.OutputOf<typeof getPreviewDataResponseSchema>;
@@ -296,6 +301,8 @@ export {
   findSloDefinitionsParamsSchema,
   findSloDefinitionsResponseSchema,
   manageSLOParamsSchema,
+  resetSLOParamsSchema,
+  resetSLOResponseSchema,
   sloResponseSchema,
   sloWithSummaryResponseSchema,
   updateSLOParamsSchema,
@@ -321,8 +328,11 @@ export type {
   FetchHistoricalSummaryParams,
   FetchHistoricalSummaryResponse,
   HistoricalSummaryResponse,
-  FindSloDefinitionsResponse,
+  FindSLODefinitionsParams,
+  FindSLODefinitionsResponse,
   ManageSLOParams,
+  ResetSLOParams,
+  ResetSLOResponse,
   SLOResponse,
   SLOWithSummaryResponse,
   UpdateSLOInput,
diff --git a/x-pack/packages/kbn-slo-schema/src/schema/slo.ts b/x-pack/packages/kbn-slo-schema/src/schema/slo.ts
index 29df82010710dc..27e8a9e998f718 100644
--- a/x-pack/packages/kbn-slo-schema/src/schema/slo.ts
+++ b/x-pack/packages/kbn-slo-schema/src/schema/slo.ts
@@ -50,6 +50,7 @@ const sloSchema = t.type({
   createdAt: dateType,
   updatedAt: dateType,
   groupBy: allOrAnyString,
+  version: t.number,
 });
 
 const sloWithSummarySchema = t.intersection([sloSchema, t.type({ summary: summarySchema })]);
diff --git a/x-pack/packages/kbn-slo-schema/tsconfig.json b/x-pack/packages/kbn-slo-schema/tsconfig.json
index 3c94d9a902af8d..bc9fd2fdede8a2 100644
--- a/x-pack/packages/kbn-slo-schema/tsconfig.json
+++ b/x-pack/packages/kbn-slo-schema/tsconfig.json
@@ -11,7 +11,8 @@
     "**/*.ts"
   ],
   "kbn_references": [
-    "@kbn/std"
+    "@kbn/std",
+    "@kbn/io-ts-utils"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/packages/ml/agg_utils/index.ts b/x-pack/packages/ml/agg_utils/index.ts
index dd3b694d332c78..6aaf0ff0996462 100644
--- a/x-pack/packages/ml/agg_utils/index.ts
+++ b/x-pack/packages/ml/agg_utils/index.ts
@@ -18,17 +18,17 @@ export type {
   NumericHistogramField,
 } from './src/fetch_histograms_for_fields';
 export { isMultiBucketAggregate } from './src/is_multi_bucket_aggregate';
-export { isSignificantTerm } from './src/type_guards';
-export { SIGNIFICANT_TERM_TYPE } from './src/types';
+export { isSignificantItem } from './src/type_guards';
+export { SIGNIFICANT_ITEM_TYPE } from './src/types';
 export type {
   AggCardinality,
-  SignificantTerm,
-  SignificantTermGroup,
-  SignificantTermGroupItem,
-  SignificantTermGroupHistogram,
-  SignificantTermHistogram,
-  SignificantTermHistogramItem,
-  SignificantTermType,
+  SignificantItem,
+  SignificantItemGroup,
+  SignificantItemGroupItem,
+  SignificantItemGroupHistogram,
+  SignificantItemHistogram,
+  SignificantItemHistogramItem,
+  SignificantItemType,
   HistogramField,
   NumericColumnStats,
   NumericColumnStatsMap,
diff --git a/x-pack/packages/ml/agg_utils/src/type_guards.test.ts b/x-pack/packages/ml/agg_utils/src/type_guards.test.ts
index 9cf472abcfb03f..7a2c13a025d0b7 100644
--- a/x-pack/packages/ml/agg_utils/src/type_guards.test.ts
+++ b/x-pack/packages/ml/agg_utils/src/type_guards.test.ts
@@ -5,15 +5,15 @@
  * 2.0.
  */
 
-import { isSignificantTerm } from './type_guards';
+import { isSignificantItem } from './type_guards';
 
-describe('isSignificantTerm', () => {
-  it('identifies significant terms', () => {
-    expect(isSignificantTerm({})).toBeFalsy();
-    expect(isSignificantTerm({ fieldName: 'response_code' })).toBeFalsy();
-    expect(isSignificantTerm({ fieldValue: '500' })).toBeFalsy();
+describe('isSignificantItem', () => {
+  it('identifies significant items', () => {
+    expect(isSignificantItem({})).toBeFalsy();
+    expect(isSignificantItem({ fieldName: 'response_code' })).toBeFalsy();
+    expect(isSignificantItem({ fieldValue: '500' })).toBeFalsy();
     expect(
-      isSignificantTerm({
+      isSignificantItem({
         key: 'response_code:500',
         type: 'keyword',
         fieldName: 'response_code',
diff --git a/x-pack/packages/ml/agg_utils/src/type_guards.ts b/x-pack/packages/ml/agg_utils/src/type_guards.ts
index 0e33052c8658b3..7d8dbc69b265ea 100644
--- a/x-pack/packages/ml/agg_utils/src/type_guards.ts
+++ b/x-pack/packages/ml/agg_utils/src/type_guards.ts
@@ -7,17 +7,17 @@
 
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 
-import type { SignificantTerm } from './types';
+import type { SignificantItem } from './types';
 
 /**
- * Type guard for a significant term.
+ * Type guard for a significant item.
  * Note this is used as a custom type within Log Rate Analysis
  * for a p-value based variant, not a generic significant terms
  * aggregation type.
  * @param arg The unknown type to be evaluated
- * @returns whether arg is of type SignificantTerm
+ * @returns whether arg is of type SignificantItem
  */
-export function isSignificantTerm(arg: unknown): arg is SignificantTerm {
+export function isSignificantItem(arg: unknown): arg is SignificantItem {
   return isPopulatedObject(arg, [
     'key',
     'type',
diff --git a/x-pack/packages/ml/agg_utils/src/types.ts b/x-pack/packages/ml/agg_utils/src/types.ts
index d8e76239d0e09c..1f441fce09a6c8 100644
--- a/x-pack/packages/ml/agg_utils/src/types.ts
+++ b/x-pack/packages/ml/agg_utils/src/types.ts
@@ -88,25 +88,25 @@ export interface HistogramField {
 }
 
 /**
- * Enumeration of significant term types.
+ * Enumeration of significant item types.
  */
-export const SIGNIFICANT_TERM_TYPE = {
+export const SIGNIFICANT_ITEM_TYPE = {
   KEYWORD: 'keyword',
   LOG_PATTERN: 'log_pattern',
 } as const;
 
 /**
- * Type for significant term type keys.
+ * Type for significant item type keys.
  */
-type SignificantTermTypeKeys = keyof typeof SIGNIFICANT_TERM_TYPE;
+type SignificantItemTypeKeys = keyof typeof SIGNIFICANT_ITEM_TYPE;
 
 /**
- * Represents the type of significant term as determined by the SIGNIFICANT_TERM_TYPE enumeration.
+ * Represents the type of significant item as determined by the SIGNIFICANT_ITEM_TYPE enumeration.
  */
-export type SignificantTermType = typeof SIGNIFICANT_TERM_TYPE[SignificantTermTypeKeys];
+export type SignificantItemType = typeof SIGNIFICANT_ITEM_TYPE[SignificantItemTypeKeys];
 
 /**
- * Represents significant term metadata for a field/value pair.
+ * Represents significant item metadata for a field/value pair.
  * This interface is used as a custom type within Log Rate Analysis
  * for a p-value based variant, not related to the generic
  * significant terms aggregation type.
@@ -114,42 +114,42 @@ export type SignificantTermType = typeof SIGNIFICANT_TERM_TYPE[SignificantTermTy
  * @interface
  * @extends FieldValuePair
  */
-export interface SignificantTerm extends FieldValuePair {
-  /** The key associated with the significant term. */
+export interface SignificantItem extends FieldValuePair {
+  /** The key associated with the significant item. */
   key: string;
 
-  /** The type of the significant term. */
-  type: SignificantTermType;
+  /** The type of the significant item. */
+  type: SignificantItemType;
 
-  /** The document count for the significant term. */
+  /** The document count for the significant item. */
   doc_count: number;
 
-  /** The background count for the significant term. */
+  /** The background count for the significant item. */
   bg_count: number;
 
-  /** The total document count for all terms. */
+  /** The total document count for all items. */
   total_doc_count: number;
 
-  /** The total background count for all terms. */
+  /** The total background count for all items. */
   total_bg_count: number;
 
-  /** The score associated with the significant term. */
+  /** The score associated with the significant item. */
   score: number;
 
-  /** The p-value for the significant term, or null if not available. */
+  /** The p-value for the significant item, or null if not available. */
   pValue: number | null;
 
-  /** The normalized score for the significant term. */
+  /** The normalized score for the significant item. */
   normalizedScore: number;
 
-  /** An optional histogram of significant term items. */
-  histogram?: SignificantTermHistogramItem[];
+  /** An optional histogram for the significant item. */
+  histogram?: SignificantItemHistogramItem[];
 
-  /** Indicates if the significant term is unique within a group. */
+  /** Indicates if the significant item is unique within a group. */
   unique?: boolean;
 }
 
-interface SignificantTermHistogramItemBase {
+interface SignificantItemHistogramItemBase {
   /** The document count for this item in the overall context. */
   doc_count_overall: number;
 
@@ -163,12 +163,12 @@ interface SignificantTermHistogramItemBase {
 /**
  * @deprecated since version 2 of internal log rate analysis REST API endpoint
  */
-interface SignificantTermHistogramItemV1 extends SignificantTermHistogramItemBase {
+interface SignificantItemHistogramItemV1 extends SignificantItemHistogramItemBase {
   /** The document count for this item in the significant term context. */
   doc_count_significant_term: number;
 }
 
-interface SignificantTermHistogramItemV2 extends SignificantTermHistogramItemBase {
+interface SignificantItemHistogramItemV2 extends SignificantItemHistogramItemBase {
   /** The document count for this histogram item in the significant item context. */
   doc_count_significant_item: number;
 }
@@ -176,41 +176,41 @@ interface SignificantTermHistogramItemV2 extends SignificantTermHistogramItemBas
 /**
  * Represents a data item in a significant term histogram.
  */
-export type SignificantTermHistogramItem =
-  | SignificantTermHistogramItemV1
-  | SignificantTermHistogramItemV2;
+export type SignificantItemHistogramItem =
+  | SignificantItemHistogramItemV1
+  | SignificantItemHistogramItemV2;
 
 /**
  * Represents histogram data for a field/value pair.
  * @interface
  */
-export interface SignificantTermHistogram extends FieldValuePair {
-  /** An array of significant term histogram items. */
-  histogram: SignificantTermHistogramItem[];
+export interface SignificantItemHistogram extends FieldValuePair {
+  /** An array of significant item histogram items. */
+  histogram: SignificantItemHistogramItem[];
 }
 
 /**
  * Represents histogram data for a group of field/value pairs.
  * @interface
  */
-export interface SignificantTermGroupHistogram {
+export interface SignificantItemGroupHistogram {
   /** The identifier for the group. */
   id: string;
 
-  /** An array of significant term histogram items. */
-  histogram: SignificantTermHistogramItem[];
+  /** An array of significant item histogram items. */
+  histogram: SignificantItemHistogramItem[];
 }
 
 /**
- * Represents an item in a significant term group.
+ * Represents an item in a significant item group.
  * @interface
  */
-export interface SignificantTermGroupItem extends FieldValuePair {
-  /** The key associated with the significant term. */
+export interface SignificantItemGroupItem extends FieldValuePair {
+  /** The key associated with the significant item. */
   key: string;
 
-  /** The type of the significant term. */
-  type: SignificantTermType;
+  /** The type of the significant item. */
+  type: SignificantItemType;
 
   /** The document count associated with this item. */
   docCount: number;
@@ -223,15 +223,15 @@ export interface SignificantTermGroupItem extends FieldValuePair {
 }
 
 /**
- * Represents a significant term group.
+ * Represents a significant item group.
  * @interface
  */
-export interface SignificantTermGroup {
+export interface SignificantItemGroup {
   /** The identifier for the item. */
   id: string;
 
-  /** An array of significant term group items. */
-  group: SignificantTermGroupItem[];
+  /** An array of significant item group items. */
+  group: SignificantItemGroupItem[];
 
   /** The document count associated with this item. */
   docCount: number;
@@ -239,6 +239,6 @@ export interface SignificantTermGroup {
   /** The p-value for this item, or null if not available. */
   pValue: number | null;
 
-  /** An optional array of significant term histogram items. */
-  histogram?: SignificantTermHistogramItem[];
+  /** An optional array of significant item histogram items. */
+  histogram?: SignificantItemHistogramItem[];
 }
diff --git a/x-pack/packages/ml/response_stream/server/index.ts b/x-pack/packages/ml/response_stream/server/index.ts
index 820c76d173c747..2beb7223026174 100644
--- a/x-pack/packages/ml/response_stream/server/index.ts
+++ b/x-pack/packages/ml/response_stream/server/index.ts
@@ -5,4 +5,8 @@
  * 2.0.
  */
 
-export { streamFactory } from './stream_factory';
+export {
+  streamFactory,
+  type StreamFactoryReturnType,
+  type UncompressedResponseStream,
+} from './stream_factory';
diff --git a/x-pack/packages/ml/response_stream/server/stream_factory.ts b/x-pack/packages/ml/response_stream/server/stream_factory.ts
index 8836c241e55d8b..29c570c2fb564d 100644
--- a/x-pack/packages/ml/response_stream/server/stream_factory.ts
+++ b/x-pack/packages/ml/response_stream/server/stream_factory.ts
@@ -22,13 +22,13 @@ function isCompressedSream(arg: unknown): arg is zlib.Gzip {
 const FLUSH_KEEP_ALIVE_INTERVAL_MS = 500;
 const FLUSH_PAYLOAD_SIZE = 4 * 1024;
 
-class UncompressedResponseStream extends Stream.PassThrough {}
+export class UncompressedResponseStream extends Stream.PassThrough {}
 
 const DELIMITER = '\n';
 
 type StreamType = 'string' | 'ndjson';
 
-interface StreamFactoryReturnType<T = unknown> {
+export interface StreamFactoryReturnType<T = unknown> {
   DELIMITER: string;
   end: () => void;
   push: (d: T, drain?: boolean) => void;
diff --git a/x-pack/packages/observability/alert_details/kibana.jsonc b/x-pack/packages/observability/alert_details/kibana.jsonc
index e17a6f606dd897..f63d6cf11995dd 100644
--- a/x-pack/packages/observability/alert_details/kibana.jsonc
+++ b/x-pack/packages/observability/alert_details/kibana.jsonc
@@ -1,5 +1,5 @@
 {
   "type": "shared-common",
   "id": "@kbn/observability-alert-details",
-  "owner": "@elastic/actionable-observability"
+  "owner": "@elastic/obs-ux-management-team"
 }
diff --git a/x-pack/packages/observability/alerting_test_data/kibana.jsonc b/x-pack/packages/observability/alerting_test_data/kibana.jsonc
index 66b007cdd30b65..6bbf701e73c758 100644
--- a/x-pack/packages/observability/alerting_test_data/kibana.jsonc
+++ b/x-pack/packages/observability/alerting_test_data/kibana.jsonc
@@ -1,5 +1,5 @@
 {
   "type": "shared-common",
   "id": "@kbn/observability-alerting-test-data",
-  "owner": "@elastic/actionable-observability"
+  "owner": "@elastic/obs-ux-management-team"
 }
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts b/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts
index 296d1b95512d34..9c7e1fb6acdb74 100644
--- a/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -38,7 +39,7 @@ export const createCustomThresholdRule = async (
     params: {
       criteria: ruleParams.params?.criteria || [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
           threshold: [1],
           timeSize: 1,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts
index 39b7159ff478bb..c2515cfe1615a1 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario1 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.LT,
           threshold: [100],
           timeSize: 1,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts
index 882d83bbbf973f..68786ea4a06d26 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario2 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.LT,
           threshold: [40],
           timeSize: 1,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts
index 7be8b142380d12..97585a66b8385f 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario3 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.LT,
           threshold: [5],
           timeSize: 1,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts
index 755f89680b1714..0feec99ca5a470 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario4 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
           threshold: [80],
           timeSize: 1,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts
index a662608ab31d6d..a36bb4af2544c8 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario5 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
           threshold: [80],
           timeSize: 5,
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts
index 5e98aa1a58d318..16639c7749ca39 100644
--- a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -22,7 +23,7 @@ export const scenario6 = {
     params: {
       criteria: [
         {
-          aggType: Aggregators.CUSTOM,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.LT,
           threshold: [1],
           timeSize: 1,
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.json b/x-pack/plugins/actions/docs/openapi/bundled.json
index 1508ff2c1e0777..2f8bbf898efee5 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.json
+++ b/x-pack/plugins/actions/docs/openapi/bundled.json
@@ -294,6 +294,9 @@
                 "$ref": "#/components/schemas/run_connector_request"
               },
               "examples": {
+                "runEmailConnectorRequest": {
+                  "$ref": "#/components/examples/run_email_connector_request"
+                },
                 "runIndexConnectorRequest": {
                   "$ref": "#/components/examples/run_index_connector_request"
                 },
@@ -356,6 +359,9 @@
                   }
                 },
                 "examples": {
+                  "runEmailConnectorResponse": {
+                    "$ref": "#/components/examples/run_email_connector_response"
+                  },
                   "runIndexConnectorResponse": {
                     "$ref": "#/components/examples/run_index_connector_response"
                   },
@@ -4770,7 +4776,66 @@
           }
         }
       },
-      "run_connector_params_level_message": {
+      "run_connector_params_message_email": {
+        "title": "Email connector parameters",
+        "description": "Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.\n",
+        "type": "object",
+        "anyOf": [
+          {
+            "required": [
+              "bcc",
+              "message",
+              "subject"
+            ]
+          },
+          {
+            "required": [
+              "cc",
+              "message",
+              "subject"
+            ]
+          },
+          {
+            "required": [
+              "to",
+              "message",
+              "subject"
+            ]
+          }
+        ],
+        "properties": {
+          "bcc": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "A list of \"blind carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format\n"
+          },
+          "cc": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "A list of \"carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format \n"
+          },
+          "message": {
+            "type": "string",
+            "description": "The email message text. Markdown format is supported."
+          },
+          "subject": {
+            "type": "string",
+            "description": "The subject line of the email."
+          },
+          "to": {
+            "type": "array",
+            "description": "A list of email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.\n",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "run_connector_params_message_serverlog": {
         "title": "Server log connector parameters",
         "description": "Test an action that writes an entry to the Kibana server log.",
         "type": "object",
@@ -5448,7 +5513,10 @@
                 "$ref": "#/components/schemas/run_connector_params_documents"
               },
               {
-                "$ref": "#/components/schemas/run_connector_params_level_message"
+                "$ref": "#/components/schemas/run_connector_params_message_email"
+              },
+              {
+                "$ref": "#/components/schemas/run_connector_params_message_serverlog"
               },
               {
                 "title": "Subaction parameters",
@@ -5729,6 +5797,25 @@
           }
         }
       },
+      "run_email_connector_request": {
+        "summary": "Send an email message from an email connector.",
+        "value": {
+          "params": {
+            "bcc": [
+              "user1@example.com"
+            ],
+            "cc": [
+              "user2@example.com",
+              "user3@example.com"
+            ],
+            "message": "Test email message.",
+            "subject": "Test message subject",
+            "to": [
+              "user4@example.com"
+            ]
+          }
+        }
+      },
       "run_index_connector_request": {
         "summary": "Run an index connector.",
         "value": {
@@ -5795,6 +5882,36 @@
           }
         }
       },
+      "run_email_connector_response": {
+        "summary": "Response for sending a message from an email connector.",
+        "value": {
+          "connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907",
+          "data": {
+            "accepted": [
+              "user1@example.com",
+              "user2@example.com",
+              "user3@example.com",
+              "user4@example.com"
+            ],
+            "envelope": {
+              "from": "tester@example.com",
+              "to": [
+                "user1@example.com",
+                "user2@example.com",
+                "user3@example.com",
+                "user4@example.com"
+              ]
+            },
+            "envelopeTime": 8,
+            "messageTime": 3,
+            "messageSize": 729,
+            "response": "250 Message queued as QzEXKcGJ",
+            "messageId": "<08a92d29-642a-0706-750c-de5996bd5cf3@example.com>",
+            "rejected": []
+          },
+          "status": "ok"
+        }
+      },
       "run_index_connector_response": {
         "summary": "Response from running an index connector.",
         "value": {
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.yaml b/x-pack/plugins/actions/docs/openapi/bundled.yaml
index 9f5dd7e1107e2e..481d0f0a7ec420 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/actions/docs/openapi/bundled.yaml
@@ -179,6 +179,8 @@ paths:
             schema:
               $ref: '#/components/schemas/run_connector_request'
             examples:
+              runEmailConnectorRequest:
+                $ref: '#/components/examples/run_email_connector_request'
               runIndexConnectorRequest:
                 $ref: '#/components/examples/run_index_connector_request'
               runJiraConnectorRequest:
@@ -219,6 +221,8 @@ paths:
                       - error
                       - ok
               examples:
+                runEmailConnectorResponse:
+                  $ref: '#/components/examples/run_email_connector_response'
                 runIndexConnectorResponse:
                   $ref: '#/components/examples/run_index_connector_response'
                 runJiraConnectorResponse:
@@ -3345,7 +3349,50 @@ components:
           items:
             type: object
             additionalProperties: true
-    run_connector_params_level_message:
+    run_connector_params_message_email:
+      title: Email connector parameters
+      description: |
+        Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.
+      type: object
+      anyOf:
+        - required:
+            - bcc
+            - message
+            - subject
+        - required:
+            - cc
+            - message
+            - subject
+        - required:
+            - to
+            - message
+            - subject
+      properties:
+        bcc:
+          type: array
+          items:
+            type: string
+          description: |
+            A list of "blind carbon copy" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format
+        cc:
+          type: array
+          items:
+            type: string
+          description: |
+            A list of "carbon copy" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format 
+        message:
+          type: string
+          description: The email message text. Markdown format is supported.
+        subject:
+          type: string
+          description: The subject line of the email.
+        to:
+          type: array
+          description: |
+            A list of email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
+          items:
+            type: string
+    run_connector_params_message_serverlog:
       title: Server log connector parameters
       description: Test an action that writes an entry to the Kibana server log.
       type: object
@@ -3831,7 +3878,8 @@ components:
         params:
           oneOf:
             - $ref: '#/components/schemas/run_connector_params_documents'
-            - $ref: '#/components/schemas/run_connector_params_level_message'
+            - $ref: '#/components/schemas/run_connector_params_message_email'
+            - $ref: '#/components/schemas/run_connector_params_message_serverlog'
             - title: Subaction parameters
               description: Test an action that involves a subaction.
               oneOf:
@@ -4036,6 +4084,19 @@ components:
         name: updated-connector
         config:
           index: updated-index
+    run_email_connector_request:
+      summary: Send an email message from an email connector.
+      value:
+        params:
+          bcc:
+            - user1@example.com
+          cc:
+            - user2@example.com
+            - user3@example.com
+          message: Test email message.
+          subject: Test message subject
+          to:
+            - user4@example.com
     run_index_connector_request:
       summary: Run an index connector.
       value:
@@ -4077,6 +4138,30 @@ components:
               caseId: '1000'
               caseName: Case name
               description: Description of the incident.
+    run_email_connector_response:
+      summary: Response for sending a message from an email connector.
+      value:
+        connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
+        data:
+          accepted:
+            - user1@example.com
+            - user2@example.com
+            - user3@example.com
+            - user4@example.com
+          envelope:
+            from: tester@example.com
+            to:
+              - user1@example.com
+              - user2@example.com
+              - user3@example.com
+              - user4@example.com
+          envelopeTime: 8
+          messageTime: 3
+          messageSize: 729
+          response: 250 Message queued as QzEXKcGJ
+          messageId: <08a92d29-642a-0706-750c-de5996bd5cf3@example.com>
+          rejected: []
+        status: ok
     run_index_connector_response:
       summary: Response from running an index connector.
       value:
diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_request.yaml
new file mode 100644
index 00000000000000..72b5e36567b025
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_request.yaml
@@ -0,0 +1,12 @@
+summary: Send an email message from an email connector.
+value:
+  params:
+    bcc:
+      - user1@example.com
+    cc:
+      - user2@example.com
+      - user3@example.com 
+    message: Test email message.
+    subject: Test message subject
+    to:
+      - user4@example.com 
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_response.yaml
new file mode 100644
index 00000000000000..af0d2cf2d57dbd
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_email_connector_response.yaml
@@ -0,0 +1,23 @@
+summary: Response for sending a message from an email connector.
+value:
+  connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
+  data:
+    accepted:
+      - user1@example.com
+      - user2@example.com
+      - user3@example.com
+      - user4@example.com
+    envelope:
+      from: tester@example.com
+      to:
+        - user1@example.com
+        - user2@example.com
+        - user3@example.com
+        - user4@example.com
+    envelopeTime: 8
+    messageTime: 3
+    messageSize: 729
+    response: "250 Message queued as QzEXKcGJ"
+    messageId: "<08a92d29-642a-0706-750c-de5996bd5cf3@example.com>"
+    rejected: []
+  status: ok
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_message_email.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_message_email.yaml
new file mode 100644
index 00000000000000..3ab895c4ff5fe7
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_message_email.yaml
@@ -0,0 +1,37 @@
+title: Email connector parameters
+description: >
+  Test an action that sends an email message.
+  There must be at least one recipient in `to`, `cc`, or `bcc`.
+type: object
+anyOf:
+  - required: [ bcc, message, subject ]
+  - required: [ cc, message, subject ]
+  - required: [ to, message, subject ]
+properties:
+  bcc:
+    type: array
+    items:
+      type: string
+    description: >
+      A list of "blind carbon copy" email addresses.
+      Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format
+  cc:
+    type: array
+    items:
+      type: string
+    description: >
+      A list of "carbon copy" email addresses.
+      Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format 
+  message:
+    type: string
+    description: The email message text. Markdown format is supported.
+  subject:
+    type: string
+    description: The subject line of the email.
+  to:
+    type: array
+    description: >
+      A list of email addresses.
+      Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.
+    items:
+      type: string
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_level_message.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_message_serverlog.yaml
similarity index 100%
rename from x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_level_message.yaml
rename to x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_message_serverlog.yaml
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
index a313de571b501b..7602693cebe50c 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
@@ -7,7 +7,8 @@ properties:
   params:
     oneOf:
       - $ref: 'run_connector_params_documents.yaml'
-      - $ref: 'run_connector_params_level_message.yaml'
+      - $ref: 'run_connector_params_message_email.yaml'
+      - $ref: 'run_connector_params_message_serverlog.yaml'
       - title: Subaction parameters
         description: Test an action that involves a subaction.
         oneOf:
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml
index 7e7d0b8956853b..577a57fbb5d960 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml
@@ -17,6 +17,8 @@ post:
         schema:
           $ref: '../components/schemas/run_connector_request.yaml'
         examples:
+          runEmailConnectorRequest:
+            $ref: '../components/examples/run_email_connector_request.yaml'
           runIndexConnectorRequest:
             $ref: '../components/examples/run_index_connector_request.yaml'
           runJiraConnectorRequest:
@@ -57,6 +59,8 @@ post:
                   - error
                   - ok
           examples:
+            runEmailConnectorResponse:
+              $ref: '../components/examples/run_email_connector_response.yaml'
             runIndexConnectorResponse:
               $ref: '../components/examples/run_index_connector_response.yaml'
             runJiraConnectorResponse:
diff --git a/x-pack/plugins/actions/server/index.ts b/x-pack/plugins/actions/server/index.ts
index a82ec2fd1ce4a7..39b94204520b73 100644
--- a/x-pack/plugins/actions/server/index.ts
+++ b/x-pack/plugins/actions/server/index.ts
@@ -7,7 +7,6 @@
 import { get } from 'lodash';
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { ActionsPlugin } from './plugin';
 import { configSchema, ActionsConfig, CustomHostSettings } from './config';
 import { ActionsClient as ActionsClientClass } from './actions_client';
 import { ActionsAuthorization as ActionsAuthorizationClass } from './authorization/actions_authorization';
@@ -37,7 +36,10 @@ export {
 } from './lib';
 export { ACTION_SAVED_OBJECT_TYPE } from './constants/saved_objects';
 
-export const plugin = (initContext: PluginInitializerContext) => new ActionsPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { ActionsPlugin } = await import('./plugin');
+  return new ActionsPlugin(initContext);
+};
 
 export { SubActionConnector } from './sub_action_framework/sub_action_connector';
 export { CaseConnector } from './sub_action_framework/case';
diff --git a/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts
index 223c8c28b55bc6..fa5be0e332330e 100644
--- a/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts
+++ b/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts
@@ -123,7 +123,7 @@ describe('requestOAuthClientCredentialsToken', () => {
 
     expect(mockLogger.warn.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
-        "error thrown getting the access token from https://test for params: {\\"scope\\":\\"test\\",\\"client_id\\":\\"123456\\",\\"client_secret\\":\\"secrert123\\"}: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
+        "error thrown getting the access token from https://test: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
       ]
     `);
   });
diff --git a/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts
index af65bcf67d3dbb..c096212af440ea 100644
--- a/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts
+++ b/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts
@@ -125,7 +125,7 @@ describe('requestOAuthJWTToken', () => {
 
     expect(mockLogger.warn.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
-        "error thrown getting the access token from https://test for params: {\\"assertion\\":\\"someJWTvalueishere\\",\\"scope\\":\\"test\\",\\"client_id\\":\\"client-id-1\\",\\"client_secret\\":\\"some-client-secret\\"}: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
+        "error thrown getting the access token from https://test: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
       ]
     `);
   });
diff --git a/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts
index 9843783aadf8de..cc7d6d5e4822d5 100644
--- a/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts
+++ b/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts
@@ -132,7 +132,7 @@ describe('requestOAuthToken', () => {
 
     expect(mockLogger.warn.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
-        "error thrown getting the access token from https://test for params: {\\"client_id\\":\\"123456\\",\\"client_secret\\":\\"secrert123\\",\\"some_additional_param\\":\\"test\\"}: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
+        "error thrown getting the access token from https://test: {\\"error\\":\\"invalid_scope\\",\\"error_description\\":\\"AADSTS70011: The provided value for the input parameter 'scope' is not valid.\\"}",
       ]
     `);
   });
diff --git a/x-pack/plugins/actions/server/lib/request_oauth_token.ts b/x-pack/plugins/actions/server/lib/request_oauth_token.ts
index 116d3f2cc33150..ab62dd726f7a85 100644
--- a/x-pack/plugins/actions/server/lib/request_oauth_token.ts
+++ b/x-pack/plugins/actions/server/lib/request_oauth_token.ts
@@ -52,11 +52,7 @@ export async function requestOAuthToken<T>(
     };
   } else {
     const errString = stringify(res.data);
-    logger.warn(
-      `error thrown getting the access token from ${tokenUrl} for params: ${JSON.stringify(
-        bodyRequest
-      )}: ${errString}`
-    );
+    logger.warn(`error thrown getting the access token from ${tokenUrl}: ${errString}`);
     throw new Error(errString);
   }
 }
diff --git a/x-pack/plugins/aiops/README.md b/x-pack/plugins/aiops/README.md
index 2d07e0c34653a6..2ea2a315c594f1 100755
--- a/x-pack/plugins/aiops/README.md
+++ b/x-pack/plugins/aiops/README.md
@@ -4,6 +4,16 @@ The plugin provides APIs and components for AIOps features, including the “Log
 
 ---
 
+## Log Rate Analysis
+
+Here's some notes on the structure of the code for the API endpoint `/internal/aiops/log_rate_analysis`. The endpoint uses the `@kbn/ml-response-stream` package to return the request's response as a HTTP stream of JSON objects. The files are located in `x-pack/plugins/aiops/server/routes/log_rate_analysis/`.
+
+`define_route.ts:defineRoute()` is the outer most wrapper that's used to define the route and its versions. It calls `route_handler_factory:routeHandlerFactory()` for each version.
+
+The route handler sets up `response_stream_factory:responseStreamFactory()` to create the response stream and then walks through the steps of the analysis.
+
+The response stream factory acts as a wrapper to set up the stream itself, the stream state (for example to set if it's running etc.), some custom actions on the stream as well as analysis handlers that fetch data from ES and pass it on to the stream.
+
 ## Development
 
 See the [kibana contributing guide](https://github.com/elastic/kibana/blob/main/CONTRIBUTING.md) for instructions setting up your development environment.
diff --git a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups.ts b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups.ts
similarity index 94%
rename from x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups.ts
rename to x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups.ts
index 7166e548449eb0..8f28e49ca3d7ac 100644
--- a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-export const finalSignificantTermGroups: SignificantTermGroup[] = [
+export const finalSignificantItemGroups: SignificantItemGroup[] = [
   {
     docCount: 632,
     group: [
diff --git a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups_textfield.ts b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups_textfield.ts
similarity index 95%
rename from x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups_textfield.ts
rename to x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups_textfield.ts
index f959d9408c4184..617a42b930f454 100644
--- a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_term_groups_textfield.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/final_significant_item_groups_textfield.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-export const finalSignificantTermGroupsTextfield: SignificantTermGroup[] = [
+export const finalSignificantItemGroupsTextfield: SignificantItemGroup[] = [
   {
     docCount: 636,
     group: [
diff --git a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_term_groups.ts b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_item_groups.ts
similarity index 85%
rename from x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_term_groups.ts
rename to x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_item_groups.ts
index 160ce3967cd435..b66738704b2506 100644
--- a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_term_groups.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_item_groups.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-export const significantTermGroups: SignificantTermGroup[] = [
+export const significantItemGroups: SignificantItemGroup[] = [
   {
     id: '2038579476',
     group: [
diff --git a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_log_patterns.ts b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_log_patterns.ts
index ab3ebe02dc5369..9efef525ccd575 100644
--- a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_log_patterns.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_log_patterns.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
-export const significantLogPatterns: SignificantTerm[] = [
+// Named significantLogPatterns since all these items are of type `log_pattern`.
+export const significantLogPatterns: SignificantItem[] = [
   {
     bg_count: 0,
     doc_count: 1266,
diff --git a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_terms.ts b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_terms.ts
index 4512f5943f4d0a..538bf1bc65eb1a 100644
--- a/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_terms.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/artificial_logs/significant_terms.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
-export const significantTerms: SignificantTerm[] = [
+// Named significantTerms since all these items are of type `keyword`.
+export const significantTerms: SignificantItem[] = [
   {
     key: 'user:Peter',
     type: 'keyword',
diff --git a/x-pack/plugins/aiops/common/__mocks__/farequote/significant_term_groups.ts b/x-pack/plugins/aiops/common/__mocks__/farequote/significant_item_groups.ts
similarity index 90%
rename from x-pack/plugins/aiops/common/__mocks__/farequote/significant_term_groups.ts
rename to x-pack/plugins/aiops/common/__mocks__/farequote/significant_item_groups.ts
index 5058f0dbe7e985..95b359f31ea36c 100644
--- a/x-pack/plugins/aiops/common/__mocks__/farequote/significant_term_groups.ts
+++ b/x-pack/plugins/aiops/common/__mocks__/farequote/significant_item_groups.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-export const significantTermGroups: SignificantTermGroup[] = [
+export const significantItemGroups: SignificantItemGroup[] = [
   {
     id: 'group-1',
     group: [
diff --git a/x-pack/plugins/aiops/common/api/log_rate_analysis/actions.ts b/x-pack/plugins/aiops/common/api/log_rate_analysis/actions.ts
index 4075ddffd27f15..bd3afd3152ae5c 100644
--- a/x-pack/plugins/aiops/common/api/log_rate_analysis/actions.ts
+++ b/x-pack/plugins/aiops/common/api/log_rate_analysis/actions.ts
@@ -6,10 +6,10 @@
  */
 
 import type {
-  SignificantTerm,
-  SignificantTermHistogram,
-  SignificantTermGroup,
-  SignificantTermGroupHistogram,
+  SignificantItem,
+  SignificantItemHistogram,
+  SignificantItemGroup,
+  SignificantItemGroupHistogram,
 } from '@kbn/ml-agg-utils';
 
 import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from './schema';
@@ -40,108 +40,108 @@ export const API_ACTION_NAME = {
 } as const;
 export type ApiActionName = typeof API_ACTION_NAME[keyof typeof API_ACTION_NAME];
 
-interface ApiActionAddSignificantTerms<T extends ApiVersion> {
+interface ApiActionAddSignificantItems<T extends ApiVersion> {
   type: T extends '1'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_TERMS
     : T extends '2'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS
     : never;
-  payload: SignificantTerm[];
+  payload: SignificantItem[];
 }
 
-export function addSignificantTermsAction<T extends ApiVersion>(
-  payload: ApiActionAddSignificantTerms<T>['payload'],
+export function addSignificantItemsAction<T extends ApiVersion>(
+  payload: ApiActionAddSignificantItems<T>['payload'],
   version: T
-): ApiActionAddSignificantTerms<T> {
+): ApiActionAddSignificantItems<T> {
   if (version === '1') {
     return {
       type: API_ACTION_NAME.ADD_SIGNIFICANT_TERMS,
       payload,
-    } as ApiActionAddSignificantTerms<T>;
+    } as ApiActionAddSignificantItems<T>;
   }
 
   return {
     type: API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS,
     payload,
-  } as ApiActionAddSignificantTerms<T>;
+  } as ApiActionAddSignificantItems<T>;
 }
 
-interface ApiActionAddSignificantTermsHistogram<T extends ApiVersion> {
+interface ApiActionAddSignificantItemsHistogram<T extends ApiVersion> {
   type: T extends '1'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_HISTOGRAM
     : T extends '2'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_HISTOGRAM
     : never;
-  payload: SignificantTermHistogram[];
+  payload: SignificantItemHistogram[];
 }
 
-export function addSignificantTermsHistogramAction<T extends ApiVersion>(
-  payload: ApiActionAddSignificantTermsHistogram<T>['payload'],
+export function addSignificantItemsHistogramAction<T extends ApiVersion>(
+  payload: ApiActionAddSignificantItemsHistogram<T>['payload'],
   version: T
-): ApiActionAddSignificantTermsHistogram<T> {
+): ApiActionAddSignificantItemsHistogram<T> {
   if (version === '1') {
     return {
       type: API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_HISTOGRAM,
       payload,
-    } as ApiActionAddSignificantTermsHistogram<T>;
+    } as ApiActionAddSignificantItemsHistogram<T>;
   }
 
   return {
     type: API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_HISTOGRAM,
     payload,
-  } as ApiActionAddSignificantTermsHistogram<T>;
+  } as ApiActionAddSignificantItemsHistogram<T>;
 }
 
-interface ApiActionAddSignificantTermsGroup<T extends ApiVersion> {
+interface ApiActionAddSignificantItemsGroup<T extends ApiVersion> {
   type: T extends '1'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_GROUP
     : T extends '2'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_GROUP
     : never;
-  payload: SignificantTermGroup[];
+  payload: SignificantItemGroup[];
 }
 
-export function addSignificantTermsGroupAction<T extends ApiVersion>(
-  payload: ApiActionAddSignificantTermsGroup<T>['payload'],
+export function addSignificantItemsGroupAction<T extends ApiVersion>(
+  payload: ApiActionAddSignificantItemsGroup<T>['payload'],
   version: T
-): ApiActionAddSignificantTermsGroup<T> {
+): ApiActionAddSignificantItemsGroup<T> {
   if (version === '1') {
     return {
       type: API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_GROUP,
       payload,
-    } as ApiActionAddSignificantTermsGroup<T>;
+    } as ApiActionAddSignificantItemsGroup<T>;
   }
 
   return {
     type: API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_GROUP,
     payload,
-  } as ApiActionAddSignificantTermsGroup<T>;
+  } as ApiActionAddSignificantItemsGroup<T>;
 }
 
-interface ApiActionAddSignificantTermsGroupHistogram<T extends ApiVersion> {
+interface ApiActionAddSignificantItemsGroupHistogram<T extends ApiVersion> {
   type: T extends '1'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_GROUP_HISTOGRAM
     : T extends '2'
     ? typeof API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_GROUP_HISTOGRAM
     : never;
-  payload: SignificantTermGroupHistogram[];
+  payload: SignificantItemGroupHistogram[];
 }
 
-export function addSignificantTermsGroupHistogramAction<T extends ApiVersion>(
-  payload: ApiActionAddSignificantTermsGroupHistogram<T>['payload'],
+export function addSignificantItemsGroupHistogramAction<T extends ApiVersion>(
+  payload: ApiActionAddSignificantItemsGroupHistogram<T>['payload'],
   version: T
-): ApiActionAddSignificantTermsGroupHistogram<T> {
+): ApiActionAddSignificantItemsGroupHistogram<T> {
   if (version === '1') {
     return {
       type: API_ACTION_NAME.ADD_SIGNIFICANT_TERMS_GROUP_HISTOGRAM,
       payload,
-    } as ApiActionAddSignificantTermsGroupHistogram<T>;
+    } as ApiActionAddSignificantItemsGroupHistogram<T>;
   }
 
   return {
     type: API_ACTION_NAME.ADD_SIGNIFICANT_ITEMS_GROUP_HISTOGRAM,
     payload,
-  } as ApiActionAddSignificantTermsGroupHistogram<T>;
+  } as ApiActionAddSignificantItemsGroupHistogram<T>;
 }
 
 interface ApiActionAddError {
@@ -211,10 +211,10 @@ export function updateLoadingStateAction(
 }
 
 export type AiopsLogRateAnalysisApiAction<T extends ApiVersion> =
-  | ApiActionAddSignificantTerms<T>
-  | ApiActionAddSignificantTermsGroup<T>
-  | ApiActionAddSignificantTermsHistogram<T>
-  | ApiActionAddSignificantTermsGroupHistogram<T>
+  | ApiActionAddSignificantItems<T>
+  | ApiActionAddSignificantItemsGroup<T>
+  | ApiActionAddSignificantItemsHistogram<T>
+  | ApiActionAddSignificantItemsGroupHistogram<T>
   | ApiActionAddError
   | ApiActionPing
   | ApiActionResetAll
diff --git a/x-pack/plugins/aiops/common/api/stream_reducer.test.ts b/x-pack/plugins/aiops/common/api/stream_reducer.test.ts
index 7802d61e1781ec..f3dd6cce856c74 100644
--- a/x-pack/plugins/aiops/common/api/stream_reducer.test.ts
+++ b/x-pack/plugins/aiops/common/api/stream_reducer.test.ts
@@ -6,11 +6,11 @@
  */
 
 import { significantTerms } from '../__mocks__/artificial_logs/significant_terms';
-import { finalSignificantTermGroups } from '../__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../__mocks__/artificial_logs/final_significant_item_groups';
 
 import {
-  addSignificantTermsAction,
-  addSignificantTermsGroupAction,
+  addSignificantItemsAction,
+  addSignificantItemsGroupAction,
   resetAllAction,
   resetGroupsAction,
   updateLoadingStateAction,
@@ -37,7 +37,7 @@ describe('streamReducer', () => {
   it('adds significant item, then resets all state again', () => {
     const state1 = streamReducer(
       initialState,
-      addSignificantTermsAction(
+      addSignificantItemsAction(
         [
           {
             key: 'the-field-name:the-field-value',
@@ -65,14 +65,14 @@ describe('streamReducer', () => {
   });
 
   it('adds significant items and groups, then resets groups only', () => {
-    const state1 = streamReducer(initialState, addSignificantTermsAction(significantTerms, '2'));
+    const state1 = streamReducer(initialState, addSignificantItemsAction(significantTerms, '2'));
 
     expect(state1.significantItems).toHaveLength(4);
     expect(state1.significantItemsGroups).toHaveLength(0);
 
     const state2 = streamReducer(
       state1,
-      addSignificantTermsGroupAction(finalSignificantTermGroups, '2')
+      addSignificantItemsGroupAction(finalSignificantItemGroups, '2')
     );
 
     expect(state2.significantItems).toHaveLength(4);
diff --git a/x-pack/plugins/aiops/common/api/stream_reducer.ts b/x-pack/plugins/aiops/common/api/stream_reducer.ts
index ba9e8014665c80..05d3fce52c22e4 100644
--- a/x-pack/plugins/aiops/common/api/stream_reducer.ts
+++ b/x-pack/plugins/aiops/common/api/stream_reducer.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import { API_ACTION_NAME, AiopsLogRateAnalysisApiAction } from './log_rate_analysis/actions';
 
 interface StreamState {
   ccsWarning: boolean;
-  significantItems: SignificantTerm[];
-  significantItemsGroups: SignificantTermGroup[];
+  significantItems: SignificantItem[];
+  significantItemsGroups: SignificantItemGroup[];
   errors: string[];
   loaded: number;
   loadingState: string;
diff --git a/x-pack/plugins/aiops/common/types.ts b/x-pack/plugins/aiops/common/types.ts
index 4b26e30c76a72c..67fca0b473549e 100644
--- a/x-pack/plugins/aiops/common/types.ts
+++ b/x-pack/plugins/aiops/common/types.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import type { SignificantTerm, SignificantTermType, FieldValuePair } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemType, FieldValuePair } from '@kbn/ml-agg-utils';
 
-export interface SignificantTermDuplicateGroup {
-  keys: Pick<SignificantTerm, keyof SignificantTerm>;
-  group: SignificantTerm[];
+export interface SignificantItemDuplicateGroup {
+  keys: Pick<SignificantItem, keyof SignificantItem>;
+  group: SignificantItem[];
 }
 
 export type FieldValuePairCounts = Record<string, Record<string, number>>;
@@ -31,7 +31,7 @@ export interface FetchFrequentItemSetsResponse {
 
 interface SimpleHierarchicalTreeNodeSet extends FieldValuePair {
   key: string;
-  type: SignificantTermType;
+  type: SignificantItemType;
   docCount: number;
   pValue: number | null;
 }
diff --git a/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
index 797f6f1e36a00c..37a984dae490d8 100644
--- a/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
+++ b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import type { GroupTableItem } from '../../components/log_rate_analysis_results_table/types';
 
 import { buildExtendedBaseFilterCriteria } from './build_extended_base_filter_criteria';
 
-const selectedSignificantTermMock: SignificantTerm = {
+const selectedSignificantItemMock: SignificantItem = {
   key: 'meta.cloud.instance_id.keyword:1234',
   type: 'keyword',
   doc_count: 53408,
@@ -123,13 +123,13 @@ describe('query_utils', () => {
       ]);
     });
 
-    it('includes a term filter when including a selectedSignificantTerm', () => {
+    it('includes a term filter when including a selectedSignificantItem', () => {
       const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
         { match_all: {} },
-        selectedSignificantTermMock
+        selectedSignificantItemMock
       );
 
       expect(baseFilterCriteria).toEqual([
@@ -147,13 +147,13 @@ describe('query_utils', () => {
       ]);
     });
 
-    it('includes a term filter with must_not when excluding a selectedSignificantTerm', () => {
+    it('includes a term filter with must_not when excluding a selectedSignificantItem', () => {
       const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
         { match_all: {} },
-        selectedSignificantTermMock,
+        selectedSignificantItemMock,
         false
       );
 
diff --git a/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
index ee4e707304ff4f..d01951b6b86553 100644
--- a/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
+++ b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
@@ -11,7 +11,7 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { Query } from '@kbn/es-query';
-import { type SignificantTerm, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { type SignificantItem, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 
 import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
 
@@ -30,8 +30,8 @@ export function buildExtendedBaseFilterCriteria(
   earliestMs?: number,
   latestMs?: number,
   query?: Query['query'],
-  selectedSignificantTerm?: SignificantTerm,
-  includeSelectedSignificantTerm = true,
+  selectedSignificantItem?: SignificantItem,
+  includeSelectedSignificantItem = true,
   selectedGroup?: GroupTableItem | null
 ): estypes.QueryDslQueryContainer[] {
   const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
@@ -41,7 +41,7 @@ export function buildExtendedBaseFilterCriteria(
     const allItems = selectedGroup.groupItemsSortedByUniqueness;
     for (const item of allItems) {
       const { fieldName, fieldValue, key, type, docCount } = item;
-      if (type === SIGNIFICANT_TERM_TYPE.KEYWORD) {
+      if (type === SIGNIFICANT_ITEM_TYPE.KEYWORD) {
         groupFilter.push({ term: { [fieldName]: fieldValue } });
       } else {
         groupFilter.push(
@@ -57,18 +57,18 @@ export function buildExtendedBaseFilterCriteria(
     }
   }
 
-  if (includeSelectedSignificantTerm) {
-    if (selectedSignificantTerm) {
-      if (selectedSignificantTerm.type === 'keyword') {
+  if (includeSelectedSignificantItem) {
+    if (selectedSignificantItem) {
+      if (selectedSignificantItem.type === 'keyword') {
         filterCriteria.push({
-          term: { [selectedSignificantTerm.fieldName]: selectedSignificantTerm.fieldValue },
+          term: { [selectedSignificantItem.fieldName]: selectedSignificantItem.fieldValue },
         });
       } else {
         filterCriteria.push(
-          getCategoryQuery(selectedSignificantTerm.fieldName, [
+          getCategoryQuery(selectedSignificantItem.fieldName, [
             {
-              key: `${selectedSignificantTerm.key}`,
-              count: selectedSignificantTerm.doc_count,
+              key: `${selectedSignificantItem.key}`,
+              count: selectedSignificantItem.doc_count,
               examples: [],
             },
           ])
@@ -77,13 +77,13 @@ export function buildExtendedBaseFilterCriteria(
     } else if (selectedGroup) {
       filterCriteria.push(...groupFilter);
     }
-  } else if (selectedSignificantTerm && !includeSelectedSignificantTerm) {
-    if (selectedSignificantTerm.type === 'keyword') {
+  } else if (selectedSignificantItem && !includeSelectedSignificantItem) {
+    if (selectedSignificantItem.type === 'keyword') {
       filterCriteria.push({
         bool: {
           must_not: [
             {
-              term: { [selectedSignificantTerm.fieldName]: selectedSignificantTerm.fieldValue },
+              term: { [selectedSignificantItem.fieldName]: selectedSignificantItem.fieldValue },
             },
           ],
         },
@@ -92,10 +92,10 @@ export function buildExtendedBaseFilterCriteria(
       filterCriteria.push({
         bool: {
           must_not: [
-            getCategoryQuery(selectedSignificantTerm.fieldName, [
+            getCategoryQuery(selectedSignificantItem.fieldName, [
               {
-                key: `${selectedSignificantTerm.key}`,
-                count: selectedSignificantTerm.doc_count,
+                key: `${selectedSignificantItem.key}`,
+                count: selectedSignificantItem.doc_count,
                 examples: [],
               },
             ]),
@@ -103,7 +103,7 @@ export function buildExtendedBaseFilterCriteria(
         },
       });
     }
-  } else if (selectedGroup && !includeSelectedSignificantTerm) {
+  } else if (selectedGroup && !includeSelectedSignificantItem) {
     filterCriteria.push({
       bool: {
         must_not: [
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_content/log_rate_analysis_content.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_content/log_rate_analysis_content.tsx
index 5e2af3d4cb917a..0770cfea837718 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_content/log_rate_analysis_content.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_content/log_rate_analysis_content.tsx
@@ -20,7 +20,7 @@ import {
   type LogRateAnalysisType,
   type WindowParameters,
 } from '@kbn/aiops-utils';
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import { useData } from '../../../hooks/use_data';
 
@@ -35,11 +35,11 @@ import { useLogRateAnalysisResultsTableRowContext } from '../../log_rate_analysi
 const DEFAULT_SEARCH_QUERY = { match_all: {} };
 
 export function getDocumentCountStatsSplitLabel(
-  significantTerm?: SignificantTerm,
+  significantItem?: SignificantItem,
   group?: GroupTableItem
 ) {
-  if (significantTerm) {
-    return `${significantTerm?.fieldName}:${significantTerm?.fieldValue}`;
+  if (significantItem) {
+    return `${significantItem?.fieldName}:${significantItem?.fieldValue}`;
   } else if (group) {
     return i18n.translate('xpack.aiops.logRateAnalysis.page.documentCountStatsSplitGroupLabel', {
       defaultMessage: 'Selected group',
@@ -94,11 +94,11 @@ export const LogRateAnalysisContent: FC<LogRateAnalysisContentProps> = ({
   }, [windowParameters]);
 
   const {
-    currentSelectedSignificantTerm,
+    currentSelectedSignificantItem,
     currentSelectedGroup,
-    setPinnedSignificantTerm,
+    setPinnedSignificantItem,
     setPinnedGroup,
-    setSelectedSignificantTerm,
+    setSelectedSignificantItem,
     setSelectedGroup,
   } = useLogRateAnalysisResultsTableRowContext();
 
@@ -107,7 +107,7 @@ export const LogRateAnalysisContent: FC<LogRateAnalysisContentProps> = ({
     'log_rate_analysis',
     esSearchQuery,
     setGlobalState,
-    currentSelectedSignificantTerm,
+    currentSelectedSignificantItem,
     currentSelectedGroup,
     undefined,
     timeRange
@@ -132,9 +132,9 @@ export const LogRateAnalysisContent: FC<LogRateAnalysisContentProps> = ({
 
   function clearSelection() {
     setWindowParameters(undefined);
-    setPinnedSignificantTerm(null);
+    setPinnedSignificantItem(null);
     setPinnedGroup(null);
-    setSelectedSignificantTerm(null);
+    setSelectedSignificantItem(null);
     setSelectedGroup(null);
     setIsBrushCleared(true);
     setInitialAnalysisStart(undefined);
@@ -148,7 +148,7 @@ export const LogRateAnalysisContent: FC<LogRateAnalysisContentProps> = ({
           documentCountStats={documentCountStats}
           documentCountStatsSplit={documentCountStatsCompare}
           documentCountStatsSplitLabel={getDocumentCountStatsSplitLabel(
-            currentSelectedSignificantTerm,
+            currentSelectedSignificantItem,
             currentSelectedGroup
           )}
           isBrushCleared={isBrushCleared}
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_page.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_page.tsx
index c3d53fb999023b..b3c9f256fb2ea6 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_page.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_page.tsx
@@ -37,7 +37,7 @@ export const LogRateAnalysisPage: FC<Props> = ({ stickyHistogram }) => {
   const { data: dataService } = useAiopsAppContext();
   const { dataView, savedSearch } = useDataSource();
 
-  const { currentSelectedSignificantTerm, currentSelectedGroup } =
+  const { currentSelectedSignificantItem, currentSelectedGroup } =
     useLogRateAnalysisResultsTableRowContext();
 
   const [aiopsListState, setAiopsListState] = usePageUrlState<AiOpsPageUrlState>(
@@ -88,7 +88,7 @@ export const LogRateAnalysisPage: FC<Props> = ({ stickyHistogram }) => {
     'log_rate_analysis',
     searchQuery,
     setGlobalState,
-    currentSelectedSignificantTerm,
+    currentSelectedSignificantItem,
     currentSelectedGroup
   );
 
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_results.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_results.tsx
index 3a236085cd6cf2..457419c8b0501e 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_results.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis/log_rate_analysis_results.tsx
@@ -31,7 +31,7 @@ import {
 } from '@kbn/aiops-utils';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
 import { initialState, streamReducer } from '../../../common/api/stream_reducer';
@@ -81,9 +81,9 @@ export interface LogRateAnalysisResultsData {
   /** The type of analysis, whether it's a spike or dip */
   analysisType: LogRateAnalysisType;
   /** Statistically significant field/value items. */
-  significantTerms: SignificantTerm[];
+  significantItems: SignificantItem[];
   /** Statistically significant groups of field/value items. */
-  significantTermsGroups: SignificantTermGroup[];
+  significantItemsGroups: SignificantItemGroup[];
 }
 
 /**
@@ -234,8 +234,8 @@ export const LogRateAnalysisResults: FC<LogRateAnalysisResultsProps> = ({
         if (onAnalysisCompleted) {
           onAnalysisCompleted({
             analysisType,
-            significantTerms: data.significantItems,
-            significantTermsGroups: data.significantItemsGroups,
+            significantItems: data.significantItems,
+            significantItemsGroups: data.significantItemsGroups,
           });
         }
       }
@@ -246,7 +246,7 @@ export const LogRateAnalysisResults: FC<LogRateAnalysisResultsProps> = ({
   const errors = useMemo(() => [...streamErrors, ...data.errors], [streamErrors, data.errors]);
 
   // Start handler clears possibly hovered or pinned
-  // significant terms on analysis refresh.
+  // significant items on analysis refresh.
   function startHandler(continueAnalysis = false, resetGroupButton = true) {
     if (!continueAnalysis) {
       setOverrides(undefined);
@@ -482,7 +482,7 @@ export const LogRateAnalysisResults: FC<LogRateAnalysisResultsProps> = ({
       >
         {showLogRateAnalysisResultsTable && groupResults ? (
           <LogRateAnalysisResultsGroupsTable
-            significantTerms={data.significantItems}
+            significantItems={data.significantItems}
             groupTableItems={groupTableItems}
             loading={isRunning}
             dataView={dataView}
@@ -494,7 +494,7 @@ export const LogRateAnalysisResults: FC<LogRateAnalysisResultsProps> = ({
         ) : null}
         {showLogRateAnalysisResultsTable && !groupResults ? (
           <LogRateAnalysisResultsTable
-            significantTerms={data.significantItems}
+            significantItems={data.significantItems}
             loading={isRunning}
             dataView={dataView}
             timeRangeMs={timeRangeMs}
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.test.ts b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.test.ts
index 6e6ea7594f69ce..c674da39486445 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.test.ts
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import { finalSignificantTermGroups } from '../../../common/__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../../../common/__mocks__/artificial_logs/final_significant_item_groups';
 
 import { getGroupTableItems } from './get_group_table_items';
 
 describe('getGroupTableItems', () => {
   it('transforms groups into table items', () => {
-    const groupTableItems = getGroupTableItems(finalSignificantTermGroups);
+    const groupTableItems = getGroupTableItems(finalSignificantItemGroups);
 
     expect(groupTableItems).toEqual([
       {
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.ts b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.ts
index 11331037de4819..6767b824449460 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.ts
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_group_table_items.ts
@@ -7,14 +7,14 @@
 
 import { sortBy } from 'lodash';
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import type { GroupTableItem, GroupTableItemGroup } from './types';
 
 export function getGroupTableItems(
-  significantTermsGroups: SignificantTermGroup[]
+  significantItemsGroups: SignificantItemGroup[]
 ): GroupTableItem[] {
-  const tableItems = significantTermsGroups.map(({ id, group, docCount, histogram, pValue }) => {
+  const tableItems = significantItemsGroups.map(({ id, group, docCount, histogram, pValue }) => {
     const sortedGroup = sortBy(group, [(d) => d.fieldName]);
     const dedupedGroup: GroupTableItemGroup[] = [];
 
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.test.ts b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.test.ts
index 99b5e9830b08ab..64f4fde55a6607 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.test.ts
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.test.ts
@@ -5,21 +5,21 @@
  * 2.0.
  */
 
-import { finalSignificantTermGroups } from '../../../common/__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../../../common/__mocks__/artificial_logs/final_significant_item_groups';
 import { significantTerms } from '../../../common/__mocks__/artificial_logs/significant_terms';
 
 import { getGroupTableItems } from './get_group_table_items';
 import { getTableItemAsKQL } from './get_table_item_as_kql';
 
 describe('getTableItemAsKQL', () => {
-  it('returns a KQL syntax for a significant term', () => {
+  it('returns a KQL syntax for a significant item', () => {
     expect(getTableItemAsKQL(significantTerms[0])).toBe('user:Peter');
     expect(getTableItemAsKQL(significantTerms[1])).toBe('response_code:500');
     expect(getTableItemAsKQL(significantTerms[2])).toBe('url:home.php');
     expect(getTableItemAsKQL(significantTerms[3])).toBe('url:login.php');
   });
-  it('returns a KQL syntax for a group of significant terms', () => {
-    const groupTableItems = getGroupTableItems(finalSignificantTermGroups);
+  it('returns a KQL syntax for a group of significant items', () => {
+    const groupTableItems = getGroupTableItems(finalSignificantItemGroups);
     expect(getTableItemAsKQL(groupTableItems[0])).toBe('user:Peter AND url:login.php');
     expect(getTableItemAsKQL(groupTableItems[1])).toBe('response_code:500 AND url:home.php');
     expect(getTableItemAsKQL(groupTableItems[2])).toBe('url:login.php AND response_code:500');
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.ts b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.ts
index fb13e3d92173c0..4374da0cec2766 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.ts
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/get_table_item_as_kql.ts
@@ -6,12 +6,12 @@
  */
 
 import { escapeKuery } from '@kbn/es-query';
-import { isSignificantTerm, type SignificantTerm } from '@kbn/ml-agg-utils';
+import { isSignificantItem, type SignificantItem } from '@kbn/ml-agg-utils';
 
 import type { GroupTableItem } from './types';
 
-export const getTableItemAsKQL = (tableItem: GroupTableItem | SignificantTerm) => {
-  if (isSignificantTerm(tableItem)) {
+export const getTableItemAsKQL = (tableItem: GroupTableItem | SignificantItem) => {
+  if (isSignificantItem(tableItem)) {
     return `${escapeKuery(tableItem.fieldName)}:${escapeKuery(String(tableItem.fieldValue))}`;
   }
 
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table.tsx
index 95f4460c7f9185..d8845145f1ace0 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table.tsx
@@ -27,7 +27,7 @@ import type { FieldStatsServices } from '@kbn/unified-field-list/src/components/
 import type { DataView } from '@kbn/data-views-plugin/public';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { type SignificantTerm, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { type SignificantItem, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 import type { TimeRange as TimeRangeMs } from '@kbn/ml-date-picker';
 
 import { getCategoryQuery } from '../../../common/api/log_categorization/get_category_query';
@@ -56,7 +56,7 @@ const DEFAULT_SORT_DIRECTION = 'asc';
 const TRUNCATE_TEXT_LINES = 3;
 
 interface LogRateAnalysisResultsTableProps {
-  significantTerms: SignificantTerm[];
+  significantItems: SignificantItem[];
   dataView: DataView;
   loading: boolean;
   isExpandedRow?: boolean;
@@ -69,7 +69,7 @@ interface LogRateAnalysisResultsTableProps {
 }
 
 export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> = ({
-  significantTerms,
+  significantItems,
   dataView,
   loading,
   isExpandedRow,
@@ -84,16 +84,16 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
 
   const {
     pinnedGroup,
-    pinnedSignificantTerm,
+    pinnedSignificantItem,
     selectedGroup,
-    selectedSignificantTerm,
-    setPinnedSignificantTerm,
-    setSelectedSignificantTerm,
+    selectedSignificantItem,
+    setPinnedSignificantItem,
+    setSelectedSignificantItem,
   } = useLogRateAnalysisResultsTableRowContext();
 
   const [pageIndex, setPageIndex] = useState(0);
   const [pageSize, setPageSize] = useState(10);
-  const [sortField, setSortField] = useState<keyof SignificantTerm>(DEFAULT_SORT_FIELD);
+  const [sortField, setSortField] = useState<keyof SignificantItem>(DEFAULT_SORT_FIELD);
   const [sortDirection, setSortDirection] = useState<'asc' | 'desc'>(DEFAULT_SORT_DIRECTION);
 
   const { data, uiSettings, fieldFormats, charts } = useAiopsAppContext();
@@ -112,7 +112,7 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
   const viewInDiscoverAction = useViewInDiscoverAction(dataViewId);
   const viewInLogPatternAnalysisAction = useViewInLogPatternAnalysisAction(dataViewId);
 
-  const columns: Array<EuiBasicTableColumn<SignificantTerm>> = [
+  const columns: Array<EuiBasicTableColumn<SignificantItem>> = [
     {
       'data-test-subj': 'aiopsLogRateAnalysisResultsTableColumnFieldName',
       field: 'fieldName',
@@ -121,7 +121,7 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
       }),
       render: (_, { fieldName, fieldValue, key, type, doc_count: count }) => {
         const dslQuery =
-          type === SIGNIFICANT_TERM_TYPE.KEYWORD
+          type === SIGNIFICANT_ITEM_TYPE.KEYWORD
             ? searchQuery
             : getCategoryQuery(fieldName, [
                 {
@@ -132,17 +132,17 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
               ]);
         return (
           <>
-            {type === SIGNIFICANT_TERM_TYPE.KEYWORD && (
+            {type === SIGNIFICANT_ITEM_TYPE.KEYWORD && (
               <FieldStatsPopover
                 dataView={dataView}
                 fieldName={fieldName}
-                fieldValue={type === SIGNIFICANT_TERM_TYPE.KEYWORD ? fieldValue : key}
+                fieldValue={type === SIGNIFICANT_ITEM_TYPE.KEYWORD ? fieldValue : key}
                 fieldStatsServices={fieldStatsServices}
                 dslQuery={dslQuery}
                 timeRangeMs={timeRangeMs}
               />
             )}
-            {type === SIGNIFICANT_TERM_TYPE.LOG_PATTERN && (
+            {type === SIGNIFICANT_ITEM_TYPE.LOG_PATTERN && (
               <EuiToolTip
                 content={i18n.translate(
                   'xpack.aiops.fieldContextPopover.descriptionTooltipLogPattern',
@@ -351,12 +351,12 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
 
   const { pagination, pageOfItems, sorting } = useMemo(() => {
     const pageStart = pageIndex * pageSize;
-    const itemCount = significantTerms?.length ?? 0;
+    const itemCount = significantItems?.length ?? 0;
 
-    let items: SignificantTerm[] = significantTerms ?? [];
+    let items: SignificantItem[] = significantItems ?? [];
 
     const sortIteratees = [
-      (item: SignificantTerm) => {
+      (item: SignificantItem) => {
         if (item && typeof item[sortField] === 'string') {
           // @ts-ignore Object is possibly null or undefined
           return item[sortField].toLowerCase();
@@ -368,11 +368,11 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
 
     // Only if the table is sorted by p-value, add a secondary sort by doc count.
     if (sortField === 'pValue') {
-      sortIteratees.push((item: SignificantTerm) => item.doc_count);
+      sortIteratees.push((item: SignificantItem) => item.doc_count);
       sortDirections.push(sortDirection);
     }
 
-    items = orderBy(significantTerms, sortIteratees, sortDirections);
+    items = orderBy(significantItems, sortIteratees, sortDirections);
 
     return {
       pageOfItems: items.slice(pageStart, pageStart + pageSize),
@@ -389,59 +389,59 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
         },
       },
     };
-  }, [pageIndex, pageSize, sortField, sortDirection, significantTerms]);
+  }, [pageIndex, pageSize, sortField, sortDirection, significantItems]);
 
   useEffect(() => {
     // If no row is hovered or pinned or the user switched to a new page,
     // fall back to set the first row into a hovered state to make the
     // main document count chart show a comparison view by default.
     if (
-      (selectedSignificantTerm === null ||
-        !pageOfItems.some((item) => isEqual(item, selectedSignificantTerm))) &&
-      pinnedSignificantTerm === null &&
+      (selectedSignificantItem === null ||
+        !pageOfItems.some((item) => isEqual(item, selectedSignificantItem))) &&
+      pinnedSignificantItem === null &&
       pageOfItems.length > 0 &&
       selectedGroup === null &&
       pinnedGroup === null
     ) {
-      setSelectedSignificantTerm(pageOfItems[0]);
+      setSelectedSignificantItem(pageOfItems[0]);
     }
 
     // If a user switched pages and a pinned row is no longer visible
     // on the current page, set the status of pinned rows back to `null`.
     if (
-      pinnedSignificantTerm !== null &&
-      !pageOfItems.some((item) => isEqual(item, pinnedSignificantTerm)) &&
+      pinnedSignificantItem !== null &&
+      !pageOfItems.some((item) => isEqual(item, pinnedSignificantItem)) &&
       selectedGroup === null &&
       pinnedGroup === null
     ) {
-      setPinnedSignificantTerm(null);
+      setPinnedSignificantItem(null);
     }
   }, [
     selectedGroup,
-    selectedSignificantTerm,
-    setSelectedSignificantTerm,
-    setPinnedSignificantTerm,
+    selectedSignificantItem,
+    setSelectedSignificantItem,
+    setPinnedSignificantItem,
     pageOfItems,
     pinnedGroup,
-    pinnedSignificantTerm,
+    pinnedSignificantItem,
   ]);
 
   // When the analysis results table unmounts,
   // make sure to reset any hovered or pinned rows.
   useEffect(
     () => () => {
-      setSelectedSignificantTerm(null);
-      setPinnedSignificantTerm(null);
+      setSelectedSignificantItem(null);
+      setPinnedSignificantItem(null);
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
     []
   );
 
-  const getRowStyle = (significantTerm: SignificantTerm) => {
+  const getRowStyle = (significantItem: SignificantItem) => {
     if (
-      pinnedSignificantTerm &&
-      pinnedSignificantTerm.fieldName === significantTerm.fieldName &&
-      pinnedSignificantTerm.fieldValue === significantTerm.fieldValue
+      pinnedSignificantItem &&
+      pinnedSignificantItem.fieldName === significantItem.fieldName &&
+      pinnedSignificantItem.fieldValue === significantItem.fieldValue
     ) {
       return {
         backgroundColor: primaryBackgroundColor,
@@ -449,9 +449,9 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
     }
 
     if (
-      selectedSignificantTerm &&
-      selectedSignificantTerm.fieldName === significantTerm.fieldName &&
-      selectedSignificantTerm.fieldValue === significantTerm.fieldValue
+      selectedSignificantItem &&
+      selectedSignificantItem.fieldName === significantItem.fieldName &&
+      selectedSignificantItem.fieldValue === significantItem.fieldValue
     ) {
       return {
         backgroundColor: euiTheme.euiColorLightestShade,
@@ -479,29 +479,29 @@ export const LogRateAnalysisResultsTable: FC<LogRateAnalysisResultsTableProps> =
       onChange={onChange}
       pagination={pagination.totalItemCount > pagination.pageSize ? pagination : undefined}
       loading={false}
-      sorting={sorting as EuiTableSortingType<SignificantTerm>}
-      rowProps={(significantTerm) => {
+      sorting={sorting as EuiTableSortingType<SignificantItem>}
+      rowProps={(significantItem) => {
         return {
-          'data-test-subj': `aiopsLogRateAnalysisResultsTableRow row-${significantTerm.fieldName}-${significantTerm.fieldValue}`,
+          'data-test-subj': `aiopsLogRateAnalysisResultsTableRow row-${significantItem.fieldName}-${significantItem.fieldValue}`,
           onClick: () => {
             if (
-              significantTerm.fieldName === pinnedSignificantTerm?.fieldName &&
-              significantTerm.fieldValue === pinnedSignificantTerm?.fieldValue
+              significantItem.fieldName === pinnedSignificantItem?.fieldName &&
+              significantItem.fieldValue === pinnedSignificantItem?.fieldValue
             ) {
-              setPinnedSignificantTerm(null);
+              setPinnedSignificantItem(null);
             } else {
-              setPinnedSignificantTerm(significantTerm);
+              setPinnedSignificantItem(significantItem);
             }
           },
           onMouseEnter: () => {
-            if (pinnedSignificantTerm === null) {
-              setSelectedSignificantTerm(significantTerm);
+            if (pinnedSignificantItem === null) {
+              setSelectedSignificantItem(significantItem);
             }
           },
           onMouseLeave: () => {
-            setSelectedSignificantTerm(null);
+            setSelectedSignificantItem(null);
           },
-          style: getRowStyle(significantTerm),
+          style: getRowStyle(significantItem),
         };
       }}
     />
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_groups.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_groups.tsx
index 9f45c79b0746d7..f6961e49c2c789 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_groups.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_groups.tsx
@@ -28,7 +28,7 @@ import {
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 import type { TimeRange as TimeRangeMs } from '@kbn/ml-date-picker';
 import type { DataView } from '@kbn/data-views-plugin/public';
 
@@ -53,7 +53,7 @@ const DEFAULT_SORT_FIELD = 'pValue';
 const DEFAULT_SORT_DIRECTION = 'asc';
 
 interface LogRateAnalysisResultsTableProps {
-  significantTerms: SignificantTerm[];
+  significantItems: SignificantItem[];
   groupTableItems: GroupTableItem[];
   loading: boolean;
   searchQuery: estypes.QueryDslQueryContainer;
@@ -66,7 +66,7 @@ interface LogRateAnalysisResultsTableProps {
 }
 
 export const LogRateAnalysisResultsGroupsTable: FC<LogRateAnalysisResultsTableProps> = ({
-  significantTerms,
+  significantItems,
   groupTableItems,
   loading,
   dataView,
@@ -98,9 +98,9 @@ export const LogRateAnalysisResultsGroupsTable: FC<LogRateAnalysisResultsTablePr
     } else {
       itemIdToExpandedRowMapValues[item.id] = (
         <LogRateAnalysisResultsTable
-          significantTerms={item.groupItemsSortedByUniqueness.reduce<SignificantTerm[]>(
+          significantItems={item.groupItemsSortedByUniqueness.reduce<SignificantItem[]>(
             (p, groupItem) => {
-              const st = significantTerms.find(
+              const st = significantItems.find(
                 (d) => d.fieldName === groupItem.fieldName && d.fieldValue === groupItem.fieldValue
               );
 
@@ -139,7 +139,11 @@ export const LogRateAnalysisResultsGroupsTable: FC<LogRateAnalysisResultsTablePr
       isExpander: true,
       name: (
         <EuiScreenReaderOnly>
-          <span>Expand rows</span>
+          <span>
+            {i18n.translate('xpack.aiops.logRateAnalysis.resultsTable.expandRowsLabel', {
+              defaultMessage: 'Expand rows',
+            })}
+          </span>
         </EuiScreenReaderOnly>
       ),
       render: (item: GroupTableItem) => (
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_row_provider.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_row_provider.tsx
index f4d6c77c9756f9..a7b3398e4e7ccf 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_row_provider.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/log_rate_analysis_results_table_row_provider.tsx
@@ -15,23 +15,23 @@ import React, {
   type SetStateAction,
 } from 'react';
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import type { GroupTableItem } from './types';
 
-type SignificantTermOrNull = SignificantTerm | null;
+type SignificantItemOrNull = SignificantItem | null;
 type GroupOrNull = GroupTableItem | null;
 
 interface LogRateAnalysisResultsTableRow {
-  pinnedSignificantTerm: SignificantTermOrNull;
-  setPinnedSignificantTerm: Dispatch<SetStateAction<SignificantTermOrNull>>;
+  pinnedSignificantItem: SignificantItemOrNull;
+  setPinnedSignificantItem: Dispatch<SetStateAction<SignificantItemOrNull>>;
   pinnedGroup: GroupOrNull;
   setPinnedGroup: Dispatch<SetStateAction<GroupOrNull>>;
-  selectedSignificantTerm: SignificantTermOrNull;
-  setSelectedSignificantTerm: Dispatch<SetStateAction<SignificantTermOrNull>>;
+  selectedSignificantItem: SignificantItemOrNull;
+  setSelectedSignificantItem: Dispatch<SetStateAction<SignificantItemOrNull>>;
   selectedGroup: GroupOrNull;
   setSelectedGroup: Dispatch<SetStateAction<GroupOrNull>>;
-  currentSelectedSignificantTerm?: SignificantTerm;
+  currentSelectedSignificantItem?: SignificantItem;
   currentSelectedGroup?: GroupTableItem;
   clearAllRowState: () => void;
 }
@@ -42,20 +42,20 @@ export const logRateAnalysisResultsTableRowContext = createContext<
 
 export const LogRateAnalysisResultsTableRowStateProvider: FC = ({ children }) => {
   // State that will be shared with all components
-  const [pinnedSignificantTerm, setPinnedSignificantTerm] = useState<SignificantTermOrNull>(null);
+  const [pinnedSignificantItem, setPinnedSignificantItem] = useState<SignificantItemOrNull>(null);
   const [pinnedGroup, setPinnedGroup] = useState<GroupOrNull>(null);
-  const [selectedSignificantTerm, setSelectedSignificantTerm] =
-    useState<SignificantTermOrNull>(null);
+  const [selectedSignificantItem, setSelectedSignificantItem] =
+    useState<SignificantItemOrNull>(null);
   const [selectedGroup, setSelectedGroup] = useState<GroupOrNull>(null);
 
   // If a row is pinned, still overrule with a potentially hovered row.
-  const currentSelectedSignificantTerm = useMemo(() => {
-    if (selectedSignificantTerm) {
-      return selectedSignificantTerm;
-    } else if (pinnedSignificantTerm) {
-      return pinnedSignificantTerm;
+  const currentSelectedSignificantItem = useMemo(() => {
+    if (selectedSignificantItem) {
+      return selectedSignificantItem;
+    } else if (pinnedSignificantItem) {
+      return pinnedSignificantItem;
     }
-  }, [pinnedSignificantTerm, selectedSignificantTerm]);
+  }, [pinnedSignificantItem, selectedSignificantItem]);
 
   // If a group is pinned, still overrule with a potentially hovered group.
   const currentSelectedGroup = useMemo(() => {
@@ -68,33 +68,33 @@ export const LogRateAnalysisResultsTableRowStateProvider: FC = ({ children }) =>
 
   const contextValue: LogRateAnalysisResultsTableRow = useMemo(
     () => ({
-      pinnedSignificantTerm,
-      setPinnedSignificantTerm,
+      pinnedSignificantItem,
+      setPinnedSignificantItem,
       pinnedGroup,
       setPinnedGroup,
-      selectedSignificantTerm,
-      setSelectedSignificantTerm,
+      selectedSignificantItem,
+      setSelectedSignificantItem,
       selectedGroup,
       setSelectedGroup,
-      currentSelectedSignificantTerm,
+      currentSelectedSignificantItem,
       currentSelectedGroup,
       clearAllRowState: () => {
-        setPinnedSignificantTerm(null);
+        setPinnedSignificantItem(null);
         setPinnedGroup(null);
-        setSelectedSignificantTerm(null);
+        setSelectedSignificantItem(null);
         setSelectedGroup(null);
       },
     }),
     [
-      pinnedSignificantTerm,
-      setPinnedSignificantTerm,
+      pinnedSignificantItem,
+      setPinnedSignificantItem,
       pinnedGroup,
       setPinnedGroup,
-      selectedSignificantTerm,
-      setSelectedSignificantTerm,
+      selectedSignificantItem,
+      setSelectedSignificantItem,
       selectedGroup,
       setSelectedGroup,
-      currentSelectedSignificantTerm,
+      currentSelectedSignificantItem,
       currentSelectedGroup,
     ]
   );
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/types.ts b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/types.ts
index 66a8a7fe5ab00d..400e4534b54f13 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/types.ts
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/types.ts
@@ -7,10 +7,10 @@
 
 import type { EuiTableActionsColumnType } from '@elastic/eui';
 
-import type { SignificantTerm, SignificantTermGroupItem } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroupItem } from '@kbn/ml-agg-utils';
 
 export type GroupTableItemGroup = Pick<
-  SignificantTermGroupItem,
+  SignificantItemGroupItem,
   'key' | 'type' | 'fieldName' | 'fieldValue' | 'docCount' | 'pValue' | 'duplicate'
 >;
 
@@ -20,9 +20,9 @@ export interface GroupTableItem {
   pValue: number | null;
   uniqueItemsCount: number;
   groupItemsSortedByUniqueness: GroupTableItemGroup[];
-  histogram: SignificantTerm['histogram'];
+  histogram: SignificantItem['histogram'];
 }
 
 export type TableItemAction = EuiTableActionsColumnType<
-  SignificantTerm | GroupTableItem
+  SignificantItem | GroupTableItem
 >['actions'][number];
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.test.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.test.tsx
index 0984c76a4b1708..52ffafd29bcc5d 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.test.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.test.tsx
@@ -10,9 +10,9 @@ import userEvent from '@testing-library/user-event';
 import { render, act } from '@testing-library/react';
 import { renderHook } from '@testing-library/react-hooks';
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
-import { finalSignificantTermGroups } from '../../../common/__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../../../common/__mocks__/artificial_logs/final_significant_item_groups';
 import { significantTerms } from '../../../common/__mocks__/artificial_logs/significant_terms';
 
 import { getGroupTableItems } from './get_group_table_items';
@@ -20,14 +20,14 @@ import { useCopyToClipboardAction } from './use_copy_to_clipboard_action';
 import type { GroupTableItem } from './types';
 
 interface Action {
-  render: (tableItem: SignificantTerm | GroupTableItem) => ReactElement;
+  render: (tableItem: SignificantItem | GroupTableItem) => ReactElement;
 }
 
 const execCommandMock = (global.document.execCommand = jest.fn());
 const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
 
 describe('useCopyToClipboardAction', () => {
-  it('renders the action for a single significant term', async () => {
+  it('renders the action for a single significant item', async () => {
     execCommandMock.mockImplementationOnce(() => true);
     const { result } = renderHook(() => useCopyToClipboardAction());
     const { findByText, getByTestId } = render(
@@ -57,7 +57,7 @@ describe('useCopyToClipboardAction', () => {
 
   it('renders the action for a group of items', async () => {
     execCommandMock.mockImplementationOnce(() => true);
-    const groupTableItems = getGroupTableItems(finalSignificantTermGroups);
+    const groupTableItems = getGroupTableItems(finalSignificantItemGroups);
     const { result } = renderHook(useCopyToClipboardAction);
     const { findByText, getByText } = render((result.current as Action).render(groupTableItems[0]));
 
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.tsx
index 87b5239843940b..b7dc328f1a4684 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_copy_to_clipboard_action.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { EuiCopy, EuiToolTip } from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
-import { isSignificantTerm, type SignificantTerm } from '@kbn/ml-agg-utils';
+import { isSignificantItem, type SignificantItem } from '@kbn/ml-agg-utils';
 
 import { TableActionButton } from './table_action_button';
 import { getTableItemAsKQL } from './get_table_item_as_kql';
@@ -23,8 +23,8 @@ const copyToClipboardButtonLabel = i18n.translate(
   }
 );
 
-const copyToClipboardSignificantTermMessage = i18n.translate(
-  'xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantTermMessage',
+const copyToClipboardSignificantItemMessage = i18n.translate(
+  'xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantItemMessage',
   {
     defaultMessage: 'Copy field/value pair as KQL syntax to clipboard',
   }
@@ -38,9 +38,9 @@ const copyToClipboardGroupMessage = i18n.translate(
 );
 
 export const useCopyToClipboardAction = (): TableItemAction => ({
-  render: (tableItem: SignificantTerm | GroupTableItem) => {
-    const message = isSignificantTerm(tableItem)
-      ? copyToClipboardSignificantTermMessage
+  render: (tableItem: SignificantItem | GroupTableItem) => {
+    const message = isSignificantItem(tableItem)
+      ? copyToClipboardSignificantItemMessage
       : copyToClipboardGroupMessage;
     return (
       <EuiToolTip content={message}>
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_discover_action.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_discover_action.tsx
index 1547daba0017ec..7f467ded4c24b7 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_discover_action.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_discover_action.tsx
@@ -8,7 +8,7 @@
 import React, { useMemo } from 'react';
 
 import { i18n } from '@kbn/i18n';
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import { SEARCH_QUERY_LANGUAGE } from '@kbn/ml-query-utils';
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
@@ -65,7 +65,7 @@ export const useViewInDiscoverAction = (dataViewId?: string): TableItemAction =>
     }
   }, [application.capabilities.discover?.show, dataViewId, discoverLocator]);
 
-  const generateDiscoverUrl = async (groupTableItem: GroupTableItem | SignificantTerm) => {
+  const generateDiscoverUrl = async (groupTableItem: GroupTableItem | SignificantItem) => {
     if (discoverLocator !== undefined) {
       const url = await discoverLocator.getRedirectUrl({
         indexPatternId: dataViewId,
@@ -82,7 +82,7 @@ export const useViewInDiscoverAction = (dataViewId?: string): TableItemAction =>
   };
 
   return {
-    render: (tableItem: SignificantTerm | GroupTableItem) => {
+    render: (tableItem: SignificantItem | GroupTableItem) => {
       const tooltipText = discoverUrlError ? discoverUrlError : viewInDiscoverMessage;
 
       const clickHandler = async () => {
diff --git a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_log_pattern_analysis_action.tsx b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_log_pattern_analysis_action.tsx
index ba25db2b76aac1..86f468e2073891 100644
--- a/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_log_pattern_analysis_action.tsx
+++ b/x-pack/plugins/aiops/public/components/log_rate_analysis_results_table/use_view_in_log_pattern_analysis_action.tsx
@@ -10,7 +10,7 @@ import React, { useMemo } from 'react';
 import { SerializableRecord } from '@kbn/utility-types';
 import { fromKueryExpression, toElasticsearchQuery } from '@kbn/es-query';
 import { i18n } from '@kbn/i18n';
-import { isSignificantTerm, type SignificantTerm, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { isSignificantItem, type SignificantItem, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 
 import { SEARCH_QUERY_LANGUAGE } from '@kbn/ml-query-utils';
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
@@ -19,8 +19,8 @@ import { TableActionButton } from './table_action_button';
 import { getTableItemAsKQL } from './get_table_item_as_kql';
 import type { GroupTableItem, TableItemAction } from './types';
 
-const isLogPattern = (tableItem: SignificantTerm | GroupTableItem) =>
-  isSignificantTerm(tableItem) && tableItem.type === SIGNIFICANT_TERM_TYPE.LOG_PATTERN;
+const isLogPattern = (tableItem: SignificantItem | GroupTableItem) =>
+  isSignificantItem(tableItem) && tableItem.type === SIGNIFICANT_ITEM_TYPE.LOG_PATTERN;
 
 const viewInLogPatternAnalysisMessage = i18n.translate(
   'xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInLogPatternAnalysis',
@@ -35,7 +35,7 @@ export const useViewInLogPatternAnalysisAction = (dataViewId?: string): TableIte
   const mlLocator = useMemo(() => share.url.locators.get('ML_APP_LOCATOR'), [share.url.locators]);
 
   const generateLogPatternAnalysisUrl = async (
-    groupTableItem: GroupTableItem | SignificantTerm
+    groupTableItem: GroupTableItem | SignificantItem
   ) => {
     if (mlLocator !== undefined) {
       const searchString = getTableItemAsKQL(groupTableItem);
@@ -85,7 +85,7 @@ export const useViewInLogPatternAnalysisAction = (dataViewId?: string): TableIte
   }, [dataViewId, mlLocator]);
 
   return {
-    render: (tableItem: SignificantTerm | GroupTableItem) => {
+    render: (tableItem: SignificantItem | GroupTableItem) => {
       const message = logPatternAnalysisUrlError
         ? logPatternAnalysisUrlError
         : viewInLogPatternAnalysisMessage;
diff --git a/x-pack/plugins/aiops/public/components/mini_histogram/mini_histogram.tsx b/x-pack/plugins/aiops/public/components/mini_histogram/mini_histogram.tsx
index 5b6a28cc59463d..6f1564cb6f86ce 100644
--- a/x-pack/plugins/aiops/public/components/mini_histogram/mini_histogram.tsx
+++ b/x-pack/plugins/aiops/public/components/mini_histogram/mini_histogram.tsx
@@ -20,14 +20,14 @@ import {
 import { EuiLoadingChart, EuiTextColor } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n-react';
-import type { SignificantTermHistogramItem } from '@kbn/ml-agg-utils';
+import type { SignificantItemHistogramItem } from '@kbn/ml-agg-utils';
 
 import { i18n } from '@kbn/i18n';
 import { useAiopsAppContext } from '../../hooks/use_aiops_app_context';
 import { useEuiTheme } from '../../hooks/use_eui_theme';
 
 interface MiniHistogramProps {
-  chartData?: SignificantTermHistogramItem[];
+  chartData?: SignificantItemHistogramItem[];
   isLoading: boolean;
   label: string;
   /** Optional color override for the default bar color for charts */
diff --git a/x-pack/plugins/aiops/public/get_document_stats.ts b/x-pack/plugins/aiops/public/get_document_stats.ts
index 9c5a53c8870e78..d4933d103eb7e0 100644
--- a/x-pack/plugins/aiops/public/get_document_stats.ts
+++ b/x-pack/plugins/aiops/public/get_document_stats.ts
@@ -10,7 +10,7 @@ import { each, get } from 'lodash';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 import type { Query } from '@kbn/es-query';
 import type { RandomSamplerWrapper } from '@kbn/ml-random-sampler-utils';
 
@@ -34,8 +34,8 @@ export interface DocumentStatsSearchStrategyParams {
   timeFieldName?: string;
   runtimeFieldMap?: estypes.MappingRuntimeFields;
   fieldsToFetch?: string[];
-  selectedSignificantTerm?: SignificantTerm;
-  includeSelectedSignificantTerm?: boolean;
+  selectedSignificantItem?: SignificantItem;
+  includeSelectedSignificantItem?: boolean;
   selectedGroup?: GroupTableItem | null;
   trackTotalHits?: boolean;
 }
@@ -54,8 +54,8 @@ export const getDocumentCountStatsRequest = (
     searchQuery,
     intervalMs,
     fieldsToFetch,
-    selectedSignificantTerm,
-    includeSelectedSignificantTerm,
+    selectedSignificantItem,
+    includeSelectedSignificantItem,
     selectedGroup,
     trackTotalHits,
   } = params;
@@ -66,8 +66,8 @@ export const getDocumentCountStatsRequest = (
     earliestMs,
     latestMs,
     searchQuery,
-    selectedSignificantTerm,
-    includeSelectedSignificantTerm,
+    selectedSignificantItem,
+    includeSelectedSignificantItem,
     selectedGroup
   );
 
diff --git a/x-pack/plugins/aiops/public/hooks/use_data.ts b/x-pack/plugins/aiops/public/hooks/use_data.ts
index d44eb1661db348..934a470588960b 100644
--- a/x-pack/plugins/aiops/public/hooks/use_data.ts
+++ b/x-pack/plugins/aiops/public/hooks/use_data.ts
@@ -11,7 +11,7 @@ import type { Moment } from 'moment';
 
 import { useExecutionContext } from '@kbn/kibana-react-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/public';
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import type { Dictionary } from '@kbn/ml-url-state';
 import { mlTimefilterRefresh$, useTimefilter } from '@kbn/ml-date-picker';
@@ -34,7 +34,7 @@ export const useData = (
   contextId: string,
   searchQuery: estypes.QueryDslQueryContainer,
   onUpdate?: (params: Dictionary<unknown>) => void,
-  selectedSignificantTerm?: SignificantTerm,
+  selectedSignificantItem?: SignificantItem,
   selectedGroup: GroupTableItem | null = null,
   barTarget: number = DEFAULT_BAR_TARGET,
   timeRange?: { min: Moment; max: Moment }
@@ -78,27 +78,27 @@ export const useData = (
     return fieldStatsRequest
       ? {
           ...fieldStatsRequest,
-          selectedSignificantTerm,
+          selectedSignificantItem,
           selectedGroup,
-          includeSelectedSignificantTerm: false,
+          includeSelectedSignificantItem: false,
         }
       : undefined;
-  }, [fieldStatsRequest, selectedSignificantTerm, selectedGroup]);
+  }, [fieldStatsRequest, selectedSignificantItem, selectedGroup]);
 
-  const selectedSignificantTermStatsRequest = useMemo(() => {
-    return fieldStatsRequest && (selectedSignificantTerm || selectedGroup)
+  const selectedSignificantItemStatsRequest = useMemo(() => {
+    return fieldStatsRequest && (selectedSignificantItem || selectedGroup)
       ? {
           ...fieldStatsRequest,
-          selectedSignificantTerm,
+          selectedSignificantItem,
           selectedGroup,
-          includeSelectedSignificantTerm: true,
+          includeSelectedSignificantItem: true,
         }
       : undefined;
-  }, [fieldStatsRequest, selectedSignificantTerm, selectedGroup]);
+  }, [fieldStatsRequest, selectedSignificantItem, selectedGroup]);
 
   const documentStats = useDocumentCountStats(
     overallStatsRequest,
-    selectedSignificantTermStatsRequest,
+    selectedSignificantItemStatsRequest,
     lastRefresh
   );
 
diff --git a/x-pack/plugins/aiops/public/hooks/use_document_count_stats.ts b/x-pack/plugins/aiops/public/hooks/use_document_count_stats.ts
index 8cfaa074286d63..c154640acd4e84 100644
--- a/x-pack/plugins/aiops/public/hooks/use_document_count_stats.ts
+++ b/x-pack/plugins/aiops/public/hooks/use_document_count_stats.ts
@@ -94,7 +94,7 @@ export function useDocumentCountStats<TParams extends DocumentStatsSearchStrateg
 
       const totalHitsParams = {
         ...searchParams,
-        selectedSignificantTerm: undefined,
+        selectedSignificantItem: undefined,
         trackTotalHits: true,
       };
 
diff --git a/x-pack/plugins/aiops/server/index.ts b/x-pack/plugins/aiops/server/index.ts
index 8dca6eb397d5ee..e6b1dace670293 100755
--- a/x-pack/plugins/aiops/server/index.ts
+++ b/x-pack/plugins/aiops/server/index.ts
@@ -6,9 +6,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { AiopsPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { AiopsPlugin } = await import('./plugin');
   return new AiopsPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/grouping_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/grouping_handler.ts
new file mode 100644
index 00000000000000..e725d25bbe01f6
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/grouping_handler.ts
@@ -0,0 +1,247 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { queue } from 'async';
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
+import { i18n } from '@kbn/i18n';
+import {
+  fetchHistogramsForFields,
+  type SignificantItem,
+  type SignificantItemGroup,
+  type SignificantItemHistogramItem,
+  type NumericChartData,
+} from '@kbn/ml-agg-utils';
+
+import { RANDOM_SAMPLER_SEED } from '../../../../common/constants';
+import {
+  addSignificantItemsGroupAction,
+  addSignificantItemsGroupHistogramAction,
+  updateLoadingStateAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+import { isRequestAbortedError } from '../../../lib/is_request_aborted_error';
+
+import { fetchFrequentItemSets } from '../queries/fetch_frequent_item_sets';
+import { fetchTerms2CategoriesCounts } from '../queries/fetch_terms_2_categories_counts';
+import { getGroupFilter } from '../queries/get_group_filter';
+import { getHistogramQuery } from '../queries/get_histogram_query';
+import { getSignificantItemGroups } from '../queries/get_significant_item_groups';
+
+import { MAX_CONCURRENT_QUERIES, PROGRESS_STEP_GROUPING } from '../response_stream_utils/constants';
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+
+export const groupingHandlerFactory =
+  <T extends ApiVersion>({
+    abortSignal,
+    client,
+    requestBody,
+    responseStream,
+    logDebugMessage,
+    logger,
+    stateHandler,
+    version,
+  }: ResponseStreamFetchOptions<T>) =>
+  async (
+    significantCategories: SignificantItem[],
+    significantTerms: SignificantItem[],
+    overallTimeSeries?: NumericChartData
+  ) => {
+    logDebugMessage('Group results.');
+
+    function pushHistogramDataLoadingState() {
+      responseStream.push(
+        updateLoadingStateAction({
+          ccsWarning: false,
+          loaded: stateHandler.loaded(),
+          loadingState: i18n.translate(
+            'xpack.aiops.logRateAnalysis.loadingState.loadingHistogramData',
+            {
+              defaultMessage: 'Loading histogram data.',
+            }
+          ),
+        })
+      );
+    }
+
+    responseStream.push(
+      updateLoadingStateAction({
+        ccsWarning: false,
+        loaded: stateHandler.loaded(),
+        loadingState: i18n.translate('xpack.aiops.logRateAnalysis.loadingState.groupingResults', {
+          defaultMessage: 'Transforming significant field/value pairs into groups.',
+        }),
+        groupsMissing: true,
+      })
+    );
+
+    try {
+      const { fields, itemSets } = await fetchFrequentItemSets(
+        client,
+        requestBody.index,
+        JSON.parse(requestBody.searchQuery) as estypes.QueryDslQueryContainer,
+        significantTerms,
+        requestBody.timeFieldName,
+        requestBody.deviationMin,
+        requestBody.deviationMax,
+        logger,
+        stateHandler.sampleProbability(),
+        responseStream.pushError,
+        abortSignal
+      );
+
+      if (significantCategories.length > 0 && significantTerms.length > 0) {
+        const { fields: significantCategoriesFields, itemSets: significantCategoriesItemSets } =
+          await fetchTerms2CategoriesCounts(
+            client,
+            requestBody,
+            JSON.parse(requestBody.searchQuery) as estypes.QueryDslQueryContainer,
+            significantTerms,
+            itemSets,
+            significantCategories,
+            requestBody.deviationMin,
+            requestBody.deviationMax,
+            logger,
+            responseStream.pushError,
+            abortSignal
+          );
+
+        fields.push(...significantCategoriesFields);
+        itemSets.push(...significantCategoriesItemSets);
+      }
+
+      if (stateHandler.shouldStop()) {
+        logDebugMessage('shouldStop after fetching frequent_item_sets.');
+        responseStream.end();
+        return;
+      }
+
+      if (fields.length > 0 && itemSets.length > 0) {
+        const significantItemGroups = getSignificantItemGroups(
+          itemSets,
+          [...significantTerms, ...significantCategories],
+          fields
+        );
+
+        // We'll find out if there's at least one group with at least two items,
+        // only then will we return the groups to the clients and make the grouping option available.
+        const maxItems = Math.max(...significantItemGroups.map((g) => g.group.length));
+
+        if (maxItems > 1) {
+          responseStream.push(addSignificantItemsGroupAction(significantItemGroups, version));
+        }
+
+        stateHandler.loaded(PROGRESS_STEP_GROUPING, false);
+        pushHistogramDataLoadingState();
+
+        if (stateHandler.shouldStop()) {
+          logDebugMessage('shouldStop after grouping.');
+          responseStream.end();
+          return;
+        }
+
+        logDebugMessage(`Fetch ${significantItemGroups.length} group histograms.`);
+
+        const groupHistogramQueue = queue(async function (cpg: SignificantItemGroup) {
+          if (stateHandler.shouldStop()) {
+            logDebugMessage('shouldStop abort fetching group histograms.');
+            groupHistogramQueue.kill();
+            responseStream.end();
+            return;
+          }
+
+          if (overallTimeSeries !== undefined) {
+            const histogramQuery = getHistogramQuery(requestBody, getGroupFilter(cpg));
+
+            let cpgTimeSeries: NumericChartData;
+            try {
+              cpgTimeSeries = (
+                (await fetchHistogramsForFields(
+                  client,
+                  requestBody.index,
+                  histogramQuery,
+                  // fields
+                  [
+                    {
+                      fieldName: requestBody.timeFieldName,
+                      type: KBN_FIELD_TYPES.DATE,
+                      interval: overallTimeSeries.interval,
+                      min: overallTimeSeries.stats[0],
+                      max: overallTimeSeries.stats[1],
+                    },
+                  ],
+                  // samplerShardSize
+                  -1,
+                  undefined,
+                  abortSignal,
+                  stateHandler.sampleProbability(),
+                  RANDOM_SAMPLER_SEED
+                )) as [NumericChartData]
+              )[0];
+            } catch (e) {
+              if (!isRequestAbortedError(e)) {
+                logger.error(
+                  `Failed to fetch the histogram data for group #${cpg.id}, got: \n${e.toString()}`
+                );
+                responseStream.pushError(
+                  `Failed to fetch the histogram data for group #${cpg.id}.`
+                );
+              }
+              return;
+            }
+            const histogram: SignificantItemHistogramItem[] =
+              overallTimeSeries.data.map((o) => {
+                const current = cpgTimeSeries.data.find(
+                  (d1) => d1.key_as_string === o.key_as_string
+                ) ?? {
+                  doc_count: 0,
+                };
+
+                if (version === '1') {
+                  return {
+                    key: o.key,
+                    key_as_string: o.key_as_string ?? '',
+                    doc_count_significant_term: current.doc_count,
+                    doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+                  };
+                }
+
+                return {
+                  key: o.key,
+                  key_as_string: o.key_as_string ?? '',
+                  doc_count_significant_item: current.doc_count,
+                  doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+                };
+              }) ?? [];
+
+            responseStream.push(
+              addSignificantItemsGroupHistogramAction(
+                [
+                  {
+                    id: cpg.id,
+                    histogram,
+                  },
+                ],
+                version
+              )
+            );
+          }
+        }, MAX_CONCURRENT_QUERIES);
+
+        groupHistogramQueue.push(significantItemGroups);
+        await groupHistogramQueue.drain();
+      }
+    } catch (e) {
+      if (!isRequestAbortedError(e)) {
+        logger.error(`Failed to transform field/value pairs into groups, got: \n${e.toString()}`);
+        responseStream.pushError(`Failed to transform field/value pairs into groups.`);
+      }
+    }
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/histogram_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/histogram_handler.ts
new file mode 100644
index 00000000000000..1ddb624c99056f
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/histogram_handler.ts
@@ -0,0 +1,275 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { queue } from 'async';
+
+import { i18n } from '@kbn/i18n';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
+import type {
+  SignificantItem,
+  SignificantItemHistogramItem,
+  NumericChartData,
+} from '@kbn/ml-agg-utils';
+import { fetchHistogramsForFields } from '@kbn/ml-agg-utils';
+
+import { RANDOM_SAMPLER_SEED } from '../../../../common/constants';
+import {
+  addSignificantItemsHistogramAction,
+  updateLoadingStateAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+import { getCategoryQuery } from '../../../../common/api/log_categorization/get_category_query';
+
+import { getHistogramQuery } from '../queries/get_histogram_query';
+
+import {
+  MAX_CONCURRENT_QUERIES,
+  PROGRESS_STEP_HISTOGRAMS,
+} from '../response_stream_utils/constants';
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+
+export const histogramHandlerFactory =
+  <T extends ApiVersion>({
+    abortSignal,
+    client,
+    logDebugMessage,
+    logger,
+    requestBody,
+    responseStream,
+    stateHandler,
+    version,
+  }: ResponseStreamFetchOptions<T>) =>
+  async (
+    fieldValuePairsCount: number,
+    significantCategories: SignificantItem[],
+    significantTerms: SignificantItem[],
+    overallTimeSeries?: NumericChartData
+  ) => {
+    function pushHistogramDataLoadingState() {
+      responseStream.push(
+        updateLoadingStateAction({
+          ccsWarning: false,
+          loaded: stateHandler.loaded(),
+          loadingState: i18n.translate(
+            'xpack.aiops.logRateAnalysis.loadingState.loadingHistogramData',
+            {
+              defaultMessage: 'Loading histogram data.',
+            }
+          ),
+        })
+      );
+    }
+
+    logDebugMessage(`Fetch ${significantTerms.length} field/value histograms.`);
+
+    // time series filtered by fields
+    if (
+      significantTerms.length > 0 &&
+      overallTimeSeries !== undefined &&
+      !requestBody.overrides?.regroupOnly
+    ) {
+      const fieldValueHistogramQueue = queue(async function (cp: SignificantItem) {
+        if (stateHandler.shouldStop()) {
+          logDebugMessage('shouldStop abort fetching field/value histograms.');
+          fieldValueHistogramQueue.kill();
+          responseStream.end();
+          return;
+        }
+
+        if (overallTimeSeries !== undefined) {
+          const histogramQuery = getHistogramQuery(requestBody, [
+            {
+              term: { [cp.fieldName]: cp.fieldValue },
+            },
+          ]);
+
+          let cpTimeSeries: NumericChartData;
+
+          try {
+            cpTimeSeries = (
+              (await fetchHistogramsForFields(
+                client,
+                requestBody.index,
+                histogramQuery,
+                // fields
+                [
+                  {
+                    fieldName: requestBody.timeFieldName,
+                    type: KBN_FIELD_TYPES.DATE,
+                    interval: overallTimeSeries.interval,
+                    min: overallTimeSeries.stats[0],
+                    max: overallTimeSeries.stats[1],
+                  },
+                ],
+                // samplerShardSize
+                -1,
+                undefined,
+                abortSignal,
+                stateHandler.sampleProbability(),
+                RANDOM_SAMPLER_SEED
+              )) as [NumericChartData]
+            )[0];
+          } catch (e) {
+            logger.error(
+              `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${
+                cp.fieldValue
+              }", got: \n${e.toString()}`
+            );
+            responseStream.pushError(
+              `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${cp.fieldValue}".`
+            );
+            return;
+          }
+
+          const histogram: SignificantItemHistogramItem[] =
+            overallTimeSeries.data.map((o) => {
+              const current = cpTimeSeries.data.find(
+                (d1) => d1.key_as_string === o.key_as_string
+              ) ?? {
+                doc_count: 0,
+              };
+              if (version === '1') {
+                return {
+                  key: o.key,
+                  key_as_string: o.key_as_string ?? '',
+                  doc_count_significant_term: current.doc_count,
+                  doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+                };
+              }
+
+              return {
+                key: o.key,
+                key_as_string: o.key_as_string ?? '',
+                doc_count_significant_item: current.doc_count,
+                doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+              };
+            }) ?? [];
+
+          const { fieldName, fieldValue } = cp;
+
+          stateHandler.loaded((1 / fieldValuePairsCount) * PROGRESS_STEP_HISTOGRAMS, false);
+          pushHistogramDataLoadingState();
+          responseStream.push(
+            addSignificantItemsHistogramAction(
+              [
+                {
+                  fieldName,
+                  fieldValue,
+                  histogram,
+                },
+              ],
+              version
+            )
+          );
+        }
+      }, MAX_CONCURRENT_QUERIES);
+
+      fieldValueHistogramQueue.push(significantTerms);
+      await fieldValueHistogramQueue.drain();
+    }
+
+    // histograms for text field patterns
+    if (
+      overallTimeSeries !== undefined &&
+      significantCategories.length > 0 &&
+      !requestBody.overrides?.regroupOnly
+    ) {
+      const significantCategoriesHistogramQueries = significantCategories.map((d) => {
+        const histogramQuery = getHistogramQuery(requestBody);
+        const categoryQuery = getCategoryQuery(d.fieldName, [
+          { key: `${d.key}`, count: d.doc_count, examples: [] },
+        ]);
+        if (Array.isArray(histogramQuery.bool?.filter)) {
+          histogramQuery.bool?.filter?.push(categoryQuery);
+        }
+        return histogramQuery;
+      });
+
+      for (const [i, histogramQuery] of significantCategoriesHistogramQueries.entries()) {
+        const cp = significantCategories[i];
+        let catTimeSeries: NumericChartData;
+
+        try {
+          catTimeSeries = (
+            (await fetchHistogramsForFields(
+              client,
+              requestBody.index,
+              histogramQuery,
+              // fields
+              [
+                {
+                  fieldName: requestBody.timeFieldName,
+                  type: KBN_FIELD_TYPES.DATE,
+                  interval: overallTimeSeries.interval,
+                  min: overallTimeSeries.stats[0],
+                  max: overallTimeSeries.stats[1],
+                },
+              ],
+              // samplerShardSize
+              -1,
+              undefined,
+              abortSignal,
+              stateHandler.sampleProbability(),
+              RANDOM_SAMPLER_SEED
+            )) as [NumericChartData]
+          )[0];
+        } catch (e) {
+          logger.error(
+            `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${
+              cp.fieldValue
+            }", got: \n${e.toString()}`
+          );
+          responseStream.pushError(
+            `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${cp.fieldValue}".`
+          );
+          return;
+        }
+
+        const histogram: SignificantItemHistogramItem[] =
+          overallTimeSeries.data.map((o) => {
+            const current = catTimeSeries.data.find(
+              (d1) => d1.key_as_string === o.key_as_string
+            ) ?? {
+              doc_count: 0,
+            };
+
+            if (version === '1') {
+              return {
+                key: o.key,
+                key_as_string: o.key_as_string ?? '',
+                doc_count_significant_term: current.doc_count,
+                doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+              };
+            }
+
+            return {
+              key: o.key,
+              key_as_string: o.key_as_string ?? '',
+              doc_count_significant_item: current.doc_count,
+              doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
+            };
+          }) ?? [];
+
+        const { fieldName, fieldValue } = cp;
+
+        stateHandler.loaded((1 / fieldValuePairsCount) * PROGRESS_STEP_HISTOGRAMS, false);
+        pushHistogramDataLoadingState();
+        responseStream.push(
+          addSignificantItemsHistogramAction(
+            [
+              {
+                fieldName,
+                fieldValue,
+                histogram,
+              },
+            ],
+            version
+          )
+        );
+      }
+    }
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/index_info_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/index_info_handler.ts
new file mode 100644
index 00000000000000..6ae2a07055aec9
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/index_info_handler.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+import { updateLoadingStateAction } from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+import { isRequestAbortedError } from '../../../lib/is_request_aborted_error';
+
+import { fetchIndexInfo } from '../queries/fetch_index_info';
+
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+import { LOADED_FIELD_CANDIDATES } from '../response_stream_utils/constants';
+
+export const indexInfoHandlerFactory =
+  <T extends ApiVersion>(options: ResponseStreamFetchOptions<T>) =>
+  async () => {
+    const {
+      abortSignal,
+      client,
+      logDebugMessage,
+      logger,
+      requestBody,
+      responseStream,
+      stateHandler,
+    } = options;
+
+    const fieldCandidates: string[] = [];
+    let fieldCandidatesCount = fieldCandidates.length;
+
+    const textFieldCandidates: string[] = [];
+
+    let totalDocCount = 0;
+
+    if (!requestBody.overrides?.remainingFieldCandidates) {
+      logDebugMessage('Fetch index information.');
+      responseStream.push(
+        updateLoadingStateAction({
+          ccsWarning: false,
+          loaded: stateHandler.loaded(),
+          loadingState: i18n.translate(
+            'xpack.aiops.logRateAnalysis.loadingState.loadingIndexInformation',
+            {
+              defaultMessage: 'Loading index information.',
+            }
+          ),
+        })
+      );
+
+      try {
+        const indexInfo = await fetchIndexInfo(
+          client,
+          requestBody,
+          ['message', 'error.message'],
+          abortSignal
+        );
+
+        fieldCandidates.push(...indexInfo.fieldCandidates);
+        fieldCandidatesCount = fieldCandidates.length;
+        textFieldCandidates.push(...indexInfo.textFieldCandidates);
+        totalDocCount = indexInfo.totalDocCount;
+      } catch (e) {
+        if (!isRequestAbortedError(e)) {
+          logger.error(`Failed to fetch index information, got: \n${e.toString()}`);
+          responseStream.pushError(`Failed to fetch index information.`);
+        }
+        responseStream.end();
+        return;
+      }
+
+      logDebugMessage(`Total document count: ${totalDocCount}`);
+
+      stateHandler.loaded(LOADED_FIELD_CANDIDATES, false);
+
+      responseStream.pushPingWithTimeout();
+
+      responseStream.push(
+        updateLoadingStateAction({
+          ccsWarning: false,
+          loaded: stateHandler.loaded(),
+          loadingState: i18n.translate(
+            'xpack.aiops.logRateAnalysis.loadingState.identifiedFieldCandidates',
+            {
+              defaultMessage:
+                'Identified {fieldCandidatesCount, plural, one {# field candidate} other {# field candidates}}.',
+              values: {
+                fieldCandidatesCount,
+              },
+            }
+          ),
+        })
+      );
+
+      if (fieldCandidatesCount === 0) {
+        responseStream.endWithUpdatedLoadingState();
+      } else if (stateHandler.shouldStop()) {
+        logDebugMessage('shouldStop after fetching field candidates.');
+        responseStream.end();
+        return;
+      }
+    }
+
+    return { fieldCandidates, textFieldCandidates };
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overall_histogram_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overall_histogram_handler.ts
new file mode 100644
index 00000000000000..278cb59b40e076
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overall_histogram_handler.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
+import {
+  fetchHistogramsForFields,
+  type NumericChartData,
+  type NumericHistogramField,
+} from '@kbn/ml-agg-utils';
+
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+import { RANDOM_SAMPLER_SEED } from '../../../../common/constants';
+
+import { isRequestAbortedError } from '../../../lib/is_request_aborted_error';
+
+import { getHistogramQuery } from '../queries/get_histogram_query';
+
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+
+export const overallHistogramHandlerFactory =
+  <T extends ApiVersion>({
+    abortSignal,
+    client,
+    requestBody,
+    logDebugMessage,
+    logger,
+    responseStream,
+    stateHandler,
+  }: ResponseStreamFetchOptions<T>) =>
+  async () => {
+    const histogramFields: [NumericHistogramField] = [
+      { fieldName: requestBody.timeFieldName, type: KBN_FIELD_TYPES.DATE },
+    ];
+
+    logDebugMessage('Fetch overall histogram.');
+
+    let overallTimeSeries: NumericChartData | undefined;
+
+    const overallHistogramQuery = getHistogramQuery(requestBody);
+
+    try {
+      overallTimeSeries = (
+        (await fetchHistogramsForFields(
+          client,
+          requestBody.index,
+          overallHistogramQuery,
+          // fields
+          histogramFields,
+          // samplerShardSize
+          -1,
+          undefined,
+          abortSignal,
+          stateHandler.sampleProbability(),
+          RANDOM_SAMPLER_SEED
+        )) as [NumericChartData]
+      )[0];
+    } catch (e) {
+      if (!isRequestAbortedError(e)) {
+        logger.error(`Failed to fetch the overall histogram data, got: \n${e.toString()}`);
+        responseStream.pushError(`Failed to fetch overall histogram data.`);
+      }
+      // Still continue the analysis even if loading the overall histogram fails.
+    }
+
+    if (stateHandler.shouldStop()) {
+      logDebugMessage('shouldStop after fetching overall histogram.');
+      responseStream.end();
+      return;
+    }
+
+    return overallTimeSeries;
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overrides_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overrides_handler.ts
new file mode 100644
index 00000000000000..e4a1d784bc4686
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/overrides_handler.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  resetAllAction,
+  resetErrorsAction,
+  resetGroupsAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+
+export const overridesHandlerFactory =
+  <T extends ApiVersion>({
+    requestBody,
+    logDebugMessage,
+    responseStream,
+    stateHandler,
+  }: ResponseStreamFetchOptions<T>) =>
+  () => {
+    if (!requestBody.overrides) {
+      logDebugMessage('Full Reset.');
+      responseStream.push(resetAllAction());
+    } else {
+      logDebugMessage('Reset Errors.');
+      responseStream.push(resetErrorsAction());
+    }
+
+    if (requestBody.overrides?.regroupOnly) {
+      logDebugMessage('Reset Groups.');
+      responseStream.push(resetGroupsAction());
+    }
+
+    if (requestBody.overrides?.loaded) {
+      logDebugMessage(`Set 'loaded' override to '${requestBody.overrides?.loaded}'.`);
+      stateHandler.loaded(requestBody.overrides?.loaded);
+    }
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/significant_items_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/significant_items_handler.ts
new file mode 100644
index 00000000000000..1fefba00cf0239
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/analysis_handlers/significant_items_handler.ts
@@ -0,0 +1,208 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { queue } from 'async';
+
+import { SIGNIFICANT_ITEM_TYPE, type SignificantItem } from '@kbn/ml-agg-utils';
+import { i18n } from '@kbn/i18n';
+
+import {
+  addSignificantItemsAction,
+  updateLoadingStateAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+
+import { isRequestAbortedError } from '../../../lib/is_request_aborted_error';
+
+import { fetchSignificantCategories } from '../queries/fetch_significant_categories';
+import { fetchSignificantTermPValues } from '../queries/fetch_significant_term_p_values';
+
+import type {
+  AiopsLogRateAnalysisSchema,
+  AiopsLogRateAnalysisApiVersion as ApiVersion,
+} from '../../../../common/api/log_rate_analysis/schema';
+
+import {
+  LOADED_FIELD_CANDIDATES,
+  MAX_CONCURRENT_QUERIES,
+  PROGRESS_STEP_P_VALUES,
+} from '../response_stream_utils/constants';
+import type { ResponseStreamFetchOptions } from '../response_stream_factory';
+
+export const significantItemsHandlerFactory =
+  <T extends ApiVersion>({
+    abortSignal,
+    client,
+    logDebugMessage,
+    logger,
+    requestBody,
+    responseStream,
+    stateHandler,
+    version,
+  }: ResponseStreamFetchOptions<T>) =>
+  async ({
+    fieldCandidates,
+    textFieldCandidates,
+  }: {
+    fieldCandidates: string[];
+    textFieldCandidates: string[];
+  }) => {
+    let fieldCandidatesCount = fieldCandidates.length;
+
+    // This will store the combined count of detected significant log patterns and keywords
+    let fieldValuePairsCount = 0;
+
+    const significantCategories: SignificantItem[] = [];
+
+    if (version === '1') {
+      significantCategories.push(
+        ...((requestBody as AiopsLogRateAnalysisSchema<'1'>).overrides?.significantTerms?.filter(
+          (d) => d.type === SIGNIFICANT_ITEM_TYPE.LOG_PATTERN
+        ) ?? [])
+      );
+    }
+
+    if (version === '2') {
+      significantCategories.push(
+        ...((requestBody as AiopsLogRateAnalysisSchema<'2'>).overrides?.significantItems?.filter(
+          (d) => d.type === SIGNIFICANT_ITEM_TYPE.LOG_PATTERN
+        ) ?? [])
+      );
+    }
+
+    // Get significant categories of text fields
+    if (textFieldCandidates.length > 0) {
+      significantCategories.push(
+        ...(await fetchSignificantCategories(
+          client,
+          requestBody,
+          textFieldCandidates,
+          logger,
+          stateHandler.sampleProbability(),
+          responseStream.pushError,
+          abortSignal
+        ))
+      );
+
+      if (significantCategories.length > 0) {
+        responseStream.push(addSignificantItemsAction(significantCategories, version));
+      }
+    }
+
+    const significantTerms: SignificantItem[] = [];
+
+    if (version === '1') {
+      significantTerms.push(
+        ...((requestBody as AiopsLogRateAnalysisSchema<'1'>).overrides?.significantTerms?.filter(
+          (d) => d.type === SIGNIFICANT_ITEM_TYPE.KEYWORD
+        ) ?? [])
+      );
+    }
+
+    if (version === '2') {
+      significantTerms.push(
+        ...((requestBody as AiopsLogRateAnalysisSchema<'2'>).overrides?.significantItems?.filter(
+          (d) => d.type === SIGNIFICANT_ITEM_TYPE.KEYWORD
+        ) ?? [])
+      );
+    }
+
+    const fieldsToSample = new Set<string>();
+
+    let remainingFieldCandidates: string[];
+    let loadingStepSizePValues = PROGRESS_STEP_P_VALUES;
+
+    if (requestBody.overrides?.remainingFieldCandidates) {
+      fieldCandidates.push(...requestBody.overrides?.remainingFieldCandidates);
+      remainingFieldCandidates = requestBody.overrides?.remainingFieldCandidates;
+      fieldCandidatesCount = fieldCandidates.length;
+      loadingStepSizePValues =
+        LOADED_FIELD_CANDIDATES +
+        PROGRESS_STEP_P_VALUES -
+        (requestBody.overrides?.loaded ?? PROGRESS_STEP_P_VALUES);
+    } else {
+      remainingFieldCandidates = fieldCandidates;
+    }
+
+    logDebugMessage('Fetch p-values.');
+
+    const pValuesQueue = queue(async function (fieldCandidate: string) {
+      stateHandler.loaded((1 / fieldCandidatesCount) * loadingStepSizePValues, false);
+
+      let pValues: Awaited<ReturnType<typeof fetchSignificantTermPValues>>;
+
+      try {
+        pValues = await fetchSignificantTermPValues(
+          client,
+          requestBody,
+          [fieldCandidate],
+          logger,
+          stateHandler.sampleProbability(),
+          responseStream.pushError,
+          abortSignal
+        );
+      } catch (e) {
+        if (!isRequestAbortedError(e)) {
+          logger.error(`Failed to fetch p-values for '${fieldCandidate}', got: \n${e.toString()}`);
+          responseStream.pushError(`Failed to fetch p-values for '${fieldCandidate}'.`);
+        }
+        return;
+      }
+
+      remainingFieldCandidates = remainingFieldCandidates.filter((d) => d !== fieldCandidate);
+
+      if (pValues.length > 0) {
+        pValues.forEach((d) => {
+          fieldsToSample.add(d.fieldName);
+        });
+        significantTerms.push(...pValues);
+
+        responseStream.push(addSignificantItemsAction(pValues, version));
+      }
+
+      responseStream.push(
+        updateLoadingStateAction({
+          ccsWarning: false,
+          loaded: stateHandler.loaded(),
+          loadingState: i18n.translate(
+            'xpack.aiops.logRateAnalysis.loadingState.identifiedFieldValuePairs',
+            {
+              defaultMessage:
+                'Identified {fieldValuePairsCount, plural, one {# significant field/value pair} other {# significant field/value pairs}}.',
+              values: {
+                fieldValuePairsCount,
+              },
+            }
+          ),
+          remainingFieldCandidates,
+        })
+      );
+    }, MAX_CONCURRENT_QUERIES);
+
+    pValuesQueue.push(fieldCandidates, (err) => {
+      if (err) {
+        logger.error(`Failed to fetch p-values.', got: \n${err.toString()}`);
+        responseStream.pushError(`Failed to fetch p-values.`);
+        pValuesQueue.kill();
+        responseStream.end();
+      } else if (stateHandler.shouldStop()) {
+        logDebugMessage('shouldStop fetching p-values.');
+        pValuesQueue.kill();
+        responseStream.end();
+      }
+    });
+    await pValuesQueue.drain();
+
+    fieldValuePairsCount = significantCategories.length + significantTerms.length;
+
+    if (fieldValuePairsCount === 0) {
+      logDebugMessage('Stopping analysis, did not find significant terms.');
+      responseStream.endWithUpdatedLoadingState();
+      return;
+    }
+
+    return { fieldValuePairsCount, significantCategories, significantTerms };
+  };
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/define_route.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/define_route.ts
index 6f9343a50ae620..60122c7ec611f6 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/define_route.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/define_route.ts
@@ -18,6 +18,12 @@ import type { AiopsLicense } from '../../types';
 
 import { routeHandlerFactory } from './route_handler_factory';
 
+/**
+ * `defineRoute` is called in the root `plugin.ts` to set up the API route
+ * for log pattern analysis. Its purpose is to take care of the route setup
+ * and versioning only. `routeHandlerFactory` is used to take care of
+ * the actual route logic.
+ */
 export const defineRoute = (
   router: IRouter<DataRequestHandlerContext>,
   license: AiopsLicense,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/duplicate_identifier.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/duplicate_identifier.ts
index 82513ab2b4e2f6..d399aa324b3b12 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/duplicate_identifier.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/duplicate_identifier.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
-// To optimize the `frequent_item_sets` query, we identify duplicate significant terms by count attributes.
-// Note this is a compromise and not 100% accurate because there could be significant terms that
+// To optimize the `frequent_item_sets` query, we identify duplicate significant items by count attributes.
+// Note this is a compromise and not 100% accurate because there could be significant items that
 // have the exact same counts but still don't co-occur.
-export const duplicateIdentifier: Array<keyof SignificantTerm> = [
+export const duplicateIdentifier: Array<keyof SignificantItem> = [
   'doc_count',
   'bg_count',
   'total_doc_count',
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_frequent_item_sets.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_frequent_item_sets.ts
index c74030efaea7fe..ff02251b64f954 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_frequent_item_sets.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_frequent_item_sets.ts
@@ -12,12 +12,12 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import type { Logger } from '@kbn/logging';
-import { type SignificantTerm } from '@kbn/ml-agg-utils';
+import { type SignificantItem } from '@kbn/ml-agg-utils';
 import { createRandomSamplerWrapper } from '@kbn/ml-random-sampler-utils';
 
 import { RANDOM_SAMPLER_SEED, LOG_RATE_ANALYSIS_SETTINGS } from '../../../../common/constants';
 import type {
-  SignificantTermDuplicateGroup,
+  SignificantItemDuplicateGroup,
   ItemSet,
   FetchFrequentItemSetsResponse,
 } from '../../../../common/types';
@@ -29,10 +29,10 @@ interface FrequentItemSetsAggregation extends estypes.AggregationsSamplerAggrega
 }
 
 export function groupDuplicates(
-  cps: SignificantTerm[],
-  uniqueFields: Array<keyof SignificantTerm>
+  cps: SignificantItem[],
+  uniqueFields: Array<keyof SignificantItem>
 ) {
-  const groups: SignificantTermDuplicateGroup[] = [];
+  const groups: SignificantItemDuplicateGroup[] = [];
 
   for (const cp of cps) {
     const compareAttributes = pick(cp, uniqueFields);
@@ -51,16 +51,16 @@ export function groupDuplicates(
   return groups;
 }
 
-export function getShouldClauses(significantTerms: SignificantTerm[]) {
+export function getShouldClauses(significantItems: SignificantItem[]) {
   return Array.from(
-    group(significantTerms, ({ fieldName }) => fieldName),
+    group(significantItems, ({ fieldName }) => fieldName),
     ([field, values]) => ({ terms: { [field]: values.map((d) => d.fieldValue) } })
   );
 }
 
-export function getFrequentItemSetsAggFields(significantTerms: SignificantTerm[]) {
+export function getFrequentItemSetsAggFields(significantItems: SignificantItem[]) {
   return Array.from(
-    group(significantTerms, ({ fieldName }) => fieldName),
+    group(significantItems, ({ fieldName }) => fieldName),
     ([field, values]) => ({ field, include: values.map((d) => String(d.fieldValue)) })
   );
 }
@@ -69,7 +69,7 @@ export async function fetchFrequentItemSets(
   client: ElasticsearchClient,
   index: string,
   searchQuery: estypes.QueryDslQueryContainer,
-  significantTerms: SignificantTerm[],
+  significantItems: SignificantItem[],
   timeFieldName: string,
   deviationMin: number,
   deviationMax: number,
@@ -80,7 +80,7 @@ export async function fetchFrequentItemSets(
   abortSignal?: AbortSignal
 ): Promise<FetchFrequentItemSetsResponse> {
   // Sort significant terms by ascending p-value, necessary to apply the field limit correctly.
-  const sortedSignificantTerms = significantTerms.slice().sort((a, b) => {
+  const sortedSignificantItems = significantItems.slice().sort((a, b) => {
     return (a.pValue ?? 0) - (b.pValue ?? 0);
   });
 
@@ -98,7 +98,7 @@ export async function fetchFrequentItemSets(
           },
         },
       ],
-      should: getShouldClauses(sortedSignificantTerms),
+      should: getShouldClauses(sortedSignificantItems),
     },
   };
 
@@ -108,7 +108,7 @@ export async function fetchFrequentItemSets(
         minimum_set_size: 2,
         size: 200,
         minimum_support: LOG_RATE_ANALYSIS_SETTINGS.FREQUENT_ITEMS_SETS_MINIMUM_SUPPORT,
-        fields: getFrequentItemSetsAggFields(sortedSignificantTerms),
+        fields: getFrequentItemSetsAggFields(sortedSignificantItems),
       },
     },
   };
@@ -177,7 +177,7 @@ export async function fetchFrequentItemSets(
     Object.entries(fis.key).forEach(([key, value]) => {
       result.set[key] = value[0];
 
-      const pValue = sortedSignificantTerms.find(
+      const pValue = sortedSignificantItems.find(
         (t) => t.fieldName === key && t.fieldValue === value[0]
       )?.pValue;
 
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_categories.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_categories.ts
index 4cf106a3694640..49617a1661ba65 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_categories.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_categories.ts
@@ -10,7 +10,7 @@ import { uniq } from 'lodash';
 import { ElasticsearchClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
 import { criticalTableLookup, type Histogram } from '@kbn/ml-chi2test';
-import { type SignificantTerm, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { type SignificantItem, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 
 import type { Category } from '../../../../common/api/log_categorization/types';
 import type { AiopsLogRateAnalysisSchema } from '../../../../common/api/log_rate_analysis/schema';
@@ -83,7 +83,7 @@ export const fetchSignificantCategories = async (
 
   if (categoriesOverall.length !== fieldNames.length) return [];
 
-  const significantCategories: SignificantTerm[] = [];
+  const significantCategories: SignificantItem[] = [];
 
   // Using for...of to allow `await` within the loop.
   for (const [i, fieldName] of fieldNames.entries()) {
@@ -152,7 +152,7 @@ export const fetchSignificantCategories = async (
           score,
           pValue,
           normalizedScore: getNormalizedScore(score),
-          type: SIGNIFICANT_TERM_TYPE.LOG_PATTERN,
+          type: SIGNIFICANT_ITEM_TYPE.LOG_PATTERN,
         });
       }
     });
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_term_p_values.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_term_p_values.ts
index 10b488940ce2c4..6cdf6983d58273 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_term_p_values.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_significant_term_p_values.ts
@@ -9,7 +9,7 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ElasticsearchClient } from '@kbn/core/server';
 
 import type { Logger } from '@kbn/logging';
-import { type SignificantTerm, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { type SignificantItem, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 import {
   createRandomSamplerWrapper,
   type RandomSamplerWrapper,
@@ -111,13 +111,13 @@ export const fetchSignificantTermPValues = async (
   sampleProbability: number = 1,
   emitError: (m: string) => void,
   abortSignal?: AbortSignal
-): Promise<SignificantTerm[]> => {
+): Promise<SignificantItem[]> => {
   const randomSamplerWrapper = createRandomSamplerWrapper({
     probability: sampleProbability,
     seed: RANDOM_SAMPLER_SEED,
   });
 
-  const result: SignificantTerm[] = [];
+  const result: SignificantItem[] = [];
 
   const settledPromises = await Promise.allSettled(
     fieldNames.map((fieldName) =>
@@ -168,7 +168,7 @@ export const fetchSignificantTermPValues = async (
       if (typeof pValue === 'number' && pValue < LOG_RATE_ANALYSIS_SETTINGS.P_VALUE_THRESHOLD) {
         result.push({
           key: `${fieldName}:${String(bucket.key)}`,
-          type: SIGNIFICANT_TERM_TYPE.KEYWORD,
+          type: SIGNIFICANT_ITEM_TYPE.KEYWORD,
           fieldName,
           fieldValue: String(bucket.key),
           doc_count: bucket.doc_count,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_terms_2_categories_counts.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_terms_2_categories_counts.ts
index 14be571331fd0d..b9eac01041be1e 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_terms_2_categories_counts.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/fetch_terms_2_categories_counts.ts
@@ -11,7 +11,7 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import type { Logger } from '@kbn/logging';
-import type { FieldValuePair, SignificantTerm } from '@kbn/ml-agg-utils';
+import type { FieldValuePair, SignificantItem } from '@kbn/ml-agg-utils';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 
 import type { AiopsLogRateAnalysisSchema } from '../../../../common/api/log_rate_analysis/schema';
@@ -68,9 +68,9 @@ export async function fetchTerms2CategoriesCounts(
   esClient: ElasticsearchClient,
   params: AiopsLogRateAnalysisSchema,
   searchQuery: estypes.QueryDslQueryContainer,
-  significantTerms: SignificantTerm[],
+  significantTerms: SignificantItem[],
   itemSets: ItemSet[],
-  significantCategories: SignificantTerm[],
+  significantCategories: SignificantItem[],
   from: number,
   to: number,
   logger: Logger,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.test.ts
index fb04844c5bd3dc..903755eca45d5e 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { significantTermGroups } from '../../../../common/__mocks__/farequote/significant_term_groups';
+import { significantItemGroups } from '../../../../common/__mocks__/farequote/significant_item_groups';
 import { fields } from '../../../../common/__mocks__/artificial_logs/fields';
 import { filteredFrequentItemSets } from '../../../../common/__mocks__/artificial_logs/filtered_frequent_item_sets';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
@@ -16,7 +16,7 @@ import { getSimpleHierarchicalTreeLeaves } from './get_simple_hierarchical_tree_
 
 describe('getFieldValuePairCounts', () => {
   it('returns a nested record with field/value pair counts for farequote', () => {
-    const fieldValuePairCounts = getFieldValuePairCounts(significantTermGroups);
+    const fieldValuePairCounts = getFieldValuePairCounts(significantItemGroups);
 
     expect(fieldValuePairCounts).toEqual({
       airline: {
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.ts
index 429306139d4027..6d0e15f2117f8d 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_field_value_pair_counts.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import type { FieldValuePairCounts } from '../../../../common/types';
 
 /**
  * Get a nested record of field/value pairs with counts
  */
-export function getFieldValuePairCounts(cpgs: SignificantTermGroup[]): FieldValuePairCounts {
+export function getFieldValuePairCounts(cpgs: SignificantItemGroup[]): FieldValuePairCounts {
   return cpgs.reduce<FieldValuePairCounts>((p, { group }) => {
     group.forEach(({ fieldName, fieldValue }) => {
       if (p[fieldName] === undefined) {
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.test.ts
index e4d30a4438c6e0..9f583f9e199df7 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.test.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import { finalSignificantTermGroups } from '../../../../common/__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../../../../common/__mocks__/artificial_logs/final_significant_item_groups';
 
 import { getGroupFilter } from './get_group_filter';
 
 describe('getGroupFilter', () => {
-  it('gets a query filter for the significant terms of a group', () => {
-    expect(getGroupFilter(finalSignificantTermGroups[0])).toStrictEqual([
+  it('gets a query filter for the significant items of a group', () => {
+    expect(getGroupFilter(finalSignificantItemGroups[0])).toStrictEqual([
       {
         term: {
           url: 'login.php',
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.ts
index d968ce90ec91b8..e2ae795004e180 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_group_filter.ts
@@ -7,21 +7,21 @@
 
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
-import { type SignificantTermGroup, SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
+import { type SignificantItemGroup, SIGNIFICANT_ITEM_TYPE } from '@kbn/ml-agg-utils';
 
 import { getCategoryQuery } from '../../../../common/api/log_categorization/get_category_query';
 
-// Transforms a list of significant terms from a group in a query filter.
+// Transforms a list of significant items from a group in a query filter.
 // Uses a `term` filter for single field value combinations.
 // For fields with multiple values it creates a single `terms` filter that includes
 // all values. This avoids queries not returning any results otherwise because
 // separate `term` filter for multiple values for the same field would rule each other out.
 export function getGroupFilter(
-  significantTermGroup: SignificantTermGroup
+  significantItemGroup: SignificantItemGroup
 ): estypes.QueryDslQueryContainer[] {
   const groupKeywordFilter = Object.entries(
-    significantTermGroup.group
-      .filter((d) => d.type === SIGNIFICANT_TERM_TYPE.KEYWORD)
+    significantItemGroup.group
+      .filter((d) => d.type === SIGNIFICANT_ITEM_TYPE.KEYWORD)
       .reduce<Record<string, Array<string | number>>>((p, c) => {
         if (p[c.fieldName]) {
           p[c.fieldName].push(c.fieldValue);
@@ -35,8 +35,8 @@ export function getGroupFilter(
     return p;
   }, []);
 
-  const groupLogPatternFilter = significantTermGroup.group
-    .filter((d) => d.type === SIGNIFICANT_TERM_TYPE.LOG_PATTERN)
+  const groupLogPatternFilter = significantItemGroup.group
+    .filter((d) => d.type === SIGNIFICANT_ITEM_TYPE.LOG_PATTERN)
     .map((d) =>
       getCategoryQuery(d.fieldName, [
         {
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.test.ts
index 3c7325cdb49ebd..5a0e1507f398d8 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { significantTermGroups } from '../../../../common/__mocks__/artificial_logs/significant_term_groups';
+import { significantItemGroups } from '../../../../common/__mocks__/artificial_logs/significant_item_groups';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
 
 import { duplicateIdentifier } from './duplicate_identifier';
@@ -16,15 +16,15 @@ import { getMarkedDuplicates } from './get_marked_duplicates';
 
 describe('getGroupsWithReaddedDuplicates', () => {
   it('gets groups with readded duplicates', () => {
-    const groupedSignificantTerms = groupDuplicates(significantTerms, duplicateIdentifier).filter(
+    const groupedSignificantItems = groupDuplicates(significantTerms, duplicateIdentifier).filter(
       (g) => g.group.length > 1
     );
 
-    const fieldValuePairCounts = getFieldValuePairCounts(significantTermGroups);
-    const markedDuplicates = getMarkedDuplicates(significantTermGroups, fieldValuePairCounts);
+    const fieldValuePairCounts = getFieldValuePairCounts(significantItemGroups);
+    const markedDuplicates = getMarkedDuplicates(significantItemGroups, fieldValuePairCounts);
     const groupsWithReaddedDuplicates = getGroupsWithReaddedDuplicates(
       markedDuplicates,
-      groupedSignificantTerms
+      groupedSignificantItems
     );
 
     expect(groupsWithReaddedDuplicates).toEqual([
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.ts
index 6defb9d8866625..e3e012ce299e3e 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_groups_with_readded_duplicates.ts
@@ -7,20 +7,20 @@
 
 import { uniqWith, isEqual } from 'lodash';
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-import type { SignificantTermDuplicateGroup } from '../../../../common/types';
+import type { SignificantItemDuplicateGroup } from '../../../../common/types';
 
 export function getGroupsWithReaddedDuplicates(
-  groups: SignificantTermGroup[],
-  groupedSignificantTerms: SignificantTermDuplicateGroup[]
-): SignificantTermGroup[] {
+  groups: SignificantItemGroup[],
+  groupedSignificantItems: SignificantItemDuplicateGroup[]
+): SignificantItemGroup[] {
   return groups.map((g) => {
     const group = [...g.group];
 
     for (const groupItem of g.group) {
       const { duplicate } = groupItem;
-      const duplicates = groupedSignificantTerms.find((d) =>
+      const duplicates = groupedSignificantItems.find((d) =>
         d.group.some(
           (dg) => dg.fieldName === groupItem.fieldName && dg.fieldValue === groupItem.fieldValue
         )
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.test.ts
index 9c0d86a392e4d8..fcc2448d4cd464 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { significantTermGroups } from '../../../../common/__mocks__/farequote/significant_term_groups';
+import { significantItemGroups } from '../../../../common/__mocks__/farequote/significant_item_groups';
 import { fields } from '../../../../common/__mocks__/artificial_logs/fields';
 import { filteredFrequentItemSets } from '../../../../common/__mocks__/artificial_logs/filtered_frequent_item_sets';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
@@ -16,9 +16,9 @@ import { getSimpleHierarchicalTree } from './get_simple_hierarchical_tree';
 import { getSimpleHierarchicalTreeLeaves } from './get_simple_hierarchical_tree_leaves';
 
 describe('markDuplicates', () => {
-  it('marks duplicates based on significant terms groups for farequote', () => {
-    const fieldValuePairCounts = getFieldValuePairCounts(significantTermGroups);
-    const markedDuplicates = getMarkedDuplicates(significantTermGroups, fieldValuePairCounts);
+  it('marks duplicates based on significant items groups for farequote', () => {
+    const fieldValuePairCounts = getFieldValuePairCounts(significantItemGroups);
+    const markedDuplicates = getMarkedDuplicates(significantItemGroups, fieldValuePairCounts);
 
     expect(markedDuplicates).toEqual([
       {
@@ -74,7 +74,7 @@ describe('markDuplicates', () => {
     ]);
   });
 
-  it('marks duplicates based on significant terms groups for artificial logs', () => {
+  it('marks duplicates based on significant items groups for artificial logs', () => {
     const simpleHierarchicalTree = getSimpleHierarchicalTree(
       filteredFrequentItemSets,
       true,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.ts
index 7708d0634bda37..8ddc13cfee8df8 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_marked_duplicates.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import type { FieldValuePairCounts } from '../../../../common/types';
 
@@ -13,9 +13,9 @@ import type { FieldValuePairCounts } from '../../../../common/types';
  * Analyse duplicate field/value pairs in groups.
  */
 export function getMarkedDuplicates(
-  cpgs: SignificantTermGroup[],
+  cpgs: SignificantItemGroup[],
   fieldValuePairCounts: FieldValuePairCounts
-): SignificantTermGroup[] {
+): SignificantItemGroup[] {
   return cpgs.map((cpg) => {
     return {
       ...cpg,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.test.ts
similarity index 75%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.test.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.test.ts
index 412b7013b64d61..8ac70af16d298b 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { significantTermGroups } from '../../../../common/__mocks__/artificial_logs/significant_term_groups';
+import { significantItemGroups } from '../../../../common/__mocks__/artificial_logs/significant_item_groups';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
 
 import { duplicateIdentifier } from './duplicate_identifier';
@@ -13,27 +13,27 @@ import { getGroupsWithReaddedDuplicates } from './get_groups_with_readded_duplic
 import { groupDuplicates } from './fetch_frequent_item_sets';
 import { getFieldValuePairCounts } from './get_field_value_pair_counts';
 import { getMarkedDuplicates } from './get_marked_duplicates';
-import { getMissingSignificantTerms } from './get_missing_significant_terms';
+import { getMissingSignificantItems } from './get_missing_significant_items';
 
-describe('getMissingSignificantTerms', () => {
-  it('get missing significant terms', () => {
-    const groupedSignificantTerms = groupDuplicates(significantTerms, duplicateIdentifier).filter(
+describe('getMissingSignificantItems', () => {
+  it('get missing significant items', () => {
+    const groupedSignificantItems = groupDuplicates(significantTerms, duplicateIdentifier).filter(
       (g) => g.group.length > 1
     );
 
-    const fieldValuePairCounts = getFieldValuePairCounts(significantTermGroups);
-    const markedDuplicates = getMarkedDuplicates(significantTermGroups, fieldValuePairCounts);
+    const fieldValuePairCounts = getFieldValuePairCounts(significantItemGroups);
+    const markedDuplicates = getMarkedDuplicates(significantItemGroups, fieldValuePairCounts);
     const groupsWithReaddedDuplicates = getGroupsWithReaddedDuplicates(
       markedDuplicates,
-      groupedSignificantTerms
+      groupedSignificantItems
     );
 
-    const missingSignificantTerms = getMissingSignificantTerms(
+    const missingSignificantItems = getMissingSignificantItems(
       significantTerms,
       groupsWithReaddedDuplicates
     );
 
-    expect(missingSignificantTerms).toEqual([
+    expect(missingSignificantItems).toEqual([
       {
         key: 'user:Peter',
         type: 'keyword',
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.ts
similarity index 57%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.ts
index 7daa797f16a370..c2847f1592dd10 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_terms.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_missing_significant_items.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-export function getMissingSignificantTerms(
-  significantTerms: SignificantTerm[],
-  significantTermGroups: SignificantTermGroup[]
+export function getMissingSignificantItems(
+  significantItems: SignificantItem[],
+  significantItemGroups: SignificantItemGroup[]
 ) {
-  return significantTerms.filter((cp) => {
-    return !significantTermGroups.some((cpg) => {
+  return significantItems.filter((cp) => {
+    return !significantItemGroups.some((cpg) => {
       return cpg.group.some((d) => d.fieldName === cp.fieldName && d.fieldValue === cp.fieldValue);
     });
   });
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.test.ts
similarity index 59%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.test.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.test.ts
index 05a682bc4ea344..cf5ba41fe5216a 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.test.ts
@@ -10,20 +10,20 @@ import { orderBy } from 'lodash';
 import { fields } from '../../../../common/__mocks__/artificial_logs/fields';
 import { frequentItemSets } from '../../../../common/__mocks__/artificial_logs/frequent_item_sets';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
-import { finalSignificantTermGroups } from '../../../../common/__mocks__/artificial_logs/final_significant_term_groups';
+import { finalSignificantItemGroups } from '../../../../common/__mocks__/artificial_logs/final_significant_item_groups';
 
-import { getSignificantTermGroups } from './get_significant_term_groups';
+import { getSignificantItemGroups } from './get_significant_item_groups';
 
-describe('getSignificantTermGroups', () => {
-  it('gets significant terms groups', () => {
-    const significantTermGroups = getSignificantTermGroups(
+describe('getSignificantItemGroups', () => {
+  it('gets significant items groups', () => {
+    const significantItemGroups = getSignificantItemGroups(
       frequentItemSets,
       significantTerms,
       fields
     );
 
-    expect(orderBy(significantTermGroups, ['docCount'])).toEqual(
-      orderBy(finalSignificantTermGroups, ['docCount'])
+    expect(orderBy(significantItemGroups, ['docCount'])).toEqual(
+      orderBy(finalSignificantItemGroups, ['docCount'])
     );
   });
 });
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.ts
similarity index 70%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.ts
index 1b498b0d765954..27dc06ad343b93 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_term_groups.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_significant_item_groups.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import { duplicateIdentifier } from './duplicate_identifier';
 import { groupDuplicates } from './fetch_frequent_item_sets';
@@ -13,18 +13,18 @@ import { getFieldValuePairCounts } from './get_field_value_pair_counts';
 import { getMarkedDuplicates } from './get_marked_duplicates';
 import { getSimpleHierarchicalTree } from './get_simple_hierarchical_tree';
 import { getSimpleHierarchicalTreeLeaves } from './get_simple_hierarchical_tree_leaves';
-import { getMissingSignificantTerms } from './get_missing_significant_terms';
-import { transformSignificantTermToGroup } from './transform_significant_term_to_group';
+import { getMissingSignificantItems } from './get_missing_significant_items';
+import { transformSignificantItemToGroup } from './transform_significant_item_to_group';
 import type { ItemSet } from '../../../../common/types';
 
-export function getSignificantTermGroups(
+export function getSignificantItemGroups(
   itemsets: ItemSet[],
-  significantTerms: SignificantTerm[],
+  significantItems: SignificantItem[],
   fields: string[]
-): SignificantTermGroup[] {
-  // We use the grouped significant terms to later repopulate
+): SignificantItemGroup[] {
+  // We use the grouped significant items to later repopulate
   // the `frequent_item_sets` result with the missing duplicates.
-  const groupedSignificantTerms = groupDuplicates(significantTerms, duplicateIdentifier).filter(
+  const groupedSignificantItems = groupDuplicates(significantItems, duplicateIdentifier).filter(
     (g) => g.group.length > 1
   );
 
@@ -33,7 +33,7 @@ export function getSignificantTermGroups(
   // and then summarize them in larger groups where possible.
 
   // Get a tree structure based on `frequent_item_sets`.
-  const { root } = getSimpleHierarchicalTree(itemsets, false, false, significantTerms, fields);
+  const { root } = getSimpleHierarchicalTree(itemsets, false, false, significantItems, fields);
 
   // Each leave of the tree will be a summarized group of co-occuring field/value pairs.
   const treeLeaves = getSimpleHierarchicalTreeLeaves(root, []);
@@ -42,21 +42,21 @@ export function getSignificantTermGroups(
   // that occur in multiple groups. This will allow us to highlight field/value pairs that are
   // unique to a group in a better way.
   const fieldValuePairCounts = getFieldValuePairCounts(treeLeaves);
-  const significantTermGroups = getMarkedDuplicates(treeLeaves, fieldValuePairCounts);
+  const significantItemGroups = getMarkedDuplicates(treeLeaves, fieldValuePairCounts);
 
   // Some field/value pairs might not be part of the `frequent_item_sets` result set, for example
   // because they don't co-occur with other field/value pairs or because of the limits we set on the query.
   // In this next part we identify those missing pairs and add them as individual groups.
-  const missingSignificantTerms = getMissingSignificantTerms(
-    significantTerms,
-    significantTermGroups
+  const missingSignificantItems = getMissingSignificantItems(
+    significantItems,
+    significantItemGroups
   );
 
-  significantTermGroups.push(
-    ...missingSignificantTerms.map((significantTerm) =>
-      transformSignificantTermToGroup(significantTerm, groupedSignificantTerms)
+  significantItemGroups.push(
+    ...missingSignificantItems.map((significantItem) =>
+      transformSignificantItemToGroup(significantItem, groupedSignificantItems)
     )
   );
 
-  return significantTermGroups;
+  return significantItemGroups;
 }
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree.ts
index 2ffcc184fa71e8..54cce87526bb12 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { SignificantTerm } from '@kbn/ml-agg-utils';
+import type { SignificantItem } from '@kbn/ml-agg-utils';
 
 import type { ItemSet, SimpleHierarchicalTreeNode } from '../../../../common/types';
 
@@ -34,7 +34,7 @@ function NewNodeFactory(name: string): SimpleHierarchicalTreeNode {
  * The resulting tree components are non-overlapping subsets of the data.
  * In summary, we start with the most inclusive itemset (highest count), and perform a depth first search in field order.
  *
- * @param significantTerms
+ * @param significantItems
  * @param fields
  * @param displayParent
  * @param parentDocCount
@@ -47,7 +47,7 @@ function NewNodeFactory(name: string): SimpleHierarchicalTreeNode {
  * @returns
  */
 function dfDepthFirstSearch(
-  significantTerms: SignificantTerm[],
+  significantItems: SignificantItem[],
   fields: string[],
   displayParent: SimpleHierarchicalTreeNode,
   parentDocCount: number,
@@ -79,10 +79,10 @@ function dfDepthFirstSearch(
 
   let displayNode: SimpleHierarchicalTreeNode;
 
-  const significantTerm = significantTerms.find(
+  const significantItem = significantItems.find(
     (d) => d.fieldName === field && d.fieldValue === value
   );
-  if (!significantTerm) {
+  if (!significantItem) {
     return 0;
   }
 
@@ -91,8 +91,8 @@ function dfDepthFirstSearch(
     displayParent.name += ` ${value}`;
 
     displayParent.set.push({
-      key: significantTerm.key,
-      type: significantTerm.type,
+      key: significantItem.key,
+      type: significantItem.type,
       fieldName: field,
       fieldValue: value,
       docCount,
@@ -105,8 +105,8 @@ function dfDepthFirstSearch(
     displayNode = NewNodeFactory(`${docCount}/${totalDocCount}${label}`);
     displayNode.set = [...displayParent.set];
     displayNode.set.push({
-      key: significantTerm.key,
-      type: significantTerm.type,
+      key: significantItem.key,
+      type: significantItem.type,
       fieldName: field,
       fieldValue: value,
       docCount,
@@ -148,7 +148,7 @@ function dfDepthFirstSearch(
   let subCount = 0;
   for (const nextValue of getValuesDescending(filteredItemSets, nextField)) {
     subCount += dfDepthFirstSearch(
-      significantTerms,
+      significantItems,
       fields,
       displayNode,
       docCount,
@@ -181,7 +181,7 @@ export function getSimpleHierarchicalTree(
   itemSets: ItemSet[],
   collapseRedundant: boolean,
   displayOther: boolean,
-  significantTerms: SignificantTerm[],
+  significantItems: SignificantItem[],
   fields: string[] = []
 ) {
   const totalDocCount = Math.max(...itemSets.map((d) => d.total_doc_count));
@@ -191,7 +191,7 @@ export function getSimpleHierarchicalTree(
   for (const field of fields) {
     for (const value of getValuesDescending(itemSets, field)) {
       dfDepthFirstSearch(
-        significantTerms,
+        significantItems,
         fields,
         newRoot,
         totalDocCount + 1,
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree_leaves.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree_leaves.ts
index bd183239eeadf1..619ec2896d4d4b 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree_leaves.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/get_simple_hierarchical_tree_leaves.ts
@@ -6,7 +6,7 @@
  */
 
 import { orderBy } from 'lodash';
-import type { SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItemGroup } from '@kbn/ml-agg-utils';
 import { stringHash } from '@kbn/ml-string-hash';
 
 import type { SimpleHierarchicalTreeNode } from '../../../../common/types';
@@ -16,7 +16,7 @@ import type { SimpleHierarchicalTreeNode } from '../../../../common/types';
  */
 export function getSimpleHierarchicalTreeLeaves(
   tree: SimpleHierarchicalTreeNode,
-  leaves: SignificantTermGroup[],
+  leaves: SignificantItemGroup[],
   level = 1
 ) {
   if (tree.children.length === 0) {
@@ -43,7 +43,7 @@ export function getSimpleHierarchicalTreeLeaves(
   const sortedLeaves = orderBy(leaves, [(d) => d.group.length], ['desc']);
 
   // Checks if a group is a subset of items already present in a larger group.
-  const filteredLeaves = sortedLeaves.reduce<SignificantTermGroup[]>((p, c) => {
+  const filteredLeaves = sortedLeaves.reduce<SignificantItemGroup[]>((p, c) => {
     const isSubset = p.some((pG) =>
       c.group.every((cGI) =>
         pG.group.some((pGI) => pGI.fieldName === cGI.fieldName && pGI.fieldValue === cGI.fieldValue)
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.test.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.test.ts
similarity index 66%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.test.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.test.ts
index 860baa3c800a20..f1a2a540dc8770 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.test.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { significantTermGroups } from '../../../../common/__mocks__/artificial_logs/significant_term_groups';
+import { significantItemGroups } from '../../../../common/__mocks__/artificial_logs/significant_item_groups';
 import { significantTerms } from '../../../../common/__mocks__/artificial_logs/significant_terms';
 
 import { duplicateIdentifier } from './duplicate_identifier';
@@ -13,30 +13,30 @@ import { getGroupsWithReaddedDuplicates } from './get_groups_with_readded_duplic
 import { groupDuplicates } from './fetch_frequent_item_sets';
 import { getFieldValuePairCounts } from './get_field_value_pair_counts';
 import { getMarkedDuplicates } from './get_marked_duplicates';
-import { getMissingSignificantTerms } from './get_missing_significant_terms';
-import { transformSignificantTermToGroup } from './transform_significant_term_to_group';
+import { getMissingSignificantItems } from './get_missing_significant_items';
+import { transformSignificantItemToGroup } from './transform_significant_item_to_group';
 
-describe('getMissingSignificantTerms', () => {
-  it('get missing significant terms', () => {
-    const groupedSignificantTerms = groupDuplicates(significantTerms, duplicateIdentifier).filter(
+describe('getMissingSignificantItems', () => {
+  it('get missing significant items', () => {
+    const groupedSignificantItems = groupDuplicates(significantTerms, duplicateIdentifier).filter(
       (g) => g.group.length > 1
     );
 
-    const fieldValuePairCounts = getFieldValuePairCounts(significantTermGroups);
-    const markedDuplicates = getMarkedDuplicates(significantTermGroups, fieldValuePairCounts);
+    const fieldValuePairCounts = getFieldValuePairCounts(significantItemGroups);
+    const markedDuplicates = getMarkedDuplicates(significantItemGroups, fieldValuePairCounts);
     const groupsWithReaddedDuplicates = getGroupsWithReaddedDuplicates(
       markedDuplicates,
-      groupedSignificantTerms
+      groupedSignificantItems
     );
 
-    const missingSignificantTerms = getMissingSignificantTerms(
+    const missingSignificantItems = getMissingSignificantItems(
       significantTerms,
       groupsWithReaddedDuplicates
     );
 
-    const transformed = transformSignificantTermToGroup(
-      missingSignificantTerms[0],
-      groupedSignificantTerms
+    const transformed = transformSignificantItemToGroup(
+      missingSignificantItems[0],
+      groupedSignificantItems
     );
 
     expect(transformed).toEqual({
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.ts
similarity index 77%
rename from x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.ts
rename to x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.ts
index 9f95a5c0fa2dbd..05a1473acc2bd4 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_term_to_group.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/queries/transform_significant_item_to_group.ts
@@ -6,17 +6,17 @@
  */
 
 import { stringHash } from '@kbn/ml-string-hash';
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
-import type { SignificantTermDuplicateGroup } from '../../../../common/types';
+import type { SignificantItemDuplicateGroup } from '../../../../common/types';
 
-export function transformSignificantTermToGroup(
-  significantTerm: SignificantTerm,
-  groupedSignificantTerms: SignificantTermDuplicateGroup[]
-): SignificantTermGroup {
-  const { key, type, fieldName, fieldValue, doc_count: docCount, pValue } = significantTerm;
+export function transformSignificantItemToGroup(
+  significantItem: SignificantItem,
+  groupedSignificantItems: SignificantItemDuplicateGroup[]
+): SignificantItemGroup {
+  const { key, type, fieldName, fieldValue, doc_count: docCount, pValue } = significantItem;
 
-  const duplicates = groupedSignificantTerms.find((d) =>
+  const duplicates = groupedSignificantItems.find((d) =>
     d.group.some((dg) => dg.fieldName === fieldName && dg.fieldValue === fieldValue)
   );
 
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_factory.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_factory.ts
new file mode 100644
index 00000000000000..f54c2e93dd29ea
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_factory.ts
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { streamFactory, type StreamFactoryReturnType } from '@kbn/ml-response-stream/server';
+import type { ElasticsearchClient } from '@kbn/core/server';
+import type { Headers, KibanaRequestEvents } from '@kbn/core-http-server';
+import type { Logger } from '@kbn/logging';
+
+import { type AiopsLogRateAnalysisApiAction } from '../../../common/api/log_rate_analysis/actions';
+
+import type {
+  AiopsLogRateAnalysisSchema,
+  AiopsLogRateAnalysisApiVersion as ApiVersion,
+} from '../../../common/api/log_rate_analysis/schema';
+
+import { indexInfoHandlerFactory } from './analysis_handlers/index_info_handler';
+import { groupingHandlerFactory } from './analysis_handlers/grouping_handler';
+import { histogramHandlerFactory } from './analysis_handlers/histogram_handler';
+import { overridesHandlerFactory } from './analysis_handlers/overrides_handler';
+import { significantItemsHandlerFactory } from './analysis_handlers/significant_items_handler';
+import { overallHistogramHandlerFactory } from './analysis_handlers/overall_histogram_handler';
+import {
+  logDebugMessageFactory,
+  type LogDebugMessage,
+} from './response_stream_utils/log_debug_message';
+import { stateHandlerFactory, type StateHandler } from './response_stream_utils/state_handler';
+import { streamEndFactory } from './response_stream_utils/stream_end';
+import { streamEndWithUpdatedLoadingStateFactory } from './response_stream_utils/stream_end_with_updated_loading_state';
+import { streamPushErrorFactory } from './response_stream_utils/stream_push_error';
+import { streamPushPingWithTimeoutFactory } from './response_stream_utils/stream_push_ping_with_timeout';
+
+/**
+ * The options to be passed in to `responseStreamFactory`.
+ */
+export interface ResponseStreamOptions<T extends ApiVersion> {
+  version: T;
+  client: ElasticsearchClient;
+  requestBody: AiopsLogRateAnalysisSchema<T>;
+  events: KibanaRequestEvents;
+  headers: Headers;
+  logger: Logger;
+}
+
+/**
+ * The full options object that will be passed on to analysis handlers
+ * so they're able to access all necessary runtime dependencies.
+ */
+export interface ResponseStreamFetchOptions<T extends ApiVersion> extends ResponseStreamOptions<T> {
+  abortSignal: AbortSignal;
+  logDebugMessage: LogDebugMessage;
+  responseStream: {
+    end: () => void;
+    endWithUpdatedLoadingState: () => void;
+    push: StreamFactoryReturnType<AiopsLogRateAnalysisApiAction<T>>['push'];
+    pushPingWithTimeout: () => void;
+    pushError: (msg: string) => void;
+  };
+  stateHandler: StateHandler;
+}
+
+/**
+ * `responseStreamFactory` sets up the response stream, the stream's state (for example
+ * if it's running, how far the stream progressed etc.), some custom actions for the stream
+ * as well as analysis handlers that fetch data from ES and pass it on to the stream.
+ * This factory should avoid to include any logic, its purpose is to take care of setting up
+ * and passing around dependencies for the various other parts involved
+ * running the analysis.
+ */
+export const responseStreamFactory = <T extends ApiVersion>(options: ResponseStreamOptions<T>) => {
+  const { events, headers, logger, requestBody } = options;
+
+  const logDebugMessage = logDebugMessageFactory(logger);
+  const state = stateHandlerFactory({
+    groupingEnabled: !!requestBody.grouping,
+    sampleProbability: requestBody.sampleProbability ?? 1,
+  });
+  const controller = new AbortController();
+  const abortSignal = controller.signal;
+
+  events.aborted$.subscribe(() => {
+    logDebugMessage('aborted$ subscription trigger.');
+    state.shouldStop(true);
+    controller.abort();
+  });
+  events.completed$.subscribe(() => {
+    logDebugMessage('completed$ subscription trigger.');
+    state.shouldStop(true);
+    controller.abort();
+  });
+
+  const {
+    end: streamEnd,
+    push,
+    responseWithHeaders,
+  } = streamFactory<AiopsLogRateAnalysisApiAction<T>>(
+    headers,
+    logger,
+    requestBody.compressResponse,
+    requestBody.flushFix
+  );
+
+  const pushPingWithTimeout = streamPushPingWithTimeoutFactory<T>(state, push, logDebugMessage);
+  const end = streamEndFactory(state, streamEnd, logDebugMessage);
+  const endWithUpdatedLoadingState = streamEndWithUpdatedLoadingStateFactory(end, push);
+  const pushError = streamPushErrorFactory(push, logDebugMessage);
+
+  const streamFetchOptions: ResponseStreamFetchOptions<T> = {
+    ...options,
+    abortSignal,
+    logDebugMessage,
+    responseStream: {
+      end,
+      endWithUpdatedLoadingState,
+      push,
+      pushError,
+      pushPingWithTimeout,
+    },
+    stateHandler: state,
+  };
+
+  return {
+    ...streamFetchOptions,
+    analysis: {
+      indexInfoHandler: indexInfoHandlerFactory(streamFetchOptions),
+      groupingHandler: groupingHandlerFactory(streamFetchOptions),
+      histogramHandler: histogramHandlerFactory(streamFetchOptions),
+      overallHistogramHandler: overallHistogramHandlerFactory(streamFetchOptions),
+      overridesHandler: overridesHandlerFactory(streamFetchOptions),
+      significantItemsHandler: significantItemsHandlerFactory(streamFetchOptions),
+    },
+    responseWithHeaders,
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/constants.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/constants.ts
new file mode 100644
index 00000000000000..3069015070239e
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/constants.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// Overall progress is a float from 0 to 1.
+export const LOADED_FIELD_CANDIDATES = 0.2;
+export const PROGRESS_STEP_P_VALUES = 0.5;
+export const PROGRESS_STEP_GROUPING = 0.1;
+export const PROGRESS_STEP_HISTOGRAMS = 0.1;
+export const PROGRESS_STEP_HISTOGRAMS_GROUPS = 0.1;
+
+// Don't use more than 10 here otherwise Kibana will emit an error
+// regarding a limit of abort signal listeners of more than 10.
+export const MAX_CONCURRENT_QUERIES = 10;
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/log_debug_message.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/log_debug_message.ts
new file mode 100644
index 00000000000000..72a61ba93ca7d8
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/log_debug_message.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Logger } from '@kbn/logging';
+
+export type LogDebugMessage = (msg: string) => void;
+
+export const logDebugMessageFactory = (logger: Logger): LogDebugMessage => {
+  let logMessageCounter = 0;
+
+  return (msg: string) => {
+    logMessageCounter++;
+    logger.debug(`Log Rate Analysis #${logMessageCounter}: ${msg}`);
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/state_handler.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/state_handler.ts
new file mode 100644
index 00000000000000..98763170083f66
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/state_handler.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface StreamState {
+  isRunning: boolean;
+  groupingEnabled: boolean;
+  loaded: number;
+  sampleProbability: number;
+  shouldStop: boolean;
+}
+
+const getDefaultStreamState = (overrides: Partial<StreamState>): StreamState => ({
+  isRunning: !!overrides.isRunning,
+  groupingEnabled: !!overrides.groupingEnabled,
+  loaded: overrides.loaded ?? 0,
+  sampleProbability: overrides.sampleProbability ?? 1,
+  shouldStop: !!overrides.shouldStop,
+});
+
+/**
+ * `stateHandlerFactory` takes care of handling the inner state of the stream,
+ * for example how much of the stream has been completed, if the stream is running etc.
+ * It exposes the state as getter/setter functions, for example `loaded()` will
+ * retrieve the current loading state, `loaded(0.5)` will update it.
+ */
+export const stateHandlerFactory = (overrides: Partial<StreamState>) => {
+  const state = getDefaultStreamState(overrides);
+
+  function groupingEnabled(d?: boolean) {
+    if (typeof d === 'boolean') {
+      state.groupingEnabled = d;
+    } else {
+      return state.groupingEnabled;
+    }
+  }
+
+  function loaded(): number;
+  function loaded(d: number, replace?: boolean): undefined;
+  function loaded(d?: number, replace = true) {
+    if (typeof d === 'number') {
+      if (replace) {
+        state.loaded = d;
+      } else {
+        state.loaded += d;
+      }
+    } else {
+      return state.loaded;
+    }
+  }
+
+  function isRunning(d?: boolean) {
+    if (typeof d === 'boolean') {
+      state.isRunning = d;
+    } else {
+      return state.isRunning;
+    }
+  }
+
+  function sampleProbability(d?: number) {
+    if (typeof d === 'number') {
+      state.sampleProbability = d;
+    } else {
+      return state.sampleProbability;
+    }
+  }
+
+  function shouldStop(d?: boolean) {
+    if (typeof d === 'boolean') {
+      state.shouldStop = d;
+    } else {
+      return state.shouldStop;
+    }
+  }
+
+  return { groupingEnabled, isRunning, loaded, sampleProbability, shouldStop };
+};
+
+export type StateHandler = ReturnType<typeof stateHandlerFactory>;
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end.ts
new file mode 100644
index 00000000000000..1be099d39a95e9
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { LogDebugMessage } from './log_debug_message';
+import type { StateHandler } from './state_handler';
+
+/**
+ * Helper function that will check if the actual stream is still running
+ * and only then will call the callback to end the raw stream and update its state.
+ * This is implemented as a factory that receives the necessary dependencies
+ * which then returns the actual helper function.
+ */
+export const streamEndFactory = (
+  stateHandler: StateHandler,
+  streamEndCallback: () => void,
+  logDebugMessage: LogDebugMessage
+) => {
+  return function end() {
+    if (stateHandler.isRunning()) {
+      stateHandler.isRunning(false);
+      logDebugMessage('Ending analysis.');
+      streamEndCallback();
+    } else {
+      logDebugMessage('end() was called again with isRunning already being false.');
+    }
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end_with_updated_loading_state.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end_with_updated_loading_state.ts
new file mode 100644
index 00000000000000..95957b9fed2013
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_end_with_updated_loading_state.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+import type { StreamFactoryReturnType } from '@kbn/ml-response-stream/server';
+
+import {
+  updateLoadingStateAction,
+  type AiopsLogRateAnalysisApiAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+/**
+ * Helper function that will push a message to the stream that it's done and
+ * then run a callback to end the actual stream.
+ * This is implemented as a factory that receives the necessary dependencies
+ * which then returns the actual helper function.
+ */
+export const streamEndWithUpdatedLoadingStateFactory = <T extends ApiVersion>(
+  streamEndCallback: () => void,
+  push: StreamFactoryReturnType<AiopsLogRateAnalysisApiAction<T>>['push']
+) => {
+  return function endWithUpdatedLoadingState() {
+    push(
+      updateLoadingStateAction({
+        ccsWarning: false,
+        loaded: 1,
+        loadingState: i18n.translate('xpack.aiops.logRateAnalysis.loadingState.doneMessage', {
+          defaultMessage: 'Done.',
+        }),
+      })
+    );
+
+    streamEndCallback();
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_error.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_error.ts
new file mode 100644
index 00000000000000..74e10c3125a591
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_error.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { StreamFactoryReturnType } from '@kbn/ml-response-stream/server';
+
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+import type { LogDebugMessage } from './log_debug_message';
+
+import {
+  addErrorAction,
+  type AiopsLogRateAnalysisApiAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+
+/**
+ * Helper function that will push an error message to the stream.
+ * This is implemented as a factory that receives the necessary dependencies
+ * which then returns the actual helper function.
+ */
+export const streamPushErrorFactory = <T extends ApiVersion>(
+  push: StreamFactoryReturnType<AiopsLogRateAnalysisApiAction<T>>['push'],
+  logDebugMessage: LogDebugMessage
+) => {
+  return function pushError(m: string) {
+    logDebugMessage('Push error.');
+    push(addErrorAction(m));
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_ping_with_timeout.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_ping_with_timeout.ts
new file mode 100644
index 00000000000000..d3c03556c0ad61
--- /dev/null
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/response_stream_utils/stream_push_ping_with_timeout.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { StreamFactoryReturnType } from '@kbn/ml-response-stream/server';
+
+import {
+  pingAction,
+  type AiopsLogRateAnalysisApiAction,
+} from '../../../../common/api/log_rate_analysis/actions';
+import type { AiopsLogRateAnalysisApiVersion as ApiVersion } from '../../../../common/api/log_rate_analysis/schema';
+
+import type { LogDebugMessage } from './log_debug_message';
+import type { StateHandler } from './state_handler';
+
+// 10s ping frequency to keep the stream alive.
+const PING_FREQUENCY = 10000;
+
+/**
+ * Helper function that will push a ping message every 10s until the stream finishes.
+ * This is implemented as a factory that receives the necessary dependencies
+ * which then returns the actual helper function.
+ */
+export const streamPushPingWithTimeoutFactory = <T extends ApiVersion>(
+  stateHandler: StateHandler,
+  push: StreamFactoryReturnType<AiopsLogRateAnalysisApiAction<T>>['push'],
+  logDebugMessage: LogDebugMessage
+) => {
+  return function pushPingWithTimeout() {
+    setTimeout(() => {
+      if (stateHandler.isRunning()) {
+        logDebugMessage('Ping message.');
+        push(pingAction());
+        pushPingWithTimeout();
+      }
+    }, PING_FREQUENCY);
+  };
+};
diff --git a/x-pack/plugins/aiops/server/routes/log_rate_analysis/route_handler_factory.ts b/x-pack/plugins/aiops/server/routes/log_rate_analysis/route_handler_factory.ts
index b92458cc1e3de2..3c1bcde38ebd6d 100644
--- a/x-pack/plugins/aiops/server/routes/log_rate_analysis/route_handler_factory.ts
+++ b/x-pack/plugins/aiops/server/routes/log_rate_analysis/route_handler_factory.ts
@@ -5,10 +5,6 @@
  * 2.0.
  */
 
-import { queue } from 'async';
-
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-
 import type {
   CoreStart,
   KibanaRequest,
@@ -17,67 +13,30 @@ import type {
   KibanaResponseFactory,
 } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
-import { i18n } from '@kbn/i18n';
-import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import { streamFactory } from '@kbn/ml-response-stream/server';
-import type {
-  SignificantTerm,
-  SignificantTermGroup,
-  SignificantTermHistogramItem,
-  NumericChartData,
-  NumericHistogramField,
-} from '@kbn/ml-agg-utils';
-import { SIGNIFICANT_TERM_TYPE } from '@kbn/ml-agg-utils';
-import { fetchHistogramsForFields } from '@kbn/ml-agg-utils';
 import { createExecutionContext } from '@kbn/ml-route-utils';
 import type { UsageCounter } from '@kbn/usage-collection-plugin/server';
 
-import { RANDOM_SAMPLER_SEED, AIOPS_TELEMETRY_ID } from '../../../common/constants';
-import {
-  addSignificantTermsAction,
-  addSignificantTermsGroupAction,
-  addSignificantTermsGroupHistogramAction,
-  addSignificantTermsHistogramAction,
-  addErrorAction,
-  pingAction,
-  resetAllAction,
-  resetErrorsAction,
-  resetGroupsAction,
-  updateLoadingStateAction,
-  AiopsLogRateAnalysisApiAction,
-} from '../../../common/api/log_rate_analysis/actions';
+import { AIOPS_TELEMETRY_ID } from '../../../common/constants';
 import type {
   AiopsLogRateAnalysisSchema,
   AiopsLogRateAnalysisApiVersion as ApiVersion,
 } from '../../../common/api/log_rate_analysis/schema';
-import { getCategoryQuery } from '../../../common/api/log_categorization/get_category_query';
 import { AIOPS_API_ENDPOINT } from '../../../common/api';
 
 import { PLUGIN_ID } from '../../../common';
 
 import { isRequestAbortedError } from '../../lib/is_request_aborted_error';
-import type { AiopsLicense } from '../../types';
-
-import { fetchSignificantCategories } from './queries/fetch_significant_categories';
-import { fetchSignificantTermPValues } from './queries/fetch_significant_term_p_values';
-import { fetchIndexInfo } from './queries/fetch_index_info';
-import { fetchFrequentItemSets } from './queries/fetch_frequent_item_sets';
-import { fetchTerms2CategoriesCounts } from './queries/fetch_terms_2_categories_counts';
-import { getHistogramQuery } from './queries/get_histogram_query';
-import { getGroupFilter } from './queries/get_group_filter';
-import { getSignificantTermGroups } from './queries/get_significant_term_groups';
 import { trackAIOpsRouteUsage } from '../../lib/track_route_usage';
+import type { AiopsLicense } from '../../types';
 
-// 10s ping frequency to keep the stream alive.
-const PING_FREQUENCY = 10000;
-
-// Overall progress is a float from 0 to 1.
-const LOADED_FIELD_CANDIDATES = 0.2;
-const PROGRESS_STEP_P_VALUES = 0.5;
-const PROGRESS_STEP_GROUPING = 0.1;
-const PROGRESS_STEP_HISTOGRAMS = 0.1;
-const PROGRESS_STEP_HISTOGRAMS_GROUPS = 0.1;
+import { responseStreamFactory } from './response_stream_factory';
+import { PROGRESS_STEP_HISTOGRAMS_GROUPS } from './response_stream_utils/constants';
 
+/**
+ * The log rate analysis route handler sets up `responseStreamFactory`
+ * to create the response stream and then uses its handlers to
+ * walk through the steps of the analysis.
+ */
 export function routeHandlerFactory<T extends ApiVersion>(
   version: T,
   license: AiopsLicense,
@@ -106,814 +65,71 @@ export function routeHandlerFactory<T extends ApiVersion>(
     const executionContext = createExecutionContext(coreStart, PLUGIN_ID, request.route.path);
 
     return await coreStart.executionContext.withContext(executionContext, () => {
-      let logMessageCounter = 1;
-
-      function logDebugMessage(msg: string) {
-        logger.debug(`Log Rate Analysis #${logMessageCounter}: ${msg}`);
-        logMessageCounter++;
-      }
-
-      logDebugMessage('Starting analysis.');
-
-      const groupingEnabled = !!request.body.grouping;
-      const sampleProbability = request.body.sampleProbability ?? 1;
-
-      const controller = new AbortController();
-      const abortSignal = controller.signal;
-
-      let isRunning = false;
-      let loaded = 0;
-      let shouldStop = false;
-      request.events.aborted$.subscribe(() => {
-        logDebugMessage('aborted$ subscription trigger.');
-        shouldStop = true;
-        controller.abort();
-      });
-      request.events.completed$.subscribe(() => {
-        logDebugMessage('completed$ subscription trigger.');
-        shouldStop = true;
-        controller.abort();
-      });
-
-      const {
-        end: streamEnd,
-        push,
-        responseWithHeaders,
-      } = streamFactory<AiopsLogRateAnalysisApiAction<T>>(
-        request.headers,
-        logger,
-        request.body.compressResponse,
-        request.body.flushFix
-      );
-
-      function pushPingWithTimeout() {
-        setTimeout(() => {
-          if (isRunning) {
-            logDebugMessage('Ping message.');
-            push(pingAction());
-            pushPingWithTimeout();
-          }
-        }, PING_FREQUENCY);
-      }
-
-      function end() {
-        if (isRunning) {
-          isRunning = false;
-          logDebugMessage('Ending analysis.');
-          streamEnd();
-        } else {
-          logDebugMessage('end() was called again with isRunning already being false.');
-        }
-      }
-
-      function endWithUpdatedLoadingState() {
-        push(
-          updateLoadingStateAction({
-            ccsWarning: false,
-            loaded: 1,
-            loadingState: i18n.translate('xpack.aiops.logRateAnalysis.loadingState.doneMessage', {
-              defaultMessage: 'Done.',
-            }),
-          })
-        );
-
-        end();
-      }
-
-      function pushError(m: string) {
-        logDebugMessage('Push error.');
-        push(addErrorAction(m));
-      }
+      const { analysis, logDebugMessage, stateHandler, responseStream, responseWithHeaders } =
+        responseStreamFactory<T>({
+          version,
+          client,
+          requestBody: request.body,
+          events: request.events,
+          headers: request.headers,
+          logger,
+        });
 
       async function runAnalysis() {
         try {
-          isRunning = true;
-
-          if (!request.body.overrides) {
-            logDebugMessage('Full Reset.');
-            push(resetAllAction());
-          } else {
-            logDebugMessage('Reset Errors.');
-            push(resetErrorsAction());
-          }
-
-          if (request.body.overrides?.regroupOnly) {
-            logDebugMessage('Reset Groups.');
-            push(resetGroupsAction());
-          }
-
-          if (request.body.overrides?.loaded) {
-            logDebugMessage(`Set 'loaded' override to '${request.body.overrides?.loaded}'.`);
-            loaded = request.body.overrides?.loaded;
-          }
+          logDebugMessage('Starting analysis.');
+          logDebugMessage(`Sample probability: ${stateHandler.sampleProbability()}`);
 
-          pushPingWithTimeout();
+          stateHandler.isRunning(true);
+          analysis.overridesHandler();
+          responseStream.pushPingWithTimeout();
 
           // Step 1: Index Info: Field candidates, total doc count, sample probability
+          const indexInfo = await analysis.indexInfoHandler();
 
-          const fieldCandidates: string[] = [];
-          let fieldCandidatesCount = fieldCandidates.length;
-
-          const textFieldCandidates: string[] = [];
-
-          let totalDocCount = 0;
-
-          if (!request.body.overrides?.remainingFieldCandidates) {
-            logDebugMessage('Fetch index information.');
-            push(
-              updateLoadingStateAction({
-                ccsWarning: false,
-                loaded,
-                loadingState: i18n.translate(
-                  'xpack.aiops.logRateAnalysis.loadingState.loadingIndexInformation',
-                  {
-                    defaultMessage: 'Loading index information.',
-                  }
-                ),
-              })
-            );
-
-            try {
-              const indexInfo = await fetchIndexInfo(
-                client,
-                request.body,
-                ['message', 'error.message'],
-                abortSignal
-              );
-
-              fieldCandidates.push(...indexInfo.fieldCandidates);
-              fieldCandidatesCount = fieldCandidates.length;
-              textFieldCandidates.push(...indexInfo.textFieldCandidates);
-              totalDocCount = indexInfo.totalDocCount;
-            } catch (e) {
-              if (!isRequestAbortedError(e)) {
-                logger.error(`Failed to fetch index information, got: \n${e.toString()}`);
-                pushError(`Failed to fetch index information.`);
-              }
-              end();
-              return;
-            }
-
-            logDebugMessage(`Total document count: ${totalDocCount}`);
-            logDebugMessage(`Sample probability: ${sampleProbability}`);
-
-            loaded += LOADED_FIELD_CANDIDATES;
-
-            pushPingWithTimeout();
-
-            push(
-              updateLoadingStateAction({
-                ccsWarning: false,
-                loaded,
-                loadingState: i18n.translate(
-                  'xpack.aiops.logRateAnalysis.loadingState.identifiedFieldCandidates',
-                  {
-                    defaultMessage:
-                      'Identified {fieldCandidatesCount, plural, one {# field candidate} other {# field candidates}}.',
-                    values: {
-                      fieldCandidatesCount,
-                    },
-                  }
-                ),
-              })
-            );
-
-            if (fieldCandidatesCount === 0) {
-              endWithUpdatedLoadingState();
-            } else if (shouldStop) {
-              logDebugMessage('shouldStop after fetching field candidates.');
-              end();
-              return;
-            }
-          }
-
-          // Step 2: Significant Categories and Terms
-
-          // This will store the combined count of detected significant log patterns and keywords
-          let fieldValuePairsCount = 0;
-
-          const significantCategories: SignificantTerm[] = [];
-
-          if (version === '1') {
-            significantCategories.push(
-              ...((
-                request.body as AiopsLogRateAnalysisSchema<'1'>
-              ).overrides?.significantTerms?.filter(
-                (d) => d.type === SIGNIFICANT_TERM_TYPE.LOG_PATTERN
-              ) ?? [])
-            );
-          }
-
-          if (version === '2') {
-            significantCategories.push(
-              ...((
-                request.body as AiopsLogRateAnalysisSchema<'2'>
-              ).overrides?.significantItems?.filter(
-                (d) => d.type === SIGNIFICANT_TERM_TYPE.LOG_PATTERN
-              ) ?? [])
-            );
-          }
-
-          // Get significant categories of text fields
-          if (textFieldCandidates.length > 0) {
-            significantCategories.push(
-              ...(await fetchSignificantCategories(
-                client,
-                request.body,
-                textFieldCandidates,
-                logger,
-                sampleProbability,
-                pushError,
-                abortSignal
-              ))
-            );
-
-            if (significantCategories.length > 0) {
-              push(addSignificantTermsAction(significantCategories, version));
-            }
-          }
-
-          const significantTerms: SignificantTerm[] = [];
-
-          if (version === '1') {
-            significantTerms.push(
-              ...((
-                request.body as AiopsLogRateAnalysisSchema<'1'>
-              ).overrides?.significantTerms?.filter(
-                (d) => d.type === SIGNIFICANT_TERM_TYPE.KEYWORD
-              ) ?? [])
-            );
-          }
-
-          if (version === '2') {
-            significantTerms.push(
-              ...((
-                request.body as AiopsLogRateAnalysisSchema<'2'>
-              ).overrides?.significantItems?.filter(
-                (d) => d.type === SIGNIFICANT_TERM_TYPE.KEYWORD
-              ) ?? [])
-            );
-          }
-
-          const fieldsToSample = new Set<string>();
-
-          // Don't use more than 10 here otherwise Kibana will emit an error
-          // regarding a limit of abort signal listeners of more than 10.
-          const MAX_CONCURRENT_QUERIES = 10;
-
-          let remainingFieldCandidates: string[];
-          let loadingStepSizePValues = PROGRESS_STEP_P_VALUES;
-
-          if (request.body.overrides?.remainingFieldCandidates) {
-            fieldCandidates.push(...request.body.overrides?.remainingFieldCandidates);
-            remainingFieldCandidates = request.body.overrides?.remainingFieldCandidates;
-            fieldCandidatesCount = fieldCandidates.length;
-            loadingStepSizePValues =
-              LOADED_FIELD_CANDIDATES +
-              PROGRESS_STEP_P_VALUES -
-              (request.body.overrides?.loaded ?? PROGRESS_STEP_P_VALUES);
-          } else {
-            remainingFieldCandidates = fieldCandidates;
-          }
-
-          logDebugMessage('Fetch p-values.');
-
-          const pValuesQueue = queue(async function (fieldCandidate: string) {
-            loaded += (1 / fieldCandidatesCount) * loadingStepSizePValues;
-
-            let pValues: Awaited<ReturnType<typeof fetchSignificantTermPValues>>;
-
-            try {
-              pValues = await fetchSignificantTermPValues(
-                client,
-                request.body,
-                [fieldCandidate],
-                logger,
-                sampleProbability,
-                pushError,
-                abortSignal
-              );
-            } catch (e) {
-              if (!isRequestAbortedError(e)) {
-                logger.error(
-                  `Failed to fetch p-values for '${fieldCandidate}', got: \n${e.toString()}`
-                );
-                pushError(`Failed to fetch p-values for '${fieldCandidate}'.`);
-              }
-              return;
-            }
-
-            remainingFieldCandidates = remainingFieldCandidates.filter((d) => d !== fieldCandidate);
-
-            if (pValues.length > 0) {
-              pValues.forEach((d) => {
-                fieldsToSample.add(d.fieldName);
-              });
-              significantTerms.push(...pValues);
-
-              push(addSignificantTermsAction(pValues, version));
-            }
-
-            push(
-              updateLoadingStateAction({
-                ccsWarning: false,
-                loaded,
-                loadingState: i18n.translate(
-                  'xpack.aiops.logRateAnalysis.loadingState.identifiedFieldValuePairs',
-                  {
-                    defaultMessage:
-                      'Identified {fieldValuePairsCount, plural, one {# significant field/value pair} other {# significant field/value pairs}}.',
-                    values: {
-                      fieldValuePairsCount,
-                    },
-                  }
-                ),
-                remainingFieldCandidates,
-              })
-            );
-          }, MAX_CONCURRENT_QUERIES);
-
-          pValuesQueue.push(fieldCandidates, (err) => {
-            if (err) {
-              logger.error(`Failed to fetch p-values.', got: \n${err.toString()}`);
-              pushError(`Failed to fetch p-values.`);
-              pValuesQueue.kill();
-              end();
-            } else if (shouldStop) {
-              logDebugMessage('shouldStop fetching p-values.');
-              pValuesQueue.kill();
-              end();
-            }
-          });
-          await pValuesQueue.drain();
-
-          fieldValuePairsCount = significantCategories.length + significantTerms.length;
-
-          if (fieldValuePairsCount === 0) {
-            logDebugMessage('Stopping analysis, did not find significant terms.');
-            endWithUpdatedLoadingState();
+          if (!indexInfo) {
             return;
           }
 
-          const histogramFields: [NumericHistogramField] = [
-            { fieldName: request.body.timeFieldName, type: KBN_FIELD_TYPES.DATE },
-          ];
-
-          logDebugMessage('Fetch overall histogram.');
-
-          let overallTimeSeries: NumericChartData | undefined;
-
-          const overallHistogramQuery = getHistogramQuery(request.body);
-
-          try {
-            overallTimeSeries = (
-              (await fetchHistogramsForFields(
-                client,
-                request.body.index,
-                overallHistogramQuery,
-                // fields
-                histogramFields,
-                // samplerShardSize
-                -1,
-                undefined,
-                abortSignal,
-                sampleProbability,
-                RANDOM_SAMPLER_SEED
-              )) as [NumericChartData]
-            )[0];
-          } catch (e) {
-            if (!isRequestAbortedError(e)) {
-              logger.error(`Failed to fetch the overall histogram data, got: \n${e.toString()}`);
-              pushError(`Failed to fetch overall histogram data.`);
-            }
-            // Still continue the analysis even if loading the overall histogram fails.
-          }
-
-          function pushHistogramDataLoadingState() {
-            push(
-              updateLoadingStateAction({
-                ccsWarning: false,
-                loaded,
-                loadingState: i18n.translate(
-                  'xpack.aiops.logRateAnalysis.loadingState.loadingHistogramData',
-                  {
-                    defaultMessage: 'Loading histogram data.',
-                  }
-                ),
-              })
-            );
-          }
+          // Step 2: Significant categories and terms
+          const significantItemsObj = await analysis.significantItemsHandler(indexInfo);
 
-          if (shouldStop) {
-            logDebugMessage('shouldStop after fetching overall histogram.');
-            end();
+          if (!significantItemsObj) {
             return;
           }
 
-          if (groupingEnabled) {
-            logDebugMessage('Group results.');
-
-            push(
-              updateLoadingStateAction({
-                ccsWarning: false,
-                loaded,
-                loadingState: i18n.translate(
-                  'xpack.aiops.logRateAnalysis.loadingState.groupingResults',
-                  {
-                    defaultMessage: 'Transforming significant field/value pairs into groups.',
-                  }
-                ),
-                groupsMissing: true,
-              })
-            );
-
-            try {
-              const { fields, itemSets } = await fetchFrequentItemSets(
-                client,
-                request.body.index,
-                JSON.parse(request.body.searchQuery) as estypes.QueryDslQueryContainer,
-                significantTerms,
-                request.body.timeFieldName,
-                request.body.deviationMin,
-                request.body.deviationMax,
-                logger,
-                sampleProbability,
-                pushError,
-                abortSignal
-              );
-
-              if (significantCategories.length > 0 && significantTerms.length > 0) {
-                const {
-                  fields: significantCategoriesFields,
-                  itemSets: significantCategoriesItemSets,
-                } = await fetchTerms2CategoriesCounts(
-                  client,
-                  request.body,
-                  JSON.parse(request.body.searchQuery) as estypes.QueryDslQueryContainer,
-                  significantTerms,
-                  itemSets,
-                  significantCategories,
-                  request.body.deviationMin,
-                  request.body.deviationMax,
-                  logger,
-                  pushError,
-                  abortSignal
-                );
-
-                fields.push(...significantCategoriesFields);
-                itemSets.push(...significantCategoriesItemSets);
-              }
-
-              if (shouldStop) {
-                logDebugMessage('shouldStop after fetching frequent_item_sets.');
-                end();
-                return;
-              }
-
-              if (fields.length > 0 && itemSets.length > 0) {
-                const significantTermGroups = getSignificantTermGroups(
-                  itemSets,
-                  [...significantTerms, ...significantCategories],
-                  fields
-                );
-
-                // We'll find out if there's at least one group with at least two items,
-                // only then will we return the groups to the clients and make the grouping option available.
-                const maxItems = Math.max(...significantTermGroups.map((g) => g.group.length));
-
-                if (maxItems > 1) {
-                  push(addSignificantTermsGroupAction(significantTermGroups, version));
-                }
-
-                loaded += PROGRESS_STEP_GROUPING;
-
-                pushHistogramDataLoadingState();
-
-                if (shouldStop) {
-                  logDebugMessage('shouldStop after grouping.');
-                  end();
-                  return;
-                }
-
-                logDebugMessage(`Fetch ${significantTermGroups.length} group histograms.`);
-
-                const groupHistogramQueue = queue(async function (cpg: SignificantTermGroup) {
-                  if (shouldStop) {
-                    logDebugMessage('shouldStop abort fetching group histograms.');
-                    groupHistogramQueue.kill();
-                    end();
-                    return;
-                  }
-
-                  if (overallTimeSeries !== undefined) {
-                    const histogramQuery = getHistogramQuery(request.body, getGroupFilter(cpg));
-
-                    let cpgTimeSeries: NumericChartData;
-                    try {
-                      cpgTimeSeries = (
-                        (await fetchHistogramsForFields(
-                          client,
-                          request.body.index,
-                          histogramQuery,
-                          // fields
-                          [
-                            {
-                              fieldName: request.body.timeFieldName,
-                              type: KBN_FIELD_TYPES.DATE,
-                              interval: overallTimeSeries.interval,
-                              min: overallTimeSeries.stats[0],
-                              max: overallTimeSeries.stats[1],
-                            },
-                          ],
-                          // samplerShardSize
-                          -1,
-                          undefined,
-                          abortSignal,
-                          sampleProbability,
-                          RANDOM_SAMPLER_SEED
-                        )) as [NumericChartData]
-                      )[0];
-                    } catch (e) {
-                      if (!isRequestAbortedError(e)) {
-                        logger.error(
-                          `Failed to fetch the histogram data for group #${
-                            cpg.id
-                          }, got: \n${e.toString()}`
-                        );
-                        pushError(`Failed to fetch the histogram data for group #${cpg.id}.`);
-                      }
-                      return;
-                    }
-                    const histogram: SignificantTermHistogramItem[] =
-                      overallTimeSeries.data.map((o) => {
-                        const current = cpgTimeSeries.data.find(
-                          (d1) => d1.key_as_string === o.key_as_string
-                        ) ?? {
-                          doc_count: 0,
-                        };
-
-                        if (version === '1') {
-                          return {
-                            key: o.key,
-                            key_as_string: o.key_as_string ?? '',
-                            doc_count_significant_term: current.doc_count,
-                            doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                          };
-                        }
-
-                        return {
-                          key: o.key,
-                          key_as_string: o.key_as_string ?? '',
-                          doc_count_significant_item: current.doc_count,
-                          doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                        };
-                      }) ?? [];
-
-                    push(
-                      addSignificantTermsGroupHistogramAction(
-                        [
-                          {
-                            id: cpg.id,
-                            histogram,
-                          },
-                        ],
-                        version
-                      )
-                    );
-                  }
-                }, MAX_CONCURRENT_QUERIES);
-
-                groupHistogramQueue.push(significantTermGroups);
-                await groupHistogramQueue.drain();
-              }
-            } catch (e) {
-              if (!isRequestAbortedError(e)) {
-                logger.error(
-                  `Failed to transform field/value pairs into groups, got: \n${e.toString()}`
-                );
-                pushError(`Failed to transform field/value pairs into groups.`);
-              }
-            }
-          }
-
-          loaded += PROGRESS_STEP_HISTOGRAMS_GROUPS;
+          const { fieldValuePairsCount, significantCategories, significantTerms } =
+            significantItemsObj;
 
-          logDebugMessage(`Fetch ${significantTerms.length} field/value histograms.`);
+          // Step 3: Fetch overall histogram
+          const overallTimeSeries = await analysis.overallHistogramHandler();
 
-          // time series filtered by fields
-          if (
-            significantTerms.length > 0 &&
-            overallTimeSeries !== undefined &&
-            !request.body.overrides?.regroupOnly
-          ) {
-            const fieldValueHistogramQueue = queue(async function (cp: SignificantTerm) {
-              if (shouldStop) {
-                logDebugMessage('shouldStop abort fetching field/value histograms.');
-                fieldValueHistogramQueue.kill();
-                end();
-                return;
-              }
-
-              if (overallTimeSeries !== undefined) {
-                const histogramQuery = getHistogramQuery(request.body, [
-                  {
-                    term: { [cp.fieldName]: cp.fieldValue },
-                  },
-                ]);
-
-                let cpTimeSeries: NumericChartData;
-
-                try {
-                  cpTimeSeries = (
-                    (await fetchHistogramsForFields(
-                      client,
-                      request.body.index,
-                      histogramQuery,
-                      // fields
-                      [
-                        {
-                          fieldName: request.body.timeFieldName,
-                          type: KBN_FIELD_TYPES.DATE,
-                          interval: overallTimeSeries.interval,
-                          min: overallTimeSeries.stats[0],
-                          max: overallTimeSeries.stats[1],
-                        },
-                      ],
-                      // samplerShardSize
-                      -1,
-                      undefined,
-                      abortSignal,
-                      sampleProbability,
-                      RANDOM_SAMPLER_SEED
-                    )) as [NumericChartData]
-                  )[0];
-                } catch (e) {
-                  logger.error(
-                    `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${
-                      cp.fieldValue
-                    }", got: \n${e.toString()}`
-                  );
-                  pushError(
-                    `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${cp.fieldValue}".`
-                  );
-                  return;
-                }
-
-                const histogram: SignificantTermHistogramItem[] =
-                  overallTimeSeries.data.map((o) => {
-                    const current = cpTimeSeries.data.find(
-                      (d1) => d1.key_as_string === o.key_as_string
-                    ) ?? {
-                      doc_count: 0,
-                    };
-                    if (version === '1') {
-                      return {
-                        key: o.key,
-                        key_as_string: o.key_as_string ?? '',
-                        doc_count_significant_term: current.doc_count,
-                        doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                      };
-                    }
-
-                    return {
-                      key: o.key,
-                      key_as_string: o.key_as_string ?? '',
-                      doc_count_significant_item: current.doc_count,
-                      doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                    };
-                  }) ?? [];
-
-                const { fieldName, fieldValue } = cp;
-
-                loaded += (1 / fieldValuePairsCount) * PROGRESS_STEP_HISTOGRAMS;
-                pushHistogramDataLoadingState();
-                push(
-                  addSignificantTermsHistogramAction(
-                    [
-                      {
-                        fieldName,
-                        fieldValue,
-                        histogram,
-                      },
-                    ],
-                    version
-                  )
-                );
-              }
-            }, MAX_CONCURRENT_QUERIES);
-
-            fieldValueHistogramQueue.push(significantTerms);
-            await fieldValueHistogramQueue.drain();
+          // Step 4: Smart gropuing
+          if (stateHandler.groupingEnabled()) {
+            await analysis.groupingHandler(
+              significantCategories,
+              significantTerms,
+              overallTimeSeries
+            );
           }
 
-          // histograms for text field patterns
-          if (
-            overallTimeSeries !== undefined &&
-            significantCategories.length > 0 &&
-            !request.body.overrides?.regroupOnly
-          ) {
-            const significantCategoriesHistogramQueries = significantCategories.map((d) => {
-              const histogramQuery = getHistogramQuery(request.body);
-              const categoryQuery = getCategoryQuery(d.fieldName, [
-                { key: `${d.key}`, count: d.doc_count, examples: [] },
-              ]);
-              if (Array.isArray(histogramQuery.bool?.filter)) {
-                histogramQuery.bool?.filter?.push(categoryQuery);
-              }
-              return histogramQuery;
-            });
-
-            for (const [i, histogramQuery] of significantCategoriesHistogramQueries.entries()) {
-              const cp = significantCategories[i];
-              let catTimeSeries: NumericChartData;
-
-              try {
-                catTimeSeries = (
-                  (await fetchHistogramsForFields(
-                    client,
-                    request.body.index,
-                    histogramQuery,
-                    // fields
-                    [
-                      {
-                        fieldName: request.body.timeFieldName,
-                        type: KBN_FIELD_TYPES.DATE,
-                        interval: overallTimeSeries.interval,
-                        min: overallTimeSeries.stats[0],
-                        max: overallTimeSeries.stats[1],
-                      },
-                    ],
-                    // samplerShardSize
-                    -1,
-                    undefined,
-                    abortSignal,
-                    sampleProbability,
-                    RANDOM_SAMPLER_SEED
-                  )) as [NumericChartData]
-                )[0];
-              } catch (e) {
-                logger.error(
-                  `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${
-                    cp.fieldValue
-                  }", got: \n${e.toString()}`
-                );
-                pushError(
-                  `Failed to fetch the histogram data for field/value pair "${cp.fieldName}:${cp.fieldValue}".`
-                );
-                return;
-              }
-
-              const histogram: SignificantTermHistogramItem[] =
-                overallTimeSeries.data.map((o) => {
-                  const current = catTimeSeries.data.find(
-                    (d1) => d1.key_as_string === o.key_as_string
-                  ) ?? {
-                    doc_count: 0,
-                  };
+          stateHandler.loaded(PROGRESS_STEP_HISTOGRAMS_GROUPS, false);
 
-                  if (version === '1') {
-                    return {
-                      key: o.key,
-                      key_as_string: o.key_as_string ?? '',
-                      doc_count_significant_term: current.doc_count,
-                      doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                    };
-                  }
-
-                  return {
-                    key: o.key,
-                    key_as_string: o.key_as_string ?? '',
-                    doc_count_significant_item: current.doc_count,
-                    doc_count_overall: Math.max(0, o.doc_count - current.doc_count),
-                  };
-                }) ?? [];
-
-              const { fieldName, fieldValue } = cp;
-
-              loaded += (1 / fieldValuePairsCount) * PROGRESS_STEP_HISTOGRAMS;
-              pushHistogramDataLoadingState();
-              push(
-                addSignificantTermsHistogramAction(
-                  [
-                    {
-                      fieldName,
-                      fieldValue,
-                      histogram,
-                    },
-                  ],
-                  version
-                )
-              );
-            }
-          }
+          // Step 5: Histograms
+          await analysis.histogramHandler(
+            fieldValuePairsCount,
+            significantCategories,
+            significantTerms,
+            overallTimeSeries
+          );
 
-          endWithUpdatedLoadingState();
+          responseStream.endWithUpdatedLoadingState();
         } catch (e) {
           if (!isRequestAbortedError(e)) {
             logger.error(`Log Rate Analysis failed to finish, got: \n${e.toString()}`);
-            pushError(`Log Rate Analysis failed to finish.`);
+            responseStream.pushError(`Log Rate Analysis failed to finish.`);
           }
-          end();
+          responseStream.end();
         }
       }
 
diff --git a/x-pack/plugins/aiops/tsconfig.json b/x-pack/plugins/aiops/tsconfig.json
index 67e8908f5c4213..66d996fe0b0020 100644
--- a/x-pack/plugins/aiops/tsconfig.json
+++ b/x-pack/plugins/aiops/tsconfig.json
@@ -66,6 +66,7 @@
     "@kbn/ml-chi2test",
     "@kbn/usage-collection-plugin",
     "@kbn/analytics",
+    "@kbn/core-http-server",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts b/x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts
index e471dd3cea5308..751f2e8c387807 100644
--- a/x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts
+++ b/x-pack/plugins/alerting/common/routes/rule/apis/create/schemas/v1.ts
@@ -8,6 +8,7 @@
 import { schema } from '@kbn/config-schema';
 import { validateDurationV1, validateHoursV1, validateTimezoneV1 } from '../../../validation';
 import { notifyWhenSchemaV1 } from '../../../response';
+import { filterStateStore } from '../../../common/constants/v1';
 
 export const actionFrequencySchema = schema.object({
   summary: schema.boolean(),
@@ -23,7 +24,14 @@ export const actionAlertsFilterSchema = schema.object({
         schema.object({
           query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
           meta: schema.recordOf(schema.string(), schema.any()),
-          state$: schema.maybe(schema.object({ store: schema.string() })),
+          $state: schema.maybe(
+            schema.object({
+              store: schema.oneOf([
+                schema.literal(filterStateStore.APP_STATE),
+                schema.literal(filterStateStore.GLOBAL_STATE),
+              ]),
+            })
+          ),
         })
       ),
       dsl: schema.maybe(schema.string()),
@@ -63,6 +71,7 @@ export const actionSchema = schema.object({
   params: schema.recordOf(schema.string(), schema.maybe(schema.any()), { defaultValue: {} }),
   frequency: schema.maybe(actionFrequencySchema),
   alerts_filter: schema.maybe(actionAlertsFilterSchema),
+  use_alert_data_for_template: schema.maybe(schema.boolean()),
 });
 
 export const createBodySchema = schema.object({
diff --git a/x-pack/plugins/alerting/common/routes/rule/common/constants/v1.ts b/x-pack/plugins/alerting/common/routes/rule/common/constants/v1.ts
index fbeb08ba6bc7f0..3bf7208efe37f2 100644
--- a/x-pack/plugins/alerting/common/routes/rule/common/constants/v1.ts
+++ b/x-pack/plugins/alerting/common/routes/rule/common/constants/v1.ts
@@ -43,6 +43,11 @@ export const ruleExecutionStatusWarningReason = {
   MAX_QUEUED_ACTIONS: 'maxQueuedActions',
 } as const;
 
+export const filterStateStore = {
+  APP_STATE: 'appState',
+  GLOBAL_STATE: 'globalState',
+} as const;
+
 export type RuleNotifyWhen = typeof ruleNotifyWhen[keyof typeof ruleNotifyWhen];
 export type RuleLastRunOutcomeValues =
   typeof ruleLastRunOutcomeValues[keyof typeof ruleLastRunOutcomeValues];
@@ -52,3 +57,4 @@ export type RuleExecutionStatusErrorReason =
   typeof ruleExecutionStatusErrorReason[keyof typeof ruleExecutionStatusErrorReason];
 export type RuleExecutionStatusWarningReason =
   typeof ruleExecutionStatusWarningReason[keyof typeof ruleExecutionStatusWarningReason];
+export type FilterStateStore = typeof filterStateStore[keyof typeof filterStateStore];
diff --git a/x-pack/plugins/alerting/common/routes/rule/common/index.ts b/x-pack/plugins/alerting/common/routes/rule/common/index.ts
index 5989a3a993e7a5..669bfc484070af 100644
--- a/x-pack/plugins/alerting/common/routes/rule/common/index.ts
+++ b/x-pack/plugins/alerting/common/routes/rule/common/index.ts
@@ -11,6 +11,7 @@ export {
   ruleExecutionStatusValues,
   ruleExecutionStatusErrorReason,
   ruleExecutionStatusWarningReason,
+  filterStateStore,
 } from './constants/latest';
 
 export type {
@@ -19,6 +20,7 @@ export type {
   RuleExecutionStatusValues,
   RuleExecutionStatusErrorReason,
   RuleExecutionStatusWarningReason,
+  FilterStateStore,
 } from './constants/latest';
 
 export {
@@ -27,6 +29,7 @@ export {
   ruleExecutionStatusValues as ruleExecutionStatusValuesV1,
   ruleExecutionStatusErrorReason as ruleExecutionStatusErrorReasonV1,
   ruleExecutionStatusWarningReason as ruleExecutionStatusWarningReasonV1,
+  filterStateStore as filterStateStoreV1,
 } from './constants/v1';
 
 export type {
@@ -35,4 +38,5 @@ export type {
   RuleExecutionStatusValues as RuleExecutionStatusValuesV1,
   RuleExecutionStatusErrorReason as RuleExecutionStatusErrorReasonV1,
   RuleExecutionStatusWarningReason as RuleExecutionStatusWarningReasonV1,
+  FilterStateStore as FilterStateStoreV1,
 } from './constants/v1';
diff --git a/x-pack/plugins/alerting/common/routes/rule/response/schemas/v1.ts b/x-pack/plugins/alerting/common/routes/rule/response/schemas/v1.ts
index fe02146c5ef620..0e043aa2176677 100644
--- a/x-pack/plugins/alerting/common/routes/rule/response/schemas/v1.ts
+++ b/x-pack/plugins/alerting/common/routes/rule/response/schemas/v1.ts
@@ -13,6 +13,7 @@ import {
   ruleExecutionStatusErrorReason as ruleExecutionStatusErrorReasonV1,
   ruleExecutionStatusWarningReason as ruleExecutionStatusWarningReasonV1,
   ruleLastRunOutcomeValues as ruleLastRunOutcomeValuesV1,
+  filterStateStore as filterStateStoreV1,
 } from '../../common/constants/v1';
 import { validateNotifyWhenV1 } from '../../validation';
 
@@ -47,7 +48,14 @@ const actionAlertsFilterSchema = schema.object({
         schema.object({
           query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
           meta: schema.recordOf(schema.string(), schema.any()),
-          state$: schema.maybe(schema.object({ store: schema.string() })),
+          $state: schema.maybe(
+            schema.object({
+              store: schema.oneOf([
+                schema.literal(filterStateStoreV1.APP_STATE),
+                schema.literal(filterStateStoreV1.GLOBAL_STATE),
+              ]),
+            })
+          ),
         })
       ),
     })
diff --git a/x-pack/plugins/alerting/common/rule.ts b/x-pack/plugins/alerting/common/rule.ts
index ff74752df86950..da3788d534598d 100644
--- a/x-pack/plugins/alerting/common/rule.ts
+++ b/x-pack/plugins/alerting/common/rule.ts
@@ -116,6 +116,7 @@ export interface RuleAction {
   params: RuleActionParams;
   frequency?: RuleActionFrequency;
   alertsFilter?: AlertsFilter;
+  useAlertDataForTemplate?: boolean;
 }
 
 export interface RuleLastRun {
diff --git a/x-pack/plugins/alerting/server/alert/alert.ts b/x-pack/plugins/alerting/server/alert/alert.ts
index ee8c48a18447bb..835b8db17a8930 100644
--- a/x-pack/plugins/alerting/server/alert/alert.ts
+++ b/x-pack/plugins/alerting/server/alert/alert.ts
@@ -6,6 +6,7 @@
  */
 
 import { v4 as uuidV4 } from 'uuid';
+import { AADAlert } from '@kbn/alerts-as-data-utils';
 import { get, isEmpty } from 'lodash';
 import { MutableAlertInstanceMeta } from '@kbn/alerting-state-types';
 import { ALERT_UUID } from '@kbn/rule-data-utils';
@@ -36,7 +37,7 @@ export type PublicAlert<
   Context extends AlertInstanceContext = AlertInstanceContext,
   ActionGroupIds extends string = DefaultActionGroupId
 > = Pick<
-  Alert<State, Context, ActionGroupIds>,
+  Alert<State, Context, ActionGroupIds, AADAlert>,
   | 'getContext'
   | 'getState'
   | 'getUuid'
@@ -50,13 +51,15 @@ export type PublicAlert<
 export class Alert<
   State extends AlertInstanceState = AlertInstanceState,
   Context extends AlertInstanceContext = AlertInstanceContext,
-  ActionGroupIds extends string = never
+  ActionGroupIds extends string = never,
+  AlertAsData extends AADAlert = AADAlert
 > {
   private scheduledExecutionOptions?: ScheduledExecutionOptions<State, Context, ActionGroupIds>;
   private meta: MutableAlertInstanceMeta;
   private state: State;
   private context: Context;
   private readonly id: string;
+  private alertAsData: AlertAsData | undefined;
 
   constructor(id: string, { state, meta = {} }: RawAlertInstance = {}) {
     this.id = id;
@@ -78,6 +81,18 @@ export class Alert<
     return this.meta.uuid!;
   }
 
+  isAlertAsData() {
+    return this.alertAsData !== undefined;
+  }
+
+  setAlertAsData(alertAsData: AlertAsData) {
+    this.alertAsData = alertAsData;
+  }
+
+  getAlertAsData() {
+    return this.alertAsData;
+  }
+
   getStart(): string | null {
     return this.state.start ? `${this.state.start}` : null;
   }
diff --git a/x-pack/plugins/alerting/server/application/rule/constants.ts b/x-pack/plugins/alerting/server/application/rule/constants.ts
index bc75d91375ecbf..0881868d9db8ff 100644
--- a/x-pack/plugins/alerting/server/application/rule/constants.ts
+++ b/x-pack/plugins/alerting/server/application/rule/constants.ts
@@ -42,3 +42,8 @@ export const ruleExecutionStatusWarningReason = {
   MAX_ALERTS: 'maxAlerts',
   MAX_QUEUED_ACTIONS: 'maxQueuedActions',
 } as const;
+
+export const filterStateStore = {
+  APP_STATE: 'appState',
+  GLOBAL_STATE: 'globalState',
+} as const;
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
index d774a80ae4ebc1..74dd0775d0c222 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
@@ -23,7 +23,7 @@ import {
 } from '../../../../rules_client/lib';
 import { generateAPIKeyName, apiKeyAsRuleDomainProperties } from '../../../../rules_client/common';
 import { ruleAuditEvent, RuleAuditAction } from '../../../../rules_client/common/audit_events';
-import { RulesClientContext } from '../../../../rules_client/types';
+import { RulesClientContext, NormalizedAlertAction } from '../../../../rules_client/types';
 import { RuleDomain, RuleParams } from '../../types';
 import { SanitizedRule } from '../../../../types';
 import {
@@ -55,7 +55,11 @@ export async function createRule<Params extends RuleParams = never>(
 ): Promise<SanitizedRule<Params>> {
   const { data: initialData, options, allowMissingConnectorSecrets } = createParams;
 
-  const data = { ...initialData, actions: addGeneratedActionValues(initialData.actions) };
+  // TODO (http-versioning): Remove this cast when we fix addGeneratedActionValues
+  const data = {
+    ...initialData,
+    actions: addGeneratedActionValues(initialData.actions as NormalizedAlertAction[]),
+  };
 
   const id = options?.id || SavedObjectsUtils.generateId();
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/create/schemas/create_rule_data_schema.ts b/x-pack/plugins/alerting/server/application/rule/methods/create/schemas/create_rule_data_schema.ts
index ce51e88c5ce73c..b7e55919969572 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/create/schemas/create_rule_data_schema.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/create/schemas/create_rule_data_schema.ts
@@ -35,6 +35,7 @@ export const createRuleDataSchema = schema.object({
       ),
       uuid: schema.maybe(schema.string()),
       alertsFilter: schema.maybe(actionAlertsFilterSchema),
+      useAlertDataForTemplate: schema.maybe(schema.boolean()),
     }),
     { defaultValue: [] }
   ),
diff --git a/x-pack/plugins/alerting/server/application/rule/schemas/action_schemas.ts b/x-pack/plugins/alerting/server/application/rule/schemas/action_schemas.ts
index f123466eca1ab3..579f41adb0424c 100644
--- a/x-pack/plugins/alerting/server/application/rule/schemas/action_schemas.ts
+++ b/x-pack/plugins/alerting/server/application/rule/schemas/action_schemas.ts
@@ -7,6 +7,7 @@
 
 import { schema } from '@kbn/config-schema';
 import { notifyWhenSchema } from './notify_when_schema';
+import { filterStateStore } from '../constants';
 
 export const actionParamsSchema = schema.recordOf(schema.string(), schema.maybe(schema.any()));
 
@@ -14,7 +15,14 @@ const actionAlertsFilterQueryFiltersSchema = schema.arrayOf(
   schema.object({
     query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
     meta: schema.recordOf(schema.string(), schema.any()),
-    state$: schema.maybe(schema.object({ store: schema.string() })),
+    $state: schema.maybe(
+      schema.object({
+        store: schema.oneOf([
+          schema.literal(filterStateStore.APP_STATE),
+          schema.literal(filterStateStore.GLOBAL_STATE),
+        ]),
+      })
+    ),
   })
 );
 
@@ -65,6 +73,7 @@ export const actionDomainSchema = schema.object({
   params: actionParamsSchema,
   frequency: schema.maybe(actionFrequencySchema),
   alertsFilter: schema.maybe(actionDomainAlertsFilterSchema),
+  useAlertDataAsTemplate: schema.maybe(schema.boolean()),
 });
 
 /**
@@ -89,4 +98,5 @@ export const actionSchema = schema.object({
   params: actionParamsSchema,
   frequency: schema.maybe(actionFrequencySchema),
   alertsFilter: schema.maybe(actionAlertsFilterSchema),
+  useAlertDataForTemplate: schema.maybe(schema.boolean()),
 });
diff --git a/x-pack/plugins/alerting/server/application/rule/types/rule.ts b/x-pack/plugins/alerting/server/application/rule/types/rule.ts
index 04e37a125aa403..d8dbabb72b23b3 100644
--- a/x-pack/plugins/alerting/server/application/rule/types/rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/types/rule.ts
@@ -12,6 +12,7 @@ import {
   ruleExecutionStatusValues,
   ruleExecutionStatusErrorReason,
   ruleExecutionStatusWarningReason,
+  filterStateStore,
 } from '../constants';
 import {
   ruleParamsSchema,
@@ -33,6 +34,7 @@ export type RuleExecutionStatusErrorReason =
   typeof ruleExecutionStatusErrorReason[keyof typeof ruleExecutionStatusErrorReason];
 export type RuleExecutionStatusWarningReason =
   typeof ruleExecutionStatusWarningReason[keyof typeof ruleExecutionStatusWarningReason];
+export type FilterStateStore = typeof filterStateStore[keyof typeof filterStateStore];
 
 export type RuleParams = TypeOf<typeof ruleParamsSchema>;
 export type RuleSnoozeSchedule = TypeOf<typeof snoozeScheduleSchema>;
diff --git a/x-pack/plugins/alerting/server/index.ts b/x-pack/plugins/alerting/server/index.ts
index 200fe93931f86d..b6962f65b4ab8e 100644
--- a/x-pack/plugins/alerting/server/index.ts
+++ b/x-pack/plugins/alerting/server/index.ts
@@ -7,7 +7,6 @@
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { RulesClient as RulesClientClass } from './rules_client';
-import { AlertingPlugin } from './plugin';
 import { configSchema } from './config';
 import { AlertsConfigType } from './types';
 
@@ -70,7 +69,10 @@ export {
 } from './alerts_service';
 export { getDataStreamAdapter } from './alerts_service/lib/data_stream_adapter';
 
-export const plugin = (initContext: PluginInitializerContext) => new AlertingPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { AlertingPlugin } = await import('./plugin');
+  return new AlertingPlugin(initContext);
+};
 
 export const config: PluginConfigDescriptor<AlertsConfigType> = {
   schema: configSchema,
diff --git a/x-pack/plugins/alerting/server/raw_rule_schema.ts b/x-pack/plugins/alerting/server/raw_rule_schema.ts
index 65d4b48ec7d661..4072b15b19210d 100644
--- a/x-pack/plugins/alerting/server/raw_rule_schema.ts
+++ b/x-pack/plugins/alerting/server/raw_rule_schema.ts
@@ -169,7 +169,7 @@ const rawRuleAlertsFilterSchema = schema.object({
             params: schema.maybe(schema.recordOf(schema.string(), schema.any())), // better type?
             value: schema.maybe(schema.string()),
           }),
-          state$: schema.maybe(
+          $state: schema.maybe(
             schema.object({
               store: schema.oneOf([schema.literal('appState'), schema.literal('globalState')]),
             })
diff --git a/x-pack/plugins/alerting/server/routes/lib/actions_schema.ts b/x-pack/plugins/alerting/server/routes/lib/actions_schema.ts
index 9d6f89e070c3a1..76661b2d33ff23 100644
--- a/x-pack/plugins/alerting/server/routes/lib/actions_schema.ts
+++ b/x-pack/plugins/alerting/server/routes/lib/actions_schema.ts
@@ -6,6 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { FilterStateStore } from '@kbn/es-query';
 import { validateTimezone } from './validate_timezone';
 import { validateDurationSchema } from '../../lib';
 import { validateHours } from './validate_hours';
@@ -36,7 +37,14 @@ export const actionsSchema = schema.arrayOf(
               schema.object({
                 query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
                 meta: schema.recordOf(schema.string(), schema.any()),
-                state$: schema.maybe(schema.object({ store: schema.string() })),
+                $state: schema.maybe(
+                  schema.object({
+                    store: schema.oneOf([
+                      schema.literal(FilterStateStore.APP_STATE),
+                      schema.literal(FilterStateStore.GLOBAL_STATE),
+                    ]),
+                  })
+                ),
               })
             ),
             dsl: schema.maybe(schema.string()),
@@ -68,6 +76,7 @@ export const actionsSchema = schema.arrayOf(
         ),
       })
     ),
+    use_alert_data_for_template: schema.maybe(schema.boolean()),
   }),
   { defaultValue: [] }
 );
diff --git a/x-pack/plugins/alerting/server/routes/lib/rewrite_actions.ts b/x-pack/plugins/alerting/server/routes/lib/rewrite_actions.ts
index 2c2b0853d181b4..16309485c18a13 100644
--- a/x-pack/plugins/alerting/server/routes/lib/rewrite_actions.ts
+++ b/x-pack/plugins/alerting/server/routes/lib/rewrite_actions.ts
@@ -15,20 +15,28 @@ export const rewriteActionsReq = (
 ): NormalizedAlertAction[] => {
   if (!actions) return [];
 
-  return actions.map(({ frequency, alerts_filter: alertsFilter, ...action }) => {
-    return {
-      ...action,
-      ...(frequency
-        ? {
-            frequency: {
-              ...omit(frequency, 'notify_when'),
-              notifyWhen: frequency.notify_when,
-            },
-          }
-        : {}),
-      ...(alertsFilter ? { alertsFilter } : {}),
-    };
-  });
+  return actions.map(
+    ({
+      frequency,
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...action
+    }) => {
+      return {
+        ...action,
+        useAlertDataForTemplate,
+        ...(frequency
+          ? {
+              frequency: {
+                ...omit(frequency, 'notify_when'),
+                notifyWhen: frequency.notify_when,
+              },
+            }
+          : {}),
+        ...(alertsFilter ? { alertsFilter } : {}),
+      };
+    }
+  );
 };
 
 export const rewriteActionsRes = (actions?: RuleAction[]) => {
@@ -37,14 +45,17 @@ export const rewriteActionsRes = (actions?: RuleAction[]) => {
     notify_when: notifyWhen,
   });
   if (!actions) return [];
-  return actions.map(({ actionTypeId, frequency, alertsFilter, ...action }) => ({
-    ...action,
-    connector_type_id: actionTypeId,
-    ...(frequency ? { frequency: rewriteFrequency(frequency) } : {}),
-    ...(alertsFilter
-      ? {
-          alerts_filter: alertsFilter,
-        }
-      : {}),
-  }));
+  return actions.map(
+    ({ actionTypeId, frequency, alertsFilter, useAlertDataForTemplate, ...action }) => ({
+      ...action,
+      connector_type_id: actionTypeId,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...(frequency ? { frequency: rewriteFrequency(frequency) } : {}),
+      ...(alertsFilter
+        ? {
+            alerts_filter: alertsFilter,
+          }
+        : {}),
+    })
+  );
 };
diff --git a/x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.test.ts b/x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.test.ts
index 1b1ed454c52076..9a77d46fb9208c 100644
--- a/x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.test.ts
+++ b/x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.test.ts
@@ -114,6 +114,7 @@ describe('bulkEditRulesRoute', () => {
                   foo: true,
                 },
                 uuid: '123-456',
+                use_alert_data_for_template: false,
               },
             ],
           }),
diff --git a/x-pack/plugins/alerting/server/routes/rule/apis/create/create_rule_route.test.ts b/x-pack/plugins/alerting/server/routes/rule/apis/create/create_rule_route.test.ts
index e952a72ec38590..a12b8ee5e177c2 100644
--- a/x-pack/plugins/alerting/server/routes/rule/apis/create/create_rule_route.test.ts
+++ b/x-pack/plugins/alerting/server/routes/rule/apis/create/create_rule_route.test.ts
@@ -124,6 +124,7 @@ describe('createRuleRoute', () => {
         },
         connector_type_id: 'test',
         uuid: '123-456',
+        use_alert_data_for_template: false,
       },
     ],
   };
@@ -198,6 +199,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -314,6 +316,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -431,6 +434,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
@@ -548,6 +552,7 @@ describe('createRuleRoute', () => {
                 "params": Object {
                   "foo": true,
                 },
+                "useAlertDataForTemplate": undefined,
               },
             ],
             "alertTypeId": "1",
diff --git a/x-pack/plugins/alerting/server/routes/rule/apis/create/transforms/transform_create_body/v1.ts b/x-pack/plugins/alerting/server/routes/rule/apis/create/transforms/transform_create_body/v1.ts
index c6b29f4577f4c3..a9e9a25d05c95f 100644
--- a/x-pack/plugins/alerting/server/routes/rule/apis/create/transforms/transform_create_body/v1.ts
+++ b/x-pack/plugins/alerting/server/routes/rule/apis/create/transforms/transform_create_body/v1.ts
@@ -15,25 +15,33 @@ import type { RuleParams } from '../../../../../../application/rule/types';
 const transformCreateBodyActions = (actions: CreateRuleActionV1[]): CreateRuleData['actions'] => {
   if (!actions) return [];
 
-  return actions.map(({ frequency, alerts_filter: alertsFilter, ...action }) => {
-    return {
-      group: action.group,
-      id: action.id,
-      params: action.params,
-      actionTypeId: action.actionTypeId,
-      ...(action.uuid ? { uuid: action.uuid } : {}),
-      ...(frequency
-        ? {
-            frequency: {
-              summary: frequency.summary,
-              throttle: frequency.throttle,
-              notifyWhen: frequency.notify_when,
-            },
-          }
-        : {}),
-      ...(alertsFilter ? { alertsFilter } : {}),
-    };
-  });
+  return actions.map(
+    ({
+      frequency,
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...action
+    }) => {
+      return {
+        group: action.group,
+        id: action.id,
+        params: action.params,
+        actionTypeId: action.actionTypeId,
+        useAlertDataForTemplate,
+        ...(action.uuid ? { uuid: action.uuid } : {}),
+        ...(frequency
+          ? {
+              frequency: {
+                summary: frequency.summary,
+                throttle: frequency.throttle,
+                notifyWhen: frequency.notify_when,
+              },
+            }
+          : {}),
+        ...(alertsFilter ? { alertsFilter } : {}),
+      };
+    }
+  );
 };
 
 export const transformCreateBody = <Params extends RuleParams = never>(
diff --git a/x-pack/plugins/alerting/server/routes/rule/apis/resolve/resolve_rule_route.test.ts b/x-pack/plugins/alerting/server/routes/rule/apis/resolve/resolve_rule_route.test.ts
index e83cd05b02edd8..929dc6ad2ccc1c 100644
--- a/x-pack/plugins/alerting/server/routes/rule/apis/resolve/resolve_rule_route.test.ts
+++ b/x-pack/plugins/alerting/server/routes/rule/apis/resolve/resolve_rule_route.test.ts
@@ -45,6 +45,7 @@ describe('resolveRuleRoute', () => {
           foo: true,
         },
         uuid: '123-456',
+        useAlertDataForTemplate: false,
       },
     ],
     consumer: 'bar',
@@ -101,6 +102,7 @@ describe('resolveRuleRoute', () => {
         params: mockedRule.actions[0].params,
         connector_type_id: mockedRule.actions[0].actionTypeId,
         uuid: mockedRule.actions[0].uuid,
+        use_alert_data_for_template: mockedRule.actions[0].useAlertDataForTemplate,
       },
     ],
     outcome: 'aliasMatch',
diff --git a/x-pack/plugins/alerting/server/routes/rule/transforms/transform_rule_to_rule_response/v1.ts b/x-pack/plugins/alerting/server/routes/rule/transforms/transform_rule_to_rule_response/v1.ts
index 74508cec9a6405..3968e0e2716209 100644
--- a/x-pack/plugins/alerting/server/routes/rule/transforms/transform_rule_to_rule_response/v1.ts
+++ b/x-pack/plugins/alerting/server/routes/rule/transforms/transform_rule_to_rule_response/v1.ts
@@ -49,11 +49,21 @@ export const transformRuleToRuleResponse = <Params extends RuleParams = never>(
   consumer: rule.consumer,
   schedule: rule.schedule,
   actions: rule.actions.map(
-    ({ group, id, actionTypeId, params, frequency, uuid, alertsFilter }) => ({
+    ({
+      group,
+      id,
+      actionTypeId,
+      params,
+      frequency,
+      uuid,
+      alertsFilter,
+      useAlertDataForTemplate,
+    }) => ({
       group,
       id,
       params,
       connector_type_id: actionTypeId,
+      use_alert_data_for_template: useAlertDataForTemplate ?? false,
       ...(frequency
         ? {
             frequency: {
diff --git a/x-pack/plugins/alerting/server/routes/update_rule.test.ts b/x-pack/plugins/alerting/server/routes/update_rule.test.ts
index 5a4b3a19c0d7ce..87901feab64cf4 100644
--- a/x-pack/plugins/alerting/server/routes/update_rule.test.ts
+++ b/x-pack/plugins/alerting/server/routes/update_rule.test.ts
@@ -132,6 +132,7 @@ describe('updateRuleRoute', () => {
                 "params": Object {
                   "baz": true,
                 },
+                "useAlertDataForTemplate": undefined,
                 "uuid": "1234-5678",
               },
             ],
diff --git a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
index 288a4126c25a25..dd1caa21a240cb 100644
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.ts
@@ -20,12 +20,16 @@ import { ActionsClient } from '@kbn/actions-plugin/server/actions_client';
 import { chunk } from 'lodash';
 import { GetSummarizedAlertsParams, IAlertsClient } from '../alerts_client/types';
 import { AlertingEventLogger } from '../lib/alerting_event_logger/alerting_event_logger';
-import { parseDuration, CombinedSummarizedAlerts, ThrottledActions } from '../types';
+import { AlertHit, parseDuration, CombinedSummarizedAlerts, ThrottledActions } from '../types';
 import { RuleRunMetricsStore } from '../lib/rule_run_metrics_store';
 import { injectActionParams } from './inject_action_params';
 import { Executable, ExecutionHandlerOptions, RuleTaskInstance } from './types';
 import { TaskRunnerContext } from './task_runner_factory';
-import { transformActionParams, transformSummaryActionParams } from './transform_action_params';
+import {
+  transformActionParams,
+  TransformActionParamsOptions,
+  transformSummaryActionParams,
+} from './transform_action_params';
 import { Alert } from '../alert';
 import { NormalizedRuleType } from '../rule_type_registry';
 import {
@@ -292,33 +296,40 @@ export class ExecutionHandler<
           };
         } else {
           const ruleUrl = this.buildRuleUrl(spaceId);
+          const executableAlert = alert!;
+          const transformActionParamsOptions: TransformActionParamsOptions = {
+            actionsPlugin,
+            alertId: ruleId,
+            alertType: this.ruleType.id,
+            actionTypeId,
+            alertName: this.rule.name,
+            spaceId,
+            tags: this.rule.tags,
+            alertInstanceId: executableAlert.getId(),
+            alertUuid: executableAlert.getUuid(),
+            alertActionGroup: actionGroup,
+            alertActionGroupName: this.ruleTypeActionGroups!.get(actionGroup)!,
+            context: executableAlert.getContext(),
+            actionId: action.id,
+            state: executableAlert.getState(),
+            kibanaBaseUrl: this.taskRunnerContext.kibanaBaseUrl,
+            alertParams: this.rule.params,
+            actionParams: action.params,
+            flapping: executableAlert.getFlapping(),
+            ruleUrl: ruleUrl?.absoluteUrl,
+          };
+
+          if (executableAlert.isAlertAsData()) {
+            transformActionParamsOptions.aadAlert = executableAlert.getAlertAsData();
+          }
+
           const actionToRun = {
             ...action,
             params: injectActionParams({
               actionTypeId,
               ruleUrl,
               ruleName: this.rule.name,
-              actionParams: transformActionParams({
-                actionsPlugin,
-                alertId: ruleId,
-                alertType: this.ruleType.id,
-                actionTypeId,
-                alertName: this.rule.name,
-                spaceId,
-                tags: this.rule.tags,
-                alertInstanceId: alert.getId(),
-                alertUuid: alert.getUuid(),
-                alertActionGroup: actionGroup,
-                alertActionGroupName: this.ruleTypeActionGroups!.get(actionGroup)!,
-                context: alert.getContext(),
-                actionId: action.id,
-                state: alert.getState(),
-                kibanaBaseUrl: this.taskRunnerContext.kibanaBaseUrl,
-                alertParams: this.rule.params,
-                actionParams: action.params,
-                flapping: alert.getFlapping(),
-                ruleUrl: ruleUrl?.absoluteUrl,
-              }),
+              actionParams: transformActionParams(transformActionParamsOptions),
             }),
           };
 
@@ -570,7 +581,6 @@ export class ExecutionHandler<
     for (const action of this.rule.actions) {
       const alertsArray = Object.entries(alerts);
       let summarizedAlerts = null;
-
       if (this.shouldGetSummarizedAlerts({ action, throttledSummaryActions })) {
         summarizedAlerts = await this.getSummarizedAlerts({
           action,
@@ -634,6 +644,15 @@ export class ExecutionHandler<
           continue;
         }
 
+        if (summarizedAlerts) {
+          const alertAsData = summarizedAlerts.all.data.find(
+            (alertHit: AlertHit) => alertHit._id === alert.getUuid()
+          );
+          if (alertAsData) {
+            alert.setAlertAsData(alertAsData);
+          }
+        }
+
         if (action.group === actionGroup && !this.isAlertMuted(alertId)) {
           if (
             this.isRecoveredAlert(action.group) ||
@@ -667,12 +686,13 @@ export class ExecutionHandler<
       }
       return false;
     }
-
+    if (action.useAlertDataForTemplate) {
+      return true;
+    }
     // we fetch summarizedAlerts to filter alerts in memory as well
     if (!isSummaryAction(action) && !action.alertsFilter) {
       return false;
     }
-
     if (
       isSummaryAction(action) &&
       isSummaryActionThrottled({
diff --git a/x-pack/plugins/alerting/server/task_runner/fixtures.ts b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
index 163b9415c7e5d0..490584e03c87f7 100644
--- a/x-pack/plugins/alerting/server/task_runner/fixtures.ts
+++ b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
@@ -355,7 +355,7 @@ export const generateRunnerResult = ({
   alertInstances = {},
   alertRecoveredInstances = {},
   summaryActions = {},
-  hasError = false,
+  taskRunError,
 }: GeneratorParams = {}) => {
   return {
     monitoring: {
@@ -388,7 +388,7 @@ export const generateRunnerResult = ({
       ...(state && { previousStartedAt: new Date('1970-01-01T00:00:00.000Z').toISOString() }),
       ...(state && { summaryActions }),
     },
-    hasError,
+    taskRunError,
   };
 };
 
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
index 03cf55f58606cf..c066ac73f0ac08 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
@@ -1826,6 +1826,8 @@ describe('Task Runner', () => {
   });
 
   test('recovers gracefully when the RuleType executor throws an exception', async () => {
+    const taskRunError = new Error(GENERIC_ERROR_MESSAGE);
+
     ruleType.executor.mockImplementation(
       async ({
         services: executorServices,
@@ -1837,7 +1839,7 @@ describe('Task Runner', () => {
         string,
         RuleAlertData
       >) => {
-        throw new Error(GENERIC_ERROR_MESSAGE);
+        throw taskRunError;
       }
     );
 
@@ -1855,7 +1857,7 @@ describe('Task Runner', () => {
 
     const runnerResult = await taskRunner.run();
 
-    expect(runnerResult).toEqual(generateRunnerResult({ successRatio: 0, hasError: true }));
+    expect(runnerResult).toEqual(generateRunnerResult({ successRatio: 0, taskRunError }));
 
     testAlertingEventLogCalls({
       status: 'error',
@@ -1877,9 +1879,11 @@ describe('Task Runner', () => {
   });
 
   test('recovers gracefully when the Rule Task Runner throws an exception when loading rule to prepare for run', async () => {
+    const taskRunError = new Error(GENERIC_ERROR_MESSAGE);
+
     // used in loadIndirectParams() which is called to load rule data
     rulesClient.getAlertFromRaw.mockImplementation(() => {
-      throw new Error(GENERIC_ERROR_MESSAGE);
+      throw taskRunError;
     });
 
     const taskRunner = new TaskRunner({
@@ -1895,7 +1899,7 @@ describe('Task Runner', () => {
 
     const runnerResult = await taskRunner.run();
 
-    expect(runnerResult).toEqual(generateRunnerResult({ successRatio: 0, hasError: true }));
+    expect(runnerResult).toEqual(generateRunnerResult({ successRatio: 0, taskRunError }));
 
     testAlertingEventLogCalls({
       setRuleName: false,
@@ -1908,8 +1912,10 @@ describe('Task Runner', () => {
   });
 
   test('recovers gracefully when the Runner of a legacy Alert task which has no schedule throws an exception when fetching attributes', async () => {
-    rulesClient.get.mockImplementation(() => {
-      throw new Error(GENERIC_ERROR_MESSAGE);
+    const taskRunError = new TypeError(GENERIC_ERROR_MESSAGE);
+
+    encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockImplementation(() => {
+      throw taskRunError;
     });
 
     // legacy alerts used to run by returning a new `runAt` instead of using a schedule
@@ -1919,18 +1925,15 @@ describe('Task Runner', () => {
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: legacyTaskInstance,
-
       context: taskRunnerFactoryInitializerParams,
       inMemoryMetrics,
     });
     expect(AlertingEventLogger).toHaveBeenCalled();
 
-    encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(mockedRawRuleSO);
-
     const runnerResult = await taskRunner.run();
 
     expect(runnerResult).toEqual(
-      generateRunnerResult({ successRatio: 0, interval: '5m', hasError: true })
+      generateRunnerResult({ successRatio: 0, interval: '5m', taskRunError })
     );
     expect(mockUsageCounter.incrementCounter).not.toHaveBeenCalled();
   });
@@ -1977,10 +1980,6 @@ describe('Task Runner', () => {
   });
 
   test('avoids rescheduling a failed Alert Task Runner when it throws due to failing to fetch the alert', async () => {
-    rulesClient.get.mockImplementation(() => {
-      throw SavedObjectsErrorHelpers.createGenericNotFoundError('alert', '1');
-    });
-
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: {
@@ -1990,7 +1989,6 @@ describe('Task Runner', () => {
           spaceId: 'foo',
         },
       },
-
       context: taskRunnerFactoryInitializerParams,
       inMemoryMetrics,
     });
@@ -2021,10 +2019,6 @@ describe('Task Runner', () => {
   });
 
   test('reschedules for next schedule interval if es connectivity error encountered and schedule interval is less than connectivity retry', async () => {
-    rulesClient.get.mockImplementation(() => {
-      throw SavedObjectsErrorHelpers.createGenericNotFoundEsUnavailableError('alert', '1');
-    });
-
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: mockedTaskInstance,
@@ -2067,10 +2061,6 @@ describe('Task Runner', () => {
   });
 
   test('correctly logs warning when Alert Task Runner throws due to failing to fetch the alert in a space', async () => {
-    rulesClient.get.mockImplementation(() => {
-      throw SavedObjectsErrorHelpers.createGenericNotFoundError('alert', '1');
-    });
-
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: {
@@ -2607,6 +2597,7 @@ describe('Task Runner', () => {
   });
 
   test('successfully stores failure runs', async () => {
+    const taskRunError = new Error(GENERIC_ERROR_MESSAGE);
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: mockedTaskInstance,
@@ -2629,16 +2620,17 @@ describe('Task Runner', () => {
         string,
         RuleAlertData
       >) => {
-        throw new Error(GENERIC_ERROR_MESSAGE);
+        throw taskRunError;
       }
     );
     const runnerResult = await taskRunner.run();
     expect(runnerResult).toEqual(
-      generateRunnerResult({ successRatio: 0, success: false, hasError: true })
+      generateRunnerResult({ successRatio: 0, success: false, taskRunError })
     );
   });
 
   test('successfully stores the success ratio', async () => {
+    const taskRunError = new Error(GENERIC_ERROR_MESSAGE);
     const taskRunner = new TaskRunner({
       ruleType,
       taskInstance: mockedTaskInstance,
@@ -2665,7 +2657,7 @@ describe('Task Runner', () => {
         string,
         RuleAlertData
       >) => {
-        throw new Error(GENERIC_ERROR_MESSAGE);
+        throw taskRunError;
       }
     );
     const runnerResult = await taskRunner.run();
@@ -2674,7 +2666,7 @@ describe('Task Runner', () => {
       generateRunnerResult({
         successRatio: 0.75,
         history: [true, true, true, false],
-        hasError: true,
+        taskRunError,
       })
     );
   });
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 3cc9c2359c2720..76d12d820fa235 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -10,7 +10,12 @@ import { omit, some } from 'lodash';
 import { UsageCounter } from '@kbn/usage-collection-plugin/server';
 import { v4 as uuidv4 } from 'uuid';
 import { Logger } from '@kbn/core/server';
-import { ConcreteTaskInstance, throwUnrecoverableError } from '@kbn/task-manager-plugin/server';
+import {
+  ConcreteTaskInstance,
+  throwUnrecoverableError,
+  createTaskRunError,
+  TaskErrorSource,
+} from '@kbn/task-manager-plugin/server';
 import { nanosToMillis } from '@kbn/event-log-plugin/server';
 import { DEFAULT_NAMESPACE_STRING } from '@kbn/core-saved-objects-utils-server';
 import { ExecutionHandler, RunResult } from './execution_handler';
@@ -937,7 +942,9 @@ export class TaskRunner<
         return { interval: retryInterval };
       }),
       monitoring: this.ruleMonitoring.getMonitoring(),
-      hasError: isErr(schedule),
+      ...(isErr(schedule)
+        ? { taskRunError: createTaskRunError(schedule.error, TaskErrorSource.FRAMEWORK) }
+        : {}),
     };
   }
 
diff --git a/x-pack/plugins/alerting/server/task_runner/transform_action_params.ts b/x-pack/plugins/alerting/server/task_runner/transform_action_params.ts
index 7076e1fc7e35ec..c9c55e07c3d757 100644
--- a/x-pack/plugins/alerting/server/task_runner/transform_action_params.ts
+++ b/x-pack/plugins/alerting/server/task_runner/transform_action_params.ts
@@ -6,6 +6,7 @@
  */
 
 import { PluginStartContract as ActionsPluginStartContract } from '@kbn/actions-plugin/server';
+import { AADAlert } from '@kbn/alerts-as-data-utils';
 import { mapKeys, snakeCase } from 'lodash/fp';
 import {
   RuleActionParams,
@@ -15,7 +16,7 @@ import {
   SanitizedRule,
 } from '../types';
 
-interface TransformActionParamsOptions {
+export interface TransformActionParamsOptions {
   actionsPlugin: ActionsPluginStartContract;
   alertId: string;
   alertType: string;
@@ -35,6 +36,7 @@ interface TransformActionParamsOptions {
   context: AlertInstanceContext;
   ruleUrl?: string;
   flapping: boolean;
+  aadAlert?: AADAlert;
 }
 
 interface SummarizedAlertsWithAll {
@@ -76,40 +78,45 @@ export function transformActionParams({
   alertParams,
   ruleUrl,
   flapping,
+  aadAlert,
 }: TransformActionParamsOptions): RuleActionParams {
   // when the list of variables we pass in here changes,
   // the UI will need to be updated as well; see:
   // x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.ts
-  const variables = {
-    alertId,
-    alertName,
-    spaceId,
-    tags,
-    alertInstanceId,
-    alertActionGroup,
-    alertActionGroupName,
-    context,
-    date: new Date().toISOString(),
-    state,
-    kibanaBaseUrl,
-    params: alertParams,
-    rule: {
-      params: alertParams,
-      id: alertId,
-      name: alertName,
-      type: alertType,
-      spaceId,
-      tags,
-      url: ruleUrl,
-    },
-    alert: {
-      id: alertInstanceId,
-      uuid: alertUuid,
-      actionGroup: alertActionGroup,
-      actionGroupName: alertActionGroupName,
-      flapping,
-    },
-  };
+  const variables =
+    aadAlert !== undefined
+      ? aadAlert
+      : {
+          alertId,
+          alertName,
+          spaceId,
+          tags,
+          alertInstanceId,
+          alertActionGroup,
+          alertActionGroupName,
+          context,
+          date: new Date().toISOString(),
+          state,
+          kibanaBaseUrl,
+          params: alertParams,
+          rule: {
+            params: alertParams,
+            id: alertId,
+            name: alertName,
+            type: alertType,
+            spaceId,
+            tags,
+            url: ruleUrl,
+          },
+          alert: {
+            id: alertInstanceId,
+            uuid: alertUuid,
+            actionGroup: alertActionGroup,
+            actionGroupName: alertActionGroupName,
+            flapping,
+          },
+        };
+
   return actionsPlugin.renderActionParameterTemplates(
     actionTypeId,
     actionId,
diff --git a/x-pack/plugins/alerting/server/task_runner/types.ts b/x-pack/plugins/alerting/server/task_runner/types.ts
index 157723bd22400d..958ec20fe01365 100644
--- a/x-pack/plugins/alerting/server/task_runner/types.ts
+++ b/x-pack/plugins/alerting/server/task_runner/types.ts
@@ -6,7 +6,7 @@
  */
 
 import { KibanaRequest, Logger } from '@kbn/core/server';
-import { ConcreteTaskInstance } from '@kbn/task-manager-plugin/server';
+import { ConcreteTaskInstance, DecoratedError } from '@kbn/task-manager-plugin/server';
 import { PublicMethodsOf } from '@kbn/utility-types';
 import { ActionsClient } from '@kbn/actions-plugin/server/actions_client';
 import { IAlertsClient } from '../alerts_client/types';
@@ -33,7 +33,7 @@ export interface RuleTaskRunResult {
   state: RuleTaskState;
   monitoring: RuleMonitoring | undefined;
   schedule: IntervalSchedule | undefined;
-  hasError: boolean;
+  taskRunError?: DecoratedError;
 }
 
 // This is the state of the alerting task after rule execution, which includes run metrics plus the task state
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
index f6a665b512554c..e82a61cbd0cd1c 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
@@ -72,6 +72,11 @@ Array [
     "type": "boolean",
     "validationName": "(\\"true\\" | \\"false\\")",
   },
+  Object {
+    "key": "context_propagation_only",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
   Object {
     "key": "dedot_custom_metrics",
     "type": "boolean",
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
index 961dfd9ca8e888..08fd02770ba5b3 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
@@ -337,6 +337,26 @@ export const generalSettings: RawSettingDefinition[] = [
     excludeAgents: ['nodejs', 'rum-js', 'js-base'],
   },
 
+  {
+    key: 'context_propagation_only',
+    type: 'boolean',
+    defaultValue: 'false',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.context_propagation_only.label',
+      {
+        defaultMessage: 'Context Propagation Only',
+      }
+    ),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.context_propagation_only.description',
+      {
+        defaultMessage:
+          'When set to true, disables log sending, metrics and trace collection. Trace context propagation and log correlation will stay active.',
+      }
+    ),
+    includeAgents: ['java'],
+  },
+
   // SERVER_TIMEOUT
   {
     key: 'server_timeout',
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts
index 1bdbc9b4f5dc4e..7964332df8bf80 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts
@@ -75,6 +75,7 @@ describe('filterByAgent', () => {
           'profiling_inferred_spans_min_duration',
           'profiling_inferred_spans_sampling_interval',
           'recording',
+          'context_propagation_only',
           'sanitize_field_names',
           'server_timeout',
           'span_frames_min_duration',
diff --git a/x-pack/plugins/apm/public/components/routing/app_root/index.tsx b/x-pack/plugins/apm/public/components/routing/app_root/index.tsx
index 2af4d21028b801..e528d1625681c0 100644
--- a/x-pack/plugins/apm/public/components/routing/app_root/index.tsx
+++ b/x-pack/plugins/apm/public/components/routing/app_root/index.tsx
@@ -8,9 +8,9 @@
 import { APP_WRAPPER_CLASS } from '@kbn/core/public';
 import {
   KibanaContextProvider,
-  RedirectAppLinks,
   useUiSetting$,
 } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
 import { ObservabilityAIAssistantProvider } from '@kbn/observability-ai-assistant-plugin/public';
 import {
@@ -60,63 +60,68 @@ export function ApmAppRoot({
   const i18nCore = core.i18n;
 
   return (
-    <RedirectAppLinks
-      application={core.application}
+    <div
       className={APP_WRAPPER_CLASS}
       data-test-subj="apmMainContainer"
       role="main"
     >
-      <ApmPluginContext.Provider value={apmPluginContextValue}>
-        <KibanaContextProvider
-          services={{ ...core, ...pluginsStart, storage, ...apmServices }}
-        >
-          <i18nCore.Context>
-            <ObservabilityAIAssistantProvider
-              value={apmPluginContextValue.observabilityAIAssistant}
-            >
-              <TimeRangeIdContextProvider>
-                <RouterProvider history={history} router={apmRouter as any}>
-                  <ApmErrorBoundary>
-                    <RedirectDependenciesToDependenciesInventory>
-                      <RedirectWithDefaultEnvironment>
-                        <RedirectWithDefaultDateRange>
-                          <RedirectWithOffset>
-                            <TrackPageview>
-                              <UpdateExecutionContextOnRouteChange>
-                                <BreadcrumbsContextProvider>
-                                  <UrlParamsProvider>
-                                    <LicenseProvider>
-                                      <AnomalyDetectionJobsContextProvider>
-                                        <InspectorContextProvider>
-                                          <ApmThemeProvider>
-                                            <MountApmHeaderActionMenu />
+      <RedirectAppLinks
+        coreStart={{
+          application: core.application,
+        }}
+      >
+        <ApmPluginContext.Provider value={apmPluginContextValue}>
+          <KibanaContextProvider
+            services={{ ...core, ...pluginsStart, storage, ...apmServices }}
+          >
+            <i18nCore.Context>
+              <ObservabilityAIAssistantProvider
+                value={apmPluginContextValue.observabilityAIAssistant}
+              >
+                <TimeRangeIdContextProvider>
+                  <RouterProvider history={history} router={apmRouter as any}>
+                    <ApmErrorBoundary>
+                      <RedirectDependenciesToDependenciesInventory>
+                        <RedirectWithDefaultEnvironment>
+                          <RedirectWithDefaultDateRange>
+                            <RedirectWithOffset>
+                              <TrackPageview>
+                                <UpdateExecutionContextOnRouteChange>
+                                  <BreadcrumbsContextProvider>
+                                    <UrlParamsProvider>
+                                      <LicenseProvider>
+                                        <AnomalyDetectionJobsContextProvider>
+                                          <InspectorContextProvider>
+                                            <ApmThemeProvider>
+                                              <MountApmHeaderActionMenu />
 
-                                            <Route
-                                              component={
-                                                ScrollToTopOnPathChange
-                                              }
-                                            />
-                                            <RouteRenderer />
-                                          </ApmThemeProvider>
-                                        </InspectorContextProvider>
-                                      </AnomalyDetectionJobsContextProvider>
-                                    </LicenseProvider>
-                                  </UrlParamsProvider>
-                                </BreadcrumbsContextProvider>
-                              </UpdateExecutionContextOnRouteChange>
-                            </TrackPageview>
-                          </RedirectWithOffset>
-                        </RedirectWithDefaultDateRange>
-                      </RedirectWithDefaultEnvironment>
-                    </RedirectDependenciesToDependenciesInventory>
-                  </ApmErrorBoundary>
-                </RouterProvider>
-              </TimeRangeIdContextProvider>
-            </ObservabilityAIAssistantProvider>
-          </i18nCore.Context>
-        </KibanaContextProvider>
-      </ApmPluginContext.Provider>
-    </RedirectAppLinks>
+                                              <Route
+                                                component={
+                                                  ScrollToTopOnPathChange
+                                                }
+                                              />
+                                              <RouteRenderer />
+                                            </ApmThemeProvider>
+                                          </InspectorContextProvider>
+                                        </AnomalyDetectionJobsContextProvider>
+                                      </LicenseProvider>
+                                    </UrlParamsProvider>
+                                  </BreadcrumbsContextProvider>
+                                </UpdateExecutionContextOnRouteChange>
+                              </TrackPageview>
+                            </RedirectWithOffset>
+                          </RedirectWithDefaultDateRange>
+                        </RedirectWithDefaultEnvironment>
+                      </RedirectDependenciesToDependenciesInventory>
+                    </ApmErrorBoundary>
+                  </RouterProvider>
+                </TimeRangeIdContextProvider>
+              </ObservabilityAIAssistantProvider>
+            </i18nCore.Context>
+          </KibanaContextProvider>
+        </ApmPluginContext.Provider>
+      </RedirectAppLinks>
+    </div>
   );
 }
 
diff --git a/x-pack/plugins/apm/server/index.ts b/x-pack/plugins/apm/server/index.ts
index 1b8f8cb7c237ec..5012526710a71d 100644
--- a/x-pack/plugins/apm/server/index.ts
+++ b/x-pack/plugins/apm/server/index.ts
@@ -12,7 +12,6 @@ import {
 } from '@kbn/core/server';
 import { maxSuggestions } from '@kbn/observability-plugin/common';
 import { SearchAggregatedTransactionSetting } from '../common/aggregated_transactions';
-import { APMPlugin } from './plugin';
 
 const disabledOnServerless = offeringBasedSchema({
   serverless: schema.boolean({
@@ -125,8 +124,10 @@ export const config: PluginConfigDescriptor<APMConfig> = {
 
 export type APMConfig = TypeOf<typeof configSchema>;
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new APMPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { APMPlugin } = await import('./plugin');
+  return new APMPlugin(initContext);
+};
 
 export { APM_SERVER_FEATURE_ID } from '../common/rules/apm_rule_types';
 export { APMPlugin } from './plugin';
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
index e205a07129d3d0..a6f31c8e279e23 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
@@ -8,7 +8,6 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { unwrapEsResponse } from '@kbn/observability-plugin/server';
 import type { ESSearchResponse, ESSearchRequest } from '@kbn/es-types';
-import type { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import { APMRouteHandlerResources } from '../../../../routes/apm_routes/register_apm_server_routes';
 import {
@@ -21,26 +20,20 @@ import { cancelEsRequestOnAbort } from '../cancel_es_request_on_abort';
 export type APMIndexDocumentParams<T> = estypes.IndexRequest<T>;
 
 export type APMInternalESClient = Awaited<
-  ReturnType<typeof createInternalESClientWithContext>
+  ReturnType<typeof createInternalESClientWithResources>
 >;
 
-export async function createInternalESClientWithContext({
-  debug,
-  apmIndices,
+export async function createInternalESClientWithResources({
+  params,
   request,
   context,
-}: {
-  debug: boolean;
-  apmIndices: APMIndices;
-  request: APMRouteHandlerResources['request'];
-  context: APMRouteHandlerResources['context'];
-}) {
+}: APMRouteHandlerResources) {
   const coreContext = await context.core;
   const { asInternalUser } = coreContext.elasticsearch.client;
+  const debug = params.query._inspect;
 
   return createInternalESClient({
     debug,
-    apmIndices,
     request,
     elasticsearchClient: asInternalUser,
   });
@@ -48,12 +41,10 @@ export async function createInternalESClientWithContext({
 
 export async function createInternalESClient({
   debug,
-  apmIndices,
   request,
   elasticsearchClient,
 }: {
   debug: boolean;
-  apmIndices: APMIndices;
   request?: APMRouteHandlerResources['request'];
   elasticsearchClient: ElasticsearchClient;
 }) {
@@ -92,7 +83,6 @@ export async function createInternalESClient({
   }
 
   return {
-    apmIndices,
     search: async <
       TDocument = unknown,
       TSearchRequest extends ESSearchRequest = ESSearchRequest
diff --git a/x-pack/plugins/apm/server/routes/fleet/create_cloud_apm_package_policy.ts b/x-pack/plugins/apm/server/routes/fleet/create_cloud_apm_package_policy.ts
index a595c2f333a8dc..457a4d4c4884e9 100644
--- a/x-pack/plugins/apm/server/routes/fleet/create_cloud_apm_package_policy.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/create_cloud_apm_package_policy.ts
@@ -12,6 +12,7 @@ import {
   KibanaRequest,
 } from '@kbn/core/server';
 import { PackagePolicy } from '@kbn/fleet-plugin/common';
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import {
   APM_SERVER_SCHEMA_SAVED_OBJECT_TYPE,
   APM_SERVER_SCHEMA_SAVED_OBJECT_ID,
@@ -33,6 +34,7 @@ export async function createCloudApmPackgePolicy({
   logger,
   internalESClient,
   request,
+  apmIndices,
 }: {
   cloudPluginSetup: APMPluginSetupDependencies['cloud'];
   fleetPluginStart: NonNullable<APMPluginStartDependencies['fleet']>;
@@ -41,6 +43,7 @@ export async function createCloudApmPackgePolicy({
   logger: Logger;
   internalESClient: APMInternalESClient;
   request: KibanaRequest;
+  apmIndices: APMIndices;
 }): Promise<PackagePolicy> {
   const { attributes } = await savedObjectsClient.get(
     APM_SERVER_SCHEMA_SAVED_OBJECT_TYPE,
@@ -61,6 +64,7 @@ export async function createCloudApmPackgePolicy({
       internalESClient,
       packagePolicy: apmPackagePolicyDefinition,
       fleetPluginStart,
+      apmIndices,
     });
   logger.info(`Fleet migration on Cloud - apmPackagePolicy create start`);
   const apmPackagePolicy = await fleetPluginStart.packagePolicyService.create(
diff --git a/x-pack/plugins/apm/server/routes/fleet/merge_package_policy_with_apm.ts b/x-pack/plugins/apm/server/routes/fleet/merge_package_policy_with_apm.ts
index 60fc87df078b97..ea6e1436f00d0b 100644
--- a/x-pack/plugins/apm/server/routes/fleet/merge_package_policy_with_apm.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/merge_package_policy_with_apm.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { NewPackagePolicy } from '@kbn/fleet-plugin/common';
 import { APMInternalESClient } from '../../lib/helpers/create_es_client/create_internal_es_client';
 import { APMPluginStartDependencies } from '../../types';
@@ -19,13 +20,15 @@ export async function decoratePackagePolicyWithAgentConfigAndSourceMap({
   packagePolicy,
   internalESClient,
   fleetPluginStart,
+  apmIndices,
 }: {
   packagePolicy: NewPackagePolicy;
   internalESClient: APMInternalESClient;
   fleetPluginStart: NonNullable<APMPluginStartDependencies['fleet']>;
+  apmIndices: APMIndices;
 }) {
   const [agentConfigurations, { artifacts }] = await Promise.all([
-    listConfigurations(internalESClient),
+    listConfigurations(internalESClient, apmIndices),
     listSourceMapArtifacts({ fleetPluginStart }),
   ]);
 
diff --git a/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts b/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
index 9008fabdd3e3bc..1a6715cebff534 100644
--- a/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
@@ -173,7 +173,6 @@ function onPackagePolicyCreateOrUpdate({
 
     const internalESClient = await createInternalESClient({
       debug: false,
-      apmIndices,
       elasticsearchClient: asInternalUser,
     });
 
@@ -181,6 +180,7 @@ function onPackagePolicyCreateOrUpdate({
       internalESClient,
       fleetPluginStart,
       packagePolicy,
+      apmIndices,
     });
   };
 }
diff --git a/x-pack/plugins/apm/server/routes/fleet/route.ts b/x-pack/plugins/apm/server/routes/fleet/route.ts
index 3223d71a77b494..3807a87b9ec7cd 100644
--- a/x-pack/plugins/apm/server/routes/fleet/route.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/route.ts
@@ -14,7 +14,7 @@ import {
   APM_SERVER_SCHEMA_SAVED_OBJECT_TYPE,
 } from '../../../common/apm_saved_object_constants';
 import { ApmFeatureFlags } from '../../../common/apm_feature_flags';
-import { createInternalESClientWithContext } from '../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithResources } from '../../lib/helpers/create_es_client/create_internal_es_client';
 import { getInternalSavedObjectsClient } from '../../lib/helpers/get_internal_saved_objects_client';
 import { createApmServerRoute } from '../apm_routes/create_apm_server_route';
 import { createCloudApmPackgePolicy } from './create_cloud_apm_package_policy';
@@ -172,13 +172,9 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
       throw Boom.forbidden(CLOUD_SUPERUSER_REQUIRED_MESSAGE);
     }
 
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: resources.params.query._inspect,
-      apmIndices,
-    });
-
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const cloudApmPackagePolicy = await createCloudApmPackgePolicy({
       cloudPluginSetup,
       fleetPluginStart,
@@ -186,6 +182,7 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
       esClient,
       logger,
       internalESClient,
+      apmIndices,
       request,
     });
 
diff --git a/x-pack/plugins/apm/server/routes/fleet/sync_agent_configs_to_apm_package_policies.ts b/x-pack/plugins/apm/server/routes/fleet/sync_agent_configs_to_apm_package_policies.ts
index 3eb7308e7908f6..ce8d4421dfc46e 100644
--- a/x-pack/plugins/apm/server/routes/fleet/sync_agent_configs_to_apm_package_policies.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/sync_agent_configs_to_apm_package_policies.ts
@@ -6,6 +6,7 @@
  */
 
 import { CoreStart, SavedObjectsClientContract } from '@kbn/core/server';
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { TelemetryUsageCounter } from '../typings';
 import { APMPluginStartDependencies } from '../../types';
 import { getInternalSavedObjectsClient } from '../../lib/helpers/get_internal_saved_objects_client';
@@ -18,11 +19,13 @@ export async function syncAgentConfigsToApmPackagePolicies({
   coreStartPromise,
   fleetPluginStart,
   internalESClient,
+  apmIndices,
   telemetryUsageCounter,
 }: {
   coreStartPromise: Promise<CoreStart>;
   fleetPluginStart: NonNullable<APMPluginStartDependencies['fleet']>;
   internalESClient: APMInternalESClient;
+  apmIndices: APMIndices;
   telemetryUsageCounter?: TelemetryUsageCounter;
 }) {
   if (telemetryUsageCounter) {
@@ -36,7 +39,7 @@ export async function syncAgentConfigsToApmPackagePolicies({
   const [savedObjectsClient, agentConfigurations, packagePolicies] =
     await Promise.all([
       getInternalSavedObjectsClient(coreStart),
-      listConfigurations(internalESClient),
+      listConfigurations(internalESClient, apmIndices),
       getApmPackagePolicies({ coreStart, fleetPluginStart }),
     ]);
 
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/find_exact_configuration.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/find_exact_configuration.ts
index 3cd71c1d290279..232c3d2d50c460 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/find_exact_configuration.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/find_exact_configuration.ts
@@ -6,6 +6,7 @@
  */
 
 import type { SearchHit } from '@kbn/es-types';
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
 import {
   SERVICE_ENVIRONMENT,
@@ -19,9 +20,11 @@ import { getConfigsAppliedToAgentsThroughFleet } from './get_config_applied_to_a
 export async function findExactConfiguration({
   service,
   internalESClient,
+  apmIndices,
 }: {
   service: AgentConfiguration['service'];
   internalESClient: APMInternalESClient;
+  apmIndices: APMIndices;
 }) {
   const serviceNameFilter = service.name
     ? { term: { [SERVICE_NAME]: service.name } }
@@ -45,7 +48,7 @@ export async function findExactConfiguration({
       'find_exact_agent_configuration',
       params
     ),
-    getConfigsAppliedToAgentsThroughFleet(internalESClient),
+    getConfigsAppliedToAgentsThroughFleet(internalESClient, apmIndices),
   ]);
 
   const hit = agentConfig.hits.hits[0] as
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/get_config_applied_to_agent_through_fleet.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/get_config_applied_to_agent_through_fleet.ts
index 7d4382e0547835..067d7565247b9b 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/get_config_applied_to_agent_through_fleet.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/get_config_applied_to_agent_through_fleet.ts
@@ -7,14 +7,17 @@
 
 import { termQuery, rangeQuery } from '@kbn/observability-plugin/server';
 import datemath from '@kbn/datemath';
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { METRICSET_NAME } from '../../../../common/es_fields/apm';
 import { APMInternalESClient } from '../../../lib/helpers/create_es_client/create_internal_es_client';
 
 export async function getConfigsAppliedToAgentsThroughFleet(
-  internalESClient: APMInternalESClient
+  internalESClient: APMInternalESClient,
+  apmIndices: APMIndices
 ) {
   const params = {
-    index: internalESClient.apmIndices.metric,
+    index: apmIndices.metric,
+    track_total_hits: 0,
     size: 0,
     body: {
       query: {
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/list_configurations.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/list_configurations.ts
index 1cca702dfb45fe..940ac7cd0b5a58 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/list_configurations.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/list_configurations.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { APMIndices } from '@kbn/apm-data-access-plugin/server';
 import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
 import { convertConfigSettingsToString } from './convert_settings_to_string';
 import { getConfigsAppliedToAgentsThroughFleet } from './get_config_applied_to_agent_through_fleet';
@@ -12,7 +13,8 @@ import { APMInternalESClient } from '../../../lib/helpers/create_es_client/creat
 import { APM_AGENT_CONFIGURATION_INDEX } from '../apm_indices/apm_system_index_constants';
 
 export async function listConfigurations(
-  internalESClient: APMInternalESClient
+  internalESClient: APMInternalESClient,
+  apmIndices: APMIndices
 ) {
   const params = {
     index: APM_AGENT_CONFIGURATION_INDEX,
@@ -24,7 +26,7 @@ export async function listConfigurations(
       'list_agent_configuration',
       params
     ),
-    getConfigsAppliedToAgentsThroughFleet(internalESClient),
+    getConfigsAppliedToAgentsThroughFleet(internalESClient, apmIndices),
   ]);
 
   return agentConfigs.hits.hits
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/queries.test.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/queries.test.ts
index 4d2fb4f768ec6a..5a267211506600 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/queries.test.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/queries.test.ts
@@ -53,8 +53,9 @@ describe('agent configuration queries', () => {
 
   describe('listConfigurations', () => {
     it('fetches configurations', async () => {
-      mock = await inspectSearchParams(({ mockInternalESClient }) =>
-        listConfigurations(mockInternalESClient)
+      mock = await inspectSearchParams(
+        ({ mockInternalESClient, mockIndices }) =>
+          listConfigurations(mockInternalESClient, mockIndices)
       );
 
       expect(mock.params).toMatchSnapshot();
@@ -92,33 +93,39 @@ describe('agent configuration queries', () => {
 
   describe('findExactConfiguration', () => {
     it('find configuration by service.name', async () => {
-      mock = await inspectSearchParams(({ mockInternalESClient }) =>
-        findExactConfiguration({
-          service: { name: 'foo' },
-          internalESClient: mockInternalESClient,
-        })
+      mock = await inspectSearchParams(
+        ({ mockInternalESClient, mockIndices }) =>
+          findExactConfiguration({
+            service: { name: 'foo' },
+            internalESClient: mockInternalESClient,
+            apmIndices: mockIndices,
+          })
       );
 
       expect(mock.params).toMatchSnapshot();
     });
 
     it('find configuration by service.environment', async () => {
-      mock = await inspectSearchParams(({ mockInternalESClient }) =>
-        findExactConfiguration({
-          service: { environment: 'bar' },
-          internalESClient: mockInternalESClient,
-        })
+      mock = await inspectSearchParams(
+        ({ mockInternalESClient, mockIndices }) =>
+          findExactConfiguration({
+            service: { environment: 'bar' },
+            internalESClient: mockInternalESClient,
+            apmIndices: mockIndices,
+          })
       );
 
       expect(mock.params).toMatchSnapshot();
     });
 
     it('find configuration by service.name and service.environment', async () => {
-      mock = await inspectSearchParams(({ mockInternalESClient }) =>
-        findExactConfiguration({
-          service: { name: 'foo', environment: 'bar' },
-          internalESClient: mockInternalESClient,
-        })
+      mock = await inspectSearchParams(
+        ({ mockInternalESClient, mockIndices }) =>
+          findExactConfiguration({
+            service: { name: 'foo', environment: 'bar' },
+            internalESClient: mockInternalESClient,
+            apmIndices: mockIndices,
+          })
       );
 
       expect(mock.params).toMatchSnapshot();
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
index c11eba5ac77401..b2c06044838ff2 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
@@ -26,7 +26,7 @@ import {
 import { getSearchTransactionsEvents } from '../../../lib/helpers/transactions';
 import { syncAgentConfigsToApmPackagePolicies } from '../../fleet/sync_agent_configs_to_apm_package_policies';
 import { getApmEventClient } from '../../../lib/helpers/get_apm_event_client';
-import { createInternalESClientWithContext } from '../../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithResources } from '../../../lib/helpers/create_es_client/create_internal_es_client';
 import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
 import { ApmFeatureFlags } from '../../../../common/apm_feature_flags';
 
@@ -49,17 +49,14 @@ const agentConfigurationRoute = createApmServerRoute({
   }> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
 
-    const { context, request, params } = resources;
     const apmIndices = await resources.getApmIndices();
-
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: params.query._inspect,
-      apmIndices,
-    });
-
-    const configurations = await listConfigurations(internalESClient);
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
+    const configurations = await listConfigurations(
+      internalESClient,
+      apmIndices
+    );
 
     return { configurations };
   },
@@ -75,20 +72,17 @@ const getSingleAgentConfigurationRoute = createApmServerRoute({
   handler: async (resources): Promise<AgentConfiguration> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
 
-    const { params, logger, context, request } = resources;
-    const { name, environment, _inspect } = params.query;
+    const { params, logger } = resources;
+    const { name, environment } = params.query;
     const service = { name, environment };
     const apmIndices = await resources.getApmIndices();
-
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: _inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const exactConfig = await findExactConfiguration({
       service,
       internalESClient,
+      apmIndices,
     });
 
     if (!exactConfig) {
@@ -117,20 +111,16 @@ const deleteAgentConfigurationRoute = createApmServerRoute({
   handler: async (resources): Promise<{ result: string }> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
 
-    const { params, logger, core, telemetryUsageCounter, context, request } =
-      resources;
+    const { params, logger, core, telemetryUsageCounter } = resources;
     const { service } = params.body;
     const apmIndices = await resources.getApmIndices();
-
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const exactConfig = await findExactConfiguration({
       service,
       internalESClient,
+      apmIndices,
     });
     if (!exactConfig) {
       logger.info(
@@ -154,6 +144,7 @@ const deleteAgentConfigurationRoute = createApmServerRoute({
         coreStartPromise: core.start(),
         fleetPluginStart: await resources.plugins.fleet.start(),
         internalESClient,
+        apmIndices,
         telemetryUsageCounter,
       });
       logger.info(
@@ -177,23 +168,19 @@ const createOrUpdateAgentConfigurationRoute = createApmServerRoute({
   ]),
   handler: async (resources): Promise<void> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
-    const { params, logger, core, telemetryUsageCounter, context, request } =
-      resources;
+    const { params, logger, core, telemetryUsageCounter } = resources;
     const { body, query } = params;
     const apmIndices = await resources.getApmIndices();
-
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
 
     // if the config already exists, it is fetched and updated
     // this is to avoid creating two configs with identical service params
     const exactConfig = await findExactConfiguration({
       service: body.service,
       internalESClient,
+      apmIndices,
     });
 
     // if the config exists ?overwrite=true is required
@@ -219,6 +206,7 @@ const createOrUpdateAgentConfigurationRoute = createApmServerRoute({
       await syncAgentConfigsToApmPackagePolicies({
         coreStartPromise: core.start(),
         fleetPluginStart: await resources.plugins.fleet.start(),
+        apmIndices,
         internalESClient,
         telemetryUsageCounter,
       });
@@ -248,21 +236,17 @@ const agentConfigurationSearchRoute = createApmServerRoute({
   ): Promise<SearchHit<AgentConfiguration, undefined, undefined> | null> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
 
-    const { params, logger, context, request } = resources;
+    const { params, logger } = resources;
 
     const {
       service,
       etag,
       mark_as_applied_by_agent: markAsAppliedByAgent,
     } = params.body;
-    const apmIndices = await resources.getApmIndices();
 
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const configuration = await searchConfigurations({
       service,
       internalESClient,
@@ -322,16 +306,9 @@ const listAgentConfigurationEnvironmentsRoute = createApmServerRoute({
   }> => {
     throwNotFoundIfAgentConfigNotAvailable(resources.featureFlags);
 
-    const { context, request, params, config } = resources;
-    const apmIndices = await resources.getApmIndices();
-
+    const { context, params, config } = resources;
     const [internalESClient, apmEventClient] = await Promise.all([
-      createInternalESClientWithContext({
-        context,
-        request,
-        debug: params.query._inspect,
-        apmIndices,
-      }),
+      createInternalESClientWithResources(resources),
       getApmEventClient(resources),
     ]);
     const coreContext = await context.core;
diff --git a/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts b/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
index 1db1d74fb71347..752c7efb8cbe22 100644
--- a/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
+++ b/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
@@ -19,7 +19,7 @@ import { getTransaction } from './get_transaction';
 import { listCustomLinks } from './list_custom_links';
 import { createApmServerRoute } from '../../apm_routes/create_apm_server_route';
 import { getApmEventClient } from '../../../lib/helpers/get_apm_event_client';
-import { createInternalESClientWithContext } from '../../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithResources } from '../../../lib/helpers/create_es_client/create_internal_es_client';
 import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { CustomLink } from '../../../../common/custom_link/custom_link_types';
 
@@ -50,22 +50,17 @@ const listCustomLinksRoute = createApmServerRoute({
   ): Promise<{
     customLinks: CustomLink[];
   }> => {
-    const { context, params, request } = resources;
+    const { context, params } = resources;
     const licensingContext = await context.licensing;
-    const apmIndices = await resources.getApmIndices();
 
     if (!isActiveGoldLicense(licensingContext.license)) {
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
     const { query } = params;
-
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: resources.params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
 
     // picks only the items listed in FILTER_OPTIONS
     const filters = pick(query, FILTER_OPTIONS);
@@ -84,20 +79,16 @@ const createCustomLinkRoute = createApmServerRoute({
   }),
   options: { tags: ['access:apm', 'access:apm_write'] },
   handler: async (resources): Promise<void> => {
-    const { context, params, request } = resources;
+    const { context, params } = resources;
     const licensingContext = await context.licensing;
-    const apmIndices = await resources.getApmIndices();
 
     if (!isActiveGoldLicense(licensingContext.license)) {
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: resources.params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const customLink = params.body;
 
     notifyFeatureUsage({
@@ -121,20 +112,16 @@ const updateCustomLinkRoute = createApmServerRoute({
     tags: ['access:apm', 'access:apm_write'],
   },
   handler: async (resources): Promise<void> => {
-    const { params, context, request } = resources;
+    const { params, context } = resources;
     const licensingContext = await context.licensing;
-    const apmIndices = await resources.getApmIndices();
 
     if (!isActiveGoldLicense(licensingContext.license)) {
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: resources.params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
 
     const { id } = params.path;
     const customLink = params.body;
@@ -158,26 +145,18 @@ const deleteCustomLinkRoute = createApmServerRoute({
     tags: ['access:apm', 'access:apm_write'],
   },
   handler: async (resources): Promise<{ result: string }> => {
-    const { context, params, request } = resources;
+    const { context, params } = resources;
     const licensingContext = await context.licensing;
-    const apmIndices = await resources.getApmIndices();
 
     if (!isActiveGoldLicense(licensingContext.license)) {
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClientWithContext({
-      context,
-      request,
-      debug: resources.params.query._inspect,
-      apmIndices,
-    });
+    const internalESClient = await createInternalESClientWithResources(
+      resources
+    );
     const { id } = params.path;
-    const res = await deleteCustomLink({
-      customLinkId: id,
-      internalESClient,
-    });
-    return res;
+    return deleteCustomLink({ customLinkId: id, internalESClient });
   },
 });
 
diff --git a/x-pack/plugins/apm/tsconfig.json b/x-pack/plugins/apm/tsconfig.json
index 47aab0ba345a38..0c0e2780950ead 100644
--- a/x-pack/plugins/apm/tsconfig.json
+++ b/x-pack/plugins/apm/tsconfig.json
@@ -102,7 +102,8 @@
     "@kbn/analytics-client",
     "@kbn/monaco",
     "@kbn/shared-svg",
-    "@kbn/deeplinks-observability"
+    "@kbn/deeplinks-observability",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": ["target/**/*"]
 }
diff --git a/x-pack/plugins/apm_data_access/server/index.ts b/x-pack/plugins/apm_data_access/server/index.ts
index 4ef9a479377336..f322ff2eb910dc 100644
--- a/x-pack/plugins/apm_data_access/server/index.ts
+++ b/x-pack/plugins/apm_data_access/server/index.ts
@@ -7,7 +7,6 @@
 
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { ApmDataAccessPlugin } from './plugin';
 
 const configSchema = schema.object({
   indices: schema.object({
@@ -78,7 +77,8 @@ export const config: PluginConfigDescriptor<APMDataAccessConfig> = {
 export type APMDataAccessConfig = TypeOf<typeof configSchema>;
 export type APMIndices = APMDataAccessConfig['indices'];
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ApmDataAccessPlugin } = await import('./plugin');
   return new ApmDataAccessPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/asset_manager/server/index.ts b/x-pack/plugins/asset_manager/server/index.ts
index 5dbecbee5f9da3..86e5e855a74c9a 100644
--- a/x-pack/plugins/asset_manager/server/index.ts
+++ b/x-pack/plugins/asset_manager/server/index.ts
@@ -7,12 +7,7 @@
 
 import { PluginInitializerContext } from '@kbn/core-plugins-server';
 import { AssetManagerConfig } from '../common/config';
-import {
-  AssetManagerServerPlugin,
-  AssetManagerServerPluginSetup,
-  AssetManagerServerPluginStart,
-  config,
-} from './plugin';
+import { AssetManagerServerPluginSetup, AssetManagerServerPluginStart, config } from './plugin';
 import type { WriteSamplesPostBody } from './routes/sample_assets';
 
 export type {
@@ -23,5 +18,7 @@ export type {
 };
 export { config };
 
-export const plugin = (context: PluginInitializerContext<AssetManagerConfig>) =>
-  new AssetManagerServerPlugin(context);
+export const plugin = async (context: PluginInitializerContext<AssetManagerConfig>) => {
+  const { AssetManagerServerPlugin } = await import('./plugin');
+  return new AssetManagerServerPlugin(context);
+};
diff --git a/x-pack/plugins/banners/server/index.ts b/x-pack/plugins/banners/server/index.ts
index 053de8b5c12b25..4b029ad07743b7 100644
--- a/x-pack/plugins/banners/server/index.ts
+++ b/x-pack/plugins/banners/server/index.ts
@@ -6,7 +6,9 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import { BannersPlugin } from './plugin';
 
 export { config } from './config';
-export const plugin: PluginInitializer<{}, {}, {}, {}> = (context) => new BannersPlugin(context);
+export const plugin: PluginInitializer<{}, {}, {}, {}> = async (context) => {
+  const { BannersPlugin } = await import('./plugin');
+  return new BannersPlugin(context);
+};
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
index 63477a325824be..d535d7dceaf0b9 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
+++ b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { JobAppParamsPDFV2 } from '@kbn/reporting-plugin/common/types';
 import type { RedirectOptions } from '@kbn/share-plugin/public';
+import { JobAppParamsPDFV2 } from '@kbn/reporting-export-types-pdf-common';
 import { CanvasAppLocatorParams, CANVAS_APP_LOCATOR } from '../../../../common/locator';
 import { CanvasWorkpad } from '../../../../types';
 
diff --git a/x-pack/plugins/canvas/server/feature.test.ts b/x-pack/plugins/canvas/server/feature.test.ts
index 513db3f668e14b..b4a891af13c6f4 100644
--- a/x-pack/plugins/canvas/server/feature.test.ts
+++ b/x-pack/plugins/canvas/server/feature.test.ts
@@ -6,8 +6,8 @@
  */
 
 import { getCanvasFeature } from './feature';
-import { ReportingStart } from '@kbn/reporting-plugin/server/types';
 import { reportingMock } from '@kbn/reporting-plugin/server/mocks';
+import { ReportingStart } from '@kbn/reporting-plugin/server/types';
 
 let mockReportingPlugin: ReportingStart;
 beforeEach(() => {
diff --git a/x-pack/plugins/canvas/server/feature.ts b/x-pack/plugins/canvas/server/feature.ts
index f5fc320fbeb50e..01ae5249629e98 100644
--- a/x-pack/plugins/canvas/server/feature.ts
+++ b/x-pack/plugins/canvas/server/feature.ts
@@ -8,13 +8,13 @@
 import { i18n } from '@kbn/i18n';
 import { DEFAULT_APP_CATEGORIES } from '@kbn/core/server';
 import { KibanaFeatureConfig } from '@kbn/features-plugin/common';
-import { ReportingSetup } from '@kbn/reporting-plugin/server';
+import { ReportingStart } from '@kbn/reporting-plugin/server/types';
 
 /*
  * Register Canvas as a Kibana feature,
  * with Reporting sub-feature integration (if enabled)
  */
-export function getCanvasFeature(plugins: { reporting?: ReportingSetup }): KibanaFeatureConfig {
+export function getCanvasFeature(plugins: { reporting?: ReportingStart }): KibanaFeatureConfig {
   const includeReporting = plugins.reporting && plugins.reporting.usesUiCapabilities();
 
   return {
diff --git a/x-pack/plugins/canvas/server/index.ts b/x-pack/plugins/canvas/server/index.ts
index 74c5810481e002..c72530f911cc10 100644
--- a/x-pack/plugins/canvas/server/index.ts
+++ b/x-pack/plugins/canvas/server/index.ts
@@ -6,12 +6,13 @@
  */
 
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { CanvasPlugin } from './plugin';
 import { ConfigSchema } from './config';
 
 export const config: PluginConfigDescriptor = {
   schema: ConfigSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new CanvasPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { CanvasPlugin } = await import('./plugin');
+  return new CanvasPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/canvas/server/plugin.ts b/x-pack/plugins/canvas/server/plugin.ts
index 8c9748cc478879..9dd6dc1bdd64fd 100644
--- a/x-pack/plugins/canvas/server/plugin.ts
+++ b/x-pack/plugins/canvas/server/plugin.ts
@@ -15,8 +15,8 @@ import { BfetchServerSetup } from '@kbn/bfetch-plugin/server';
 import { UsageCollectionSetup } from '@kbn/usage-collection-plugin/server';
 import { HomeServerPluginSetup } from '@kbn/home-plugin/server';
 import { EmbeddableSetup } from '@kbn/embeddable-plugin/server';
-import { ReportingSetup } from '@kbn/reporting-plugin/server';
 import { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
+import { ReportingServerPluginSetup } from '@kbn/reporting-server';
 import { getCanvasFeature } from './feature';
 import { initRoutes } from './routes';
 import { registerCanvasUsageCollector } from './collectors';
@@ -35,7 +35,7 @@ interface PluginsSetup {
   home: HomeServerPluginSetup;
   bfetch: BfetchServerSetup;
   data: DataPluginSetup;
-  reporting?: ReportingSetup;
+  reporting?: ReportingServerPluginSetup;
   usageCollection?: UsageCollectionSetup;
 }
 
diff --git a/x-pack/plugins/canvas/tsconfig.json b/x-pack/plugins/canvas/tsconfig.json
index 45b22e422dc6eb..b3a9ef19723e39 100644
--- a/x-pack/plugins/canvas/tsconfig.json
+++ b/x-pack/plugins/canvas/tsconfig.json
@@ -84,6 +84,8 @@
     "@kbn/content-management-plugin",
     "@kbn/react-kibana-context-theme",
     "@kbn/shared-ux-page-kibana-template",
+    "@kbn/reporting-server",
+    "@kbn/reporting-export-types-pdf-common",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/cases/common/constants/index.ts b/x-pack/plugins/cases/common/constants/index.ts
index f2c2dcef9bb2e7..5a540b610135ca 100644
--- a/x-pack/plugins/cases/common/constants/index.ts
+++ b/x-pack/plugins/cases/common/constants/index.ts
@@ -202,6 +202,7 @@ export const SEARCH_DEBOUNCE_MS = 500;
 export const LOCAL_STORAGE_KEYS = {
   casesQueryParams: 'cases.list.queryParams',
   casesFilterOptions: 'cases.list.filterOptions',
+  casesTableColumns: 'cases.list.tableColumns',
 };
 
 /**
diff --git a/x-pack/plugins/cases/common/types/api/case/v1.test.ts b/x-pack/plugins/cases/common/types/api/case/v1.test.ts
index e6e7286ed4766b..a509bdee36525e 100644
--- a/x-pack/plugins/cases/common/types/api/case/v1.test.ts
+++ b/x-pack/plugins/cases/common/types/api/case/v1.test.ts
@@ -40,6 +40,7 @@ import {
   CasesFindRequestSortFieldsRt,
   CasesFindResponseRt,
   CasesPatchRequestRt,
+  CasesSearchRequestRt,
 } from './v1';
 import { CustomFieldTypes } from '../../domain/custom_field/v1';
 
@@ -461,6 +462,50 @@ describe('CasesFindRequestRt', () => {
   });
 });
 
+describe('CasesSearchRequestRt', () => {
+  const defaultRequest = {
+    tags: ['new', 'case'],
+    status: CaseStatuses.open,
+    severity: CaseSeverity.LOW,
+    assignees: ['damaged_racoon'],
+    reporters: ['damaged_racoon'],
+    defaultSearchOperator: 'AND',
+    from: 'now',
+    page: '1',
+    perPage: '10',
+    search: 'search text',
+    searchFields: ['title', 'description'],
+    to: '1w',
+    sortOrder: 'desc',
+    sortField: 'createdAt',
+    owner: 'cases',
+    customFields: {
+      toggle_custom_field_key: [true],
+      another_custom_field: [null, false],
+      text_custom_field: ['hello'],
+      number_custom_field: [1234],
+    },
+  };
+
+  it('has expected attributes in request', () => {
+    const query = CasesSearchRequestRt.decode(defaultRequest);
+
+    expect(query).toStrictEqual({
+      _tag: 'Right',
+      right: { ...defaultRequest, page: 1, perPage: 10 },
+    });
+  });
+
+  it('removes foo:bar attributes from request', () => {
+    const query = CasesSearchRequestRt.decode({ ...defaultRequest, foo: 'bar' });
+
+    expect(query).toStrictEqual({
+      _tag: 'Right',
+      right: { ...defaultRequest, page: 1, perPage: 10 },
+    });
+  });
+});
+
 describe('Status', () => {
   describe('CasesStatusRequestRt', () => {
     const defaultRequest = {
diff --git a/x-pack/plugins/cases/common/types/api/case/v1.ts b/x-pack/plugins/cases/common/types/api/case/v1.ts
index 28beb03812aa56..228de9c1c281ab 100644
--- a/x-pack/plugins/cases/common/types/api/case/v1.ts
+++ b/x-pack/plugins/cases/common/types/api/case/v1.ts
@@ -283,6 +283,21 @@ export const CasesFindRequestRt = rt.intersection([
   paginationSchema({ maxPerPage: MAX_CASES_PER_PAGE }),
 ]);
 
+export const CasesSearchRequestRt = rt.intersection([
+  rt.exact(
+    rt.partial({
+      /**
+       * custom fields of the case
+       */
+      customFields: rt.record(
+        rt.string,
+        rt.array(rt.union([rt.string, rt.boolean, rt.number, rt.null]))
+      ),
+    })
+  ),
+  CasesFindRequestRt,
+]);
+
 export const CasesFindResponseRt = rt.intersection([
   rt.strict({
     cases: rt.array(CaseRt),
@@ -487,6 +502,7 @@ export type CaseResolveResponse = rt.TypeOf<typeof CaseResolveResponseRt>;
 export type CasesDeleteRequest = rt.TypeOf<typeof CasesDeleteRequestRt>;
 export type CasesByAlertIDRequest = rt.TypeOf<typeof CasesByAlertIDRequestRt>;
 export type CasesFindRequest = rt.TypeOf<typeof CasesFindRequestRt>;
+export type CasesSearchRequest = rt.TypeOf<typeof CasesSearchRequestRt>;
 export type CasesFindRequestSortFields = rt.TypeOf<typeof CasesFindRequestSortFieldsRt>;
 export type CasesFindResponse = rt.TypeOf<typeof CasesFindResponseRt>;
 export type CasePatchRequest = rt.TypeOf<typeof CasePatchRequestRt>;
diff --git a/x-pack/plugins/cases/public/components/all_cases/all_cases_list.test.tsx b/x-pack/plugins/cases/public/components/all_cases/all_cases_list.test.tsx
index 10b55c0e979b37..4bd497a3c76f3f 100644
--- a/x-pack/plugins/cases/public/components/all_cases/all_cases_list.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/all_cases_list.test.tsx
@@ -25,7 +25,7 @@ import { useGetCasesMockState, connectorsMock } from '../../containers/mock';
 import { SortFieldCase, StatusAll } from '../../../common/ui/types';
 import { CaseSeverity, CaseStatuses } from '../../../common/types/domain';
 import { SECURITY_SOLUTION_OWNER } from '../../../common/constants';
-import { getEmptyTagValue } from '../empty_value';
+import { getEmptyCellValue } from '../empty_value';
 import { useKibana } from '../../common/lib/kibana';
 import { AllCasesList } from './all_cases_list';
 import type { GetCasesColumn, UseCasesColumnsReturnValue } from './use_cases_columns';
@@ -48,7 +48,10 @@ import { userProfiles, userProfilesMap } from '../../containers/user_profiles/ap
 import { useBulkGetUserProfiles } from '../../containers/user_profiles/use_bulk_get_user_profiles';
 import { useLicense } from '../../common/use_license';
 import * as api from '../../containers/api';
+import { useGetCaseConfiguration } from '../../containers/configure/use_get_case_configuration';
+import { useCaseConfigureResponse } from '../configure_cases/__mock__';
 
+jest.mock('../../containers/configure/use_get_case_configuration');
 jest.mock('../../containers/use_get_cases');
 jest.mock('../../containers/use_get_action_license');
 jest.mock('../../containers/use_get_tags');
@@ -64,6 +67,7 @@ jest.mock('../app/use_available_owners', () => ({
 jest.mock('../../containers/use_update_case');
 jest.mock('../../common/use_license');
 
+const useGetCaseConfigurationMock = useGetCaseConfiguration as jest.Mock;
 const useGetCasesMock = useGetCases as jest.Mock;
 const useGetTagsMock = useGetTags as jest.Mock;
 const useGetCurrentUserProfileMock = useGetCurrentUserProfile as jest.Mock;
@@ -89,7 +93,7 @@ describe('AllCasesListGeneric', () => {
   const onRowClick = jest.fn();
   const updateCaseProperty = jest.fn();
 
-  const emptyTag = getEmptyTagValue().props.children;
+  const emptyTag = getEmptyCellValue().props.children;
 
   const defaultGetCases = {
     ...useGetCasesMockState,
@@ -99,9 +103,11 @@ describe('AllCasesListGeneric', () => {
     filterStatus: CaseStatuses.open,
     handleIsLoading: jest.fn(),
     isLoadingCases: [],
+    isLoadingColumns: false,
     isSelectorView: false,
     userProfiles: new Map(),
     currentUserProfile: undefined,
+    selectedColumns: [],
   };
 
   const removeMsFromDate = (value: string) => moment(value).format('YYYY-MM-DDTHH:mm:ss[Z]');
@@ -156,8 +162,9 @@ describe('AllCasesListGeneric', () => {
     useGetTagsMock.mockReturnValue({ data: ['coke', 'pepsi'], isLoading: false });
     useGetCategoriesMock.mockReturnValue({ data: ['twix', 'snickers'], isLoading: false });
     useGetCurrentUserProfileMock.mockReturnValue({ data: userProfiles[0], isLoading: false });
-    useBulkGetUserProfilesMock.mockReturnValue({ data: userProfilesMap });
     useGetConnectorsMock.mockImplementation(() => ({ data: connectorsMock, isLoading: false }));
+    useGetCaseConfigurationMock.mockImplementation(() => useCaseConfigureResponse);
+    useBulkGetUserProfilesMock.mockReturnValue({ data: userProfilesMap });
     useUpdateCaseMock.mockReturnValue({ mutate: updateCaseProperty });
     useLicenseMock.mockReturnValue({ isAtLeastPlatinum: () => false });
     mockKibana();
@@ -1119,4 +1126,18 @@ describe('AllCasesListGeneric', () => {
       });
     });
   });
+
+  describe('Columns Popover', () => {
+    it('renders the columns popover correctly', async () => {
+      appMockRenderer.render(<AllCasesList isSelectorView={false} />);
+
+      expect(await screen.findByTestId('column-selection-popover-button')).toBeInTheDocument();
+    });
+
+    it('does not render the columns popover when isSelectorView=true', () => {
+      appMockRenderer.render(<AllCasesList isSelectorView={true} />);
+
+      expect(screen.queryByTestId('column-selection-popover-button')).not.toBeInTheDocument();
+    });
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/all_cases/all_cases_list.tsx b/x-pack/plugins/cases/public/components/all_cases/all_cases_list.tsx
index f915dbe0b7e38a..75fe22f8e53b68 100644
--- a/x-pack/plugins/cases/public/components/all_cases/all_cases_list.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/all_cases_list.tsx
@@ -37,6 +37,7 @@ import { useGetCurrentUserProfile } from '../../containers/user_profiles/use_get
 import { getAllPermissionsExceptFrom, isReadOnlyPermissions } from '../../utils/permissions';
 import { useIsLoadingCases } from './use_is_loading_cases';
 import { useAllCasesState } from './use_all_cases_state';
+import { useCasesColumnsSelection } from './use_cases_columns_selection';
 
 const ProgressLoader = styled(EuiProgress)`
   ${({ $isShow }: { $isShow: boolean }) =>
@@ -209,14 +210,16 @@ export const AllCasesList = React.memo<AllCasesListProps>(
       ]
     );
 
-    const { columns } = useCasesColumns({
+    const { selectedColumns, setSelectedColumns } = useCasesColumnsSelection();
+
+    const { columns, isLoadingColumns } = useCasesColumns({
       filterStatus: filterOptions.status ?? StatusAll,
       userProfiles: userProfiles ?? new Map(),
       isSelectorView,
       connectors,
       onRowClick,
-      showSolutionColumn: !hasOwner && availableSolutions.length > 1,
       disableActions: selectedCases.length > 0,
+      selectedColumns,
     });
 
     const pagination = useMemo(
@@ -260,7 +263,7 @@ export const AllCasesList = React.memo<AllCasesListProps>(
           size="xs"
           color="accent"
           className="essentialAnimation"
-          $isShow={isLoading || isLoadingCases}
+          $isShow={isLoading || isLoadingCases || isLoadingColumns}
         />
         {!isSelectorView ? <CasesMetrics /> : null}
         <CasesTableFilters
@@ -291,6 +294,7 @@ export const AllCasesList = React.memo<AllCasesListProps>(
           data={data}
           goToCreateCase={onRowClick ? onCreateCasePressed : undefined}
           isCasesLoading={isLoadingCases}
+          isLoadingColumns={isLoadingColumns}
           isCommentUpdating={isLoadingCases}
           isDataEmpty={isDataEmpty}
           isSelectorView={isSelectorView}
@@ -302,6 +306,8 @@ export const AllCasesList = React.memo<AllCasesListProps>(
           tableRef={tableRef}
           tableRowProps={tableRowProps}
           deselectCases={deselectCases}
+          selectedColumns={selectedColumns}
+          onSelectedColumnsChange={setSelectedColumns}
         />
       </>
     );
diff --git a/x-pack/plugins/cases/public/components/all_cases/assignees_column.tsx b/x-pack/plugins/cases/public/components/all_cases/assignees_column.tsx
index 41e936a7021c0c..c11c5a9d6a602f 100644
--- a/x-pack/plugins/cases/public/components/all_cases/assignees_column.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/assignees_column.tsx
@@ -9,7 +9,7 @@ import React, { useCallback, useMemo, useState } from 'react';
 import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import type { UserProfileWithAvatar } from '@kbn/user-profile-components';
 import type { CaseUI } from '../../../common/ui/types';
-import { getEmptyTagValue } from '../empty_value';
+import { getEmptyCellValue } from '../empty_value';
 import { UserToolTip } from '../user_profiles/user_tooltip';
 import { useAssignees } from '../../containers/user_profiles/use_assignees';
 import { getUsernameDataTestSubj } from '../user_profiles/data_test_subject';
@@ -58,7 +58,7 @@ const AssigneesColumnComponent: React.FC<AssigneesColumnProps> = ({
   }, [allAssignees, isAvatarListExpanded, limitedAvatars, shouldShowExpandListButton]);
 
   if (allAssignees.length <= 0) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   }
 
   return (
diff --git a/x-pack/plugins/cases/public/components/all_cases/columns_popover.test.tsx b/x-pack/plugins/cases/public/components/all_cases/columns_popover.test.tsx
new file mode 100644
index 00000000000000..062ed4dd131f4a
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/columns_popover.test.tsx
@@ -0,0 +1,173 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import type { AppMockRenderer } from '../../common/mock';
+import { createAppMockRenderer } from '../../common/mock';
+import { ColumnsPopover } from './columns_popover';
+
+describe('ColumnsPopover', () => {
+  let appMockRenderer: AppMockRenderer;
+
+  beforeEach(() => {
+    appMockRenderer = createAppMockRenderer();
+    jest.clearAllMocks();
+  });
+
+  const selectedColumns = [
+    { field: 'title', name: 'Title', isChecked: true },
+    { field: 'category', name: 'Category', isChecked: false },
+    { field: 'tags', name: 'Tags', isChecked: false },
+  ];
+
+  it('renders correctly a list of selected columns', async () => {
+    appMockRenderer.render(
+      <ColumnsPopover selectedColumns={selectedColumns} onSelectedColumnsChange={() => {}} />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+
+    expect(await screen.findByTestId('column-selection-popover')).toBeInTheDocument();
+
+    selectedColumns.forEach(({ field, name, isChecked }) => {
+      expect(screen.getByTestId(`column-selection-switch-${field}`)).toHaveAttribute(
+        'aria-checked',
+        isChecked.toString()
+      );
+      expect(screen.getByText(name)).toBeInTheDocument();
+    });
+  });
+
+  it('clicking a switch calls onSelectedColumnsChange with the right params', async () => {
+    const onSelectedColumnsChange = jest.fn();
+
+    appMockRenderer.render(
+      <ColumnsPopover
+        selectedColumns={selectedColumns}
+        onSelectedColumnsChange={onSelectedColumnsChange}
+      />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.click(
+      await screen.findByTestId(`column-selection-switch-${selectedColumns[0].field}`),
+      undefined,
+      { skipPointerEventsCheck: true }
+    );
+
+    await waitFor(() => {
+      expect(onSelectedColumnsChange).toHaveBeenCalledWith([
+        { ...selectedColumns[0], isChecked: false },
+        selectedColumns[1],
+        selectedColumns[2],
+      ]);
+    });
+  });
+
+  it('clicking Show All calls onSelectedColumnsChange with the right params', async () => {
+    const onSelectedColumnsChange = jest.fn();
+
+    appMockRenderer.render(
+      <ColumnsPopover
+        selectedColumns={selectedColumns}
+        onSelectedColumnsChange={onSelectedColumnsChange}
+      />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.click(await screen.findByTestId('column-selection-popover-show-all-button'));
+
+    const onSelectedColumnsChangeCallParams = selectedColumns.map((column) => ({
+      ...column,
+      isChecked: true,
+    }));
+
+    await waitFor(() => {
+      expect(onSelectedColumnsChange).toHaveBeenCalledWith(onSelectedColumnsChangeCallParams);
+    });
+  });
+
+  it('clicking Hide All calls onSelectedColumnsChange with the right params', async () => {
+    const onSelectedColumnsChange = jest.fn();
+
+    appMockRenderer.render(
+      <ColumnsPopover
+        selectedColumns={selectedColumns}
+        onSelectedColumnsChange={onSelectedColumnsChange}
+      />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.click(await screen.findByTestId('column-selection-popover-hide-all-button'));
+
+    await waitFor(() => {
+      expect(onSelectedColumnsChange).toHaveBeenCalledWith(
+        selectedColumns.map((column) => ({ ...column, isChecked: false }))
+      );
+    });
+  });
+
+  it('searching for text changes the column list correctly', async () => {
+    appMockRenderer.render(
+      <ColumnsPopover selectedColumns={selectedColumns} onSelectedColumnsChange={() => {}} />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.paste(await screen.findByTestId('column-selection-popover-search'), 'Title');
+
+    expect(await screen.findByTestId('column-selection-switch-title')).toBeInTheDocument();
+    expect(screen.queryByTestId('column-selection-switch-category')).not.toBeInTheDocument();
+    expect(screen.queryByTestId('column-selection-switch-tags')).not.toBeInTheDocument();
+  });
+
+  it('searching for text does not change the list of selected columns', async () => {
+    const onSelectedColumnsChange = jest.fn();
+
+    appMockRenderer.render(
+      <ColumnsPopover
+        selectedColumns={selectedColumns}
+        onSelectedColumnsChange={onSelectedColumnsChange}
+      />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.paste(await screen.findByTestId('column-selection-popover-search'), 'Category');
+
+    expect(onSelectedColumnsChange).not.toHaveBeenCalled();
+  });
+
+  it('searching for text hides the drag and drop icons', async () => {
+    appMockRenderer.render(
+      <ColumnsPopover selectedColumns={selectedColumns} onSelectedColumnsChange={() => {}} />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+
+    expect(await screen.findAllByTestId('column-selection-popover-draggable-icon')).toHaveLength(3);
+
+    userEvent.paste(await screen.findByTestId('column-selection-popover-search'), 'Foobar');
+
+    expect(
+      await screen.queryByTestId('column-selection-popover-draggable-icon')
+    ).not.toBeInTheDocument();
+  });
+
+  it('searching for text disables hideAll and showAll buttons', async () => {
+    appMockRenderer.render(
+      <ColumnsPopover selectedColumns={selectedColumns} onSelectedColumnsChange={() => {}} />
+    );
+
+    userEvent.click(await screen.findByTestId('column-selection-popover-button'));
+    userEvent.paste(await screen.findByTestId('column-selection-popover-search'), 'Foobar');
+
+    expect(await screen.findByTestId('column-selection-popover-show-all-button')).toBeDisabled();
+    expect(await screen.findByTestId('column-selection-popover-hide-all-button')).toBeDisabled();
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/all_cases/columns_popover.tsx b/x-pack/plugins/cases/public/components/all_cases/columns_popover.tsx
new file mode 100644
index 00000000000000..e95afcc159e98e
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/columns_popover.tsx
@@ -0,0 +1,232 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ChangeEvent } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
+
+import type { DropResult } from '@elastic/eui';
+
+import {
+  EuiFieldSearch,
+  EuiHighlight,
+  EuiPopoverFooter,
+  EuiPopoverTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPopover,
+  EuiDragDropContext,
+  EuiButtonEmpty,
+  EuiDraggable,
+  EuiDroppable,
+  EuiPanel,
+  euiDragDropReorder,
+  EuiIcon,
+  EuiSwitch,
+  useEuiTheme,
+} from '@elastic/eui';
+
+import type { CasesColumnSelection } from './types';
+
+import * as i18n from './translations';
+
+interface Props {
+  selectedColumns: CasesColumnSelection[];
+  onSelectedColumnsChange: (columns: CasesColumnSelection[]) => void;
+}
+
+interface ToggleColumnsParams {
+  isChecked: boolean;
+  field?: string;
+}
+
+export const ColumnsPopover: React.FC<Props> = ({
+  selectedColumns,
+  onSelectedColumnsChange,
+}: Props) => {
+  const { euiTheme } = useEuiTheme();
+
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  const togglePopover = useCallback(() => setIsPopoverOpen((prevValue) => !prevValue), []);
+  const closePopover = useCallback(() => setIsPopoverOpen(false), []);
+
+  const [columnSearchText, setColumnSearchText] = useState('');
+
+  const isDragEnabled = columnSearchText.length === 0;
+
+  const toggleColumns = useCallback(
+    ({ isChecked, field }: ToggleColumnsParams) => {
+      const newSelectedColumns = selectedColumns.map((column) => {
+        if (column.field === field || !field) {
+          return { ...column, isChecked };
+        }
+        return column;
+      });
+
+      onSelectedColumnsChange(newSelectedColumns);
+    },
+    [selectedColumns, onSelectedColumnsChange]
+  );
+
+  const showAll = useCallback(() => toggleColumns({ isChecked: true }), [toggleColumns]);
+  const hideAll = useCallback(() => toggleColumns({ isChecked: false }), [toggleColumns]);
+
+  const onDragEnd = ({ source, destination }: DropResult) => {
+    if (source && destination) {
+      const reorderedColumns = euiDragDropReorder(selectedColumns, source.index, destination.index);
+
+      onSelectedColumnsChange(reorderedColumns);
+    }
+  };
+
+  const filteredColumns = useMemo(
+    () =>
+      selectedColumns.filter(
+        ({ name }) => name.toLowerCase().indexOf(columnSearchText.toLowerCase()) !== -1
+      ),
+    [selectedColumns, columnSearchText]
+  );
+
+  return (
+    <EuiPopover
+      isOpen={isPopoverOpen}
+      closePopover={closePopover}
+      panelPaddingSize="s"
+      anchorPosition="leftUp"
+      hasDragDrop
+      zIndex={0}
+      data-test-subj="column-selection-popover"
+      button={
+        <EuiButtonEmpty
+          aria-label={i18n.COLUMNS}
+          className="columns"
+          data-test-subj="column-selection-popover-button"
+          iconType="indexOpen"
+          iconSide="left"
+          onClick={togglePopover}
+          size="xs"
+        >
+          {i18n.COLUMNS}
+        </EuiButtonEmpty>
+      }
+    >
+      <EuiPopoverTitle>
+        <EuiFieldSearch
+          compressed
+          placeholder={i18n.SEARCH}
+          aria-label={i18n.SEARCH_COLUMNS}
+          value={columnSearchText}
+          onChange={(e: ChangeEvent<HTMLInputElement>) =>
+            setColumnSearchText(e.currentTarget.value)
+          }
+          data-test-subj="column-selection-popover-search"
+        />
+      </EuiPopoverTitle>
+      <EuiDragDropContext onDragEnd={onDragEnd}>
+        <EuiFlexGroup
+          css={{ width: 300 }}
+          data-test-subj="column-selection-popover-drag-drop-context"
+        >
+          <EuiFlexItem>
+            <EuiDroppable
+              droppableId="casesColumnDroppableArea"
+              css={
+                isDragEnabled
+                  ? {
+                      paddingBottom: euiTheme.size.base,
+                    }
+                  : {
+                      paddingTop: euiTheme.size.base,
+                    }
+              }
+            >
+              {filteredColumns.map(({ field, name, isChecked }, idx) => (
+                <EuiDraggable
+                  key={field}
+                  index={idx}
+                  draggableId={field}
+                  isDragDisabled={!isDragEnabled}
+                  css={{ height: euiTheme.size.xl, paddingLeft: euiTheme.size.base }}
+                  customDragHandle
+                  hasInteractiveChildren
+                >
+                  {(provided) => (
+                    <EuiFlexGroup alignItems="center" gutterSize="m" justifyContent="spaceBetween">
+                      <EuiFlexItem grow={false}>
+                        <EuiSwitch
+                          label={
+                            <EuiHighlight search={columnSearchText} title={name}>
+                              {name}
+                            </EuiHighlight>
+                          }
+                          checked={isChecked}
+                          data-test-subj={`column-selection-switch-${field}`}
+                          onChange={(e) => toggleColumns({ field, isChecked: e.target.checked })}
+                          compressed
+                          labelProps={{
+                            style: {
+                              textOverflow: 'ellipsis',
+                              whiteSpace: 'nowrap',
+                              width: '190px',
+                              overflow: 'hidden',
+                            },
+                          }}
+                        />
+                      </EuiFlexItem>
+                      {isDragEnabled && (
+                        <EuiFlexItem
+                          grow={false}
+                          data-test-subj="column-selection-popover-draggable-icon"
+                        >
+                          <EuiPanel
+                            color="transparent"
+                            {...provided.dragHandleProps}
+                            aria-label={i18n.DRAG_HANDLE}
+                            grow={false}
+                          >
+                            <EuiIcon type="grab" color="subdued" />
+                          </EuiPanel>
+                        </EuiFlexItem>
+                      )}
+                    </EuiFlexGroup>
+                  )}
+                </EuiDraggable>
+              ))}
+            </EuiDroppable>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiDragDropContext>
+      <EuiPopoverFooter>
+        <EuiFlexGroup gutterSize="s" responsive={false} justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              size="xs"
+              flush="left"
+              onClick={showAll}
+              data-test-subj="column-selection-popover-show-all-button"
+              disabled={!isDragEnabled}
+            >
+              {i18n.SHOW_ALL}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              size="xs"
+              flush="right"
+              onClick={hideAll}
+              data-test-subj="column-selection-popover-hide-all-button"
+              disabled={!isDragEnabled}
+            >
+              {i18n.HIDE_ALL}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPopoverFooter>
+    </EuiPopover>
+  );
+};
+ColumnsPopover.displayName = 'ColumnsPopover';
diff --git a/x-pack/plugins/cases/public/components/all_cases/table.tsx b/x-pack/plugins/cases/public/components/all_cases/table.tsx
index ae60e942dc75ac..e50d54b8a9d6f8 100644
--- a/x-pack/plugins/cases/public/components/all_cases/table.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/table.tsx
@@ -14,7 +14,10 @@ import styled from 'styled-components';
 
 import { CasesTableUtilityBar } from './utility_bar';
 import { LinkButton } from '../links';
+
 import type { CasesFindResponseUI, CasesUI, CaseUI } from '../../../common/ui/types';
+import type { CasesColumnSelection } from './types';
+
 import * as i18n from './translations';
 import { useCreateCaseNavigation } from '../../common/navigation';
 import { useCasesContext } from '../cases_context/use_cases_context';
@@ -35,6 +38,9 @@ interface CasesTableProps {
   tableRef: MutableRefObject<EuiBasicTable | null>;
   tableRowProps: EuiBasicTableProps<CaseUI>['rowProps'];
   deselectCases: () => void;
+  selectedColumns: CasesColumnSelection[];
+  onSelectedColumnsChange: (columns: CasesColumnSelection[]) => void;
+  isLoadingColumns: boolean;
 }
 
 const Div = styled.div`
@@ -57,6 +63,9 @@ export const CasesTable: FunctionComponent<CasesTableProps> = ({
   tableRef,
   tableRowProps,
   deselectCases,
+  selectedColumns,
+  onSelectedColumnsChange,
+  isLoadingColumns,
 }) => {
   const { permissions } = useCasesContext();
   const { getCreateCaseUrl, navigateToCreateCase } = useCreateCaseNavigation();
@@ -72,7 +81,7 @@ export const CasesTable: FunctionComponent<CasesTableProps> = ({
     [goToCreateCase, navigateToCreateCase]
   );
 
-  return isCasesLoading && isDataEmpty ? (
+  return (isCasesLoading && isDataEmpty) || isLoadingColumns ? (
     <Div>
       <EuiSkeletonText data-test-subj="initialLoadingPanelAllCases" lines={10} />
     </Div>
@@ -84,6 +93,8 @@ export const CasesTable: FunctionComponent<CasesTableProps> = ({
         totalCases={data.total ?? 0}
         selectedCases={selectedCases}
         deselectCases={deselectCases}
+        selectedColumns={selectedColumns}
+        onSelectedColumnsChange={onSelectedColumnsChange}
       />
       <EuiBasicTable
         className={classnames({ isSelectorView })}
diff --git a/x-pack/plugins/cases/public/components/all_cases/translations.ts b/x-pack/plugins/cases/public/components/all_cases/translations.ts
index 4c96c351d5ac7d..a041fd58c3f7a1 100644
--- a/x-pack/plugins/cases/public/components/all_cases/translations.ts
+++ b/x-pack/plugins/cases/public/components/all_cases/translations.ts
@@ -176,3 +176,30 @@ export const NO_ATTACHMENTS_ADDED = i18n.translate(
     defaultMessage: 'No attachments added to the case',
   }
 );
+
+export const COLUMNS = i18n.translate('xpack.cases.allCasesView.columnSelection', {
+  defaultMessage: 'Columns',
+});
+
+export const SHOW_ALL = i18n.translate('xpack.cases.allCasesView.columnSelectionShowAll', {
+  defaultMessage: 'Show All',
+});
+
+export const HIDE_ALL = i18n.translate('xpack.cases.allCasesView.columnSelectionHideAll', {
+  defaultMessage: 'Hide All',
+});
+
+export const SEARCH = i18n.translate('xpack.cases.allCasesView.columnSelectionSearch', {
+  defaultMessage: 'Search',
+});
+
+export const SEARCH_COLUMNS = i18n.translate(
+  'xpack.cases.allCasesView.columnSelectionSearchColumns',
+  {
+    defaultMessage: 'Search Columns',
+  }
+);
+
+export const DRAG_HANDLE = i18n.translate('xpack.cases.allCasesView.columnSelectionDragHandle', {
+  defaultMessage: 'Drag Handle',
+});
diff --git a/x-pack/plugins/cases/public/components/all_cases/types.ts b/x-pack/plugins/cases/public/components/all_cases/types.ts
index 8ea90cfb1a63b5..c0872b63cd8921 100644
--- a/x-pack/plugins/cases/public/components/all_cases/types.ts
+++ b/x-pack/plugins/cases/public/components/all_cases/types.ts
@@ -26,3 +26,9 @@ export interface Solution {
   label: string;
   iconType: string;
 }
+
+export interface CasesColumnSelection {
+  field: string;
+  name: string;
+  isChecked: boolean;
+}
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.test.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.test.tsx
index 8c394791836dc3..b61e7548b089eb 100644
--- a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.test.tsx
@@ -13,12 +13,32 @@ import '../../common/mock/match_media';
 import type { GetCasesColumn } from './use_cases_columns';
 import { ExternalServiceColumn, useCasesColumns } from './use_cases_columns';
 import { useGetCasesMockState } from '../../containers/mock';
-import { connectors } from '../configure_cases/__mock__';
+import { connectors, useCaseConfigureResponse } from '../configure_cases/__mock__';
 import type { AppMockRenderer } from '../../common/mock';
 import { createAppMockRenderer, readCasesPermissions, TestProviders } from '../../common/mock';
 import { renderHook } from '@testing-library/react-hooks';
-import { CaseStatuses } from '../../../common/types/domain';
+import { CaseStatuses, CustomFieldTypes } from '../../../common/types/domain';
 import { userProfilesMap } from '../../containers/user_profiles/api.mock';
+import { useGetCaseConfiguration } from '../../containers/configure/use_get_case_configuration';
+
+jest.mock('../../containers/configure/use_get_case_configuration');
+
+const useGetCaseConfigurationMock = useGetCaseConfiguration as jest.Mock;
+
+const DEFAULT_SELECTED_COLUMNS = [
+  { field: 'title', name: 'title', isChecked: true },
+  { field: 'assignees', name: 'assignees', isChecked: true },
+  { field: 'tags', name: 'tags', isChecked: true },
+  { field: 'totalAlerts', name: 'totalAlerts', isChecked: true },
+  { field: 'totalComment', name: 'totalComment', isChecked: true },
+  { field: 'category', name: 'category', isChecked: true },
+  { field: 'createdAt', name: 'createdAt', isChecked: true },
+  { field: 'updatedAt', name: 'updatedAt', isChecked: true },
+  { field: 'closedAt', name: 'closedAt', isChecked: false },
+  { field: 'externalIncident', name: 'externalIncident', isChecked: true },
+  { field: 'status', name: 'status', isChecked: true },
+  { field: 'severity', name: 'severity', isChecked: true },
+];
 
 describe('useCasesColumns ', () => {
   let appMockRender: AppMockRenderer;
@@ -26,24 +46,35 @@ describe('useCasesColumns ', () => {
     filterStatus: CaseStatuses.open,
     userProfiles: userProfilesMap,
     isSelectorView: false,
-    showSolutionColumn: true,
+    selectedColumns: DEFAULT_SELECTED_COLUMNS,
   };
 
   beforeEach(() => {
     jest.clearAllMocks();
     appMockRender = createAppMockRenderer();
+    useGetCaseConfigurationMock.mockImplementation(() => useCaseConfigureResponse);
   });
 
-  it('return all columns correctly', async () => {
+  it('return all selected columns correctly', async () => {
     const license = licensingMock.createLicense({
       license: { type: 'platinum' },
     });
 
     appMockRender = createAppMockRenderer({ license });
 
-    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
-      wrapper: appMockRender.AppWrapper,
-    });
+    const { result } = renderHook(
+      () =>
+        useCasesColumns({
+          ...useCasesColumnsProps,
+          selectedColumns: DEFAULT_SELECTED_COLUMNS.map((element) => ({
+            ...element,
+            isChecked: true,
+          })),
+        }),
+      {
+        wrapper: appMockRender.AppWrapper,
+      }
+    );
 
     expect(result.current).toMatchInlineSnapshot(`
       Object {
@@ -74,12 +105,6 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "width": "80px",
           },
-          Object {
-            "align": "right",
-            "field": "owner",
-            "name": "Solution",
-            "render": [Function],
-          },
           Object {
             "align": "right",
             "field": "totalComment",
@@ -105,6 +130,12 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "sortable": true,
           },
+          Object {
+            "field": "closedAt",
+            "name": "Closed on",
+            "render": [Function],
+            "sortable": true,
+          },
           Object {
             "name": "External incident",
             "render": [Function],
@@ -129,77 +160,22 @@ describe('useCasesColumns ', () => {
             "render": [Function],
           },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
 
-  it('returns the assignees column without the width specified when in the modal view', async () => {
+  it('only returns selected columns', async () => {
     const license = licensingMock.createLicense({
       license: { type: 'platinum' },
     });
 
     appMockRender = createAppMockRenderer({ license });
 
-    const { result } = renderHook(
-      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
-      {
-        wrapper: appMockRender.AppWrapper,
-      }
-    );
-
-    expect(result.current).toMatchInlineSnapshot(`
-      Object {
-        "columns": Array [
-          Object {
-            "field": "title",
-            "name": "Name",
-            "render": [Function],
-            "sortable": true,
-            "width": "55%",
-          },
-          Object {
-            "field": "category",
-            "name": "Category",
-            "render": [Function],
-            "sortable": true,
-            "width": "100px",
-          },
-          Object {
-            "field": "createdAt",
-            "name": "Created on",
-            "render": [Function],
-            "sortable": true,
-          },
-          Object {
-            "field": "severity",
-            "name": "Severity",
-            "render": [Function],
-            "sortable": true,
-            "width": "90px",
-          },
-          Object {
-            "align": "right",
-            "render": [Function],
-          },
-        ],
-      }
-    `);
-  });
-
-  it('does not render the solution columns', async () => {
-    const license = licensingMock.createLicense({
-      license: { type: 'platinum' },
+    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
+      wrapper: appMockRender.AppWrapper,
     });
 
-    appMockRender = createAppMockRenderer({ license });
-
-    const { result } = renderHook(
-      () => useCasesColumns({ ...useCasesColumnsProps, showSolutionColumn: false }),
-      {
-        wrapper: appMockRender.AppWrapper,
-      }
-    );
-
     expect(result.current).toMatchInlineSnapshot(`
       Object {
         "columns": Array [
@@ -278,20 +254,24 @@ describe('useCasesColumns ', () => {
             "render": [Function],
           },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
 
-  it('does not return the alerts column', async () => {
+  it('returns the assignees column without the width specified when in the modal view', async () => {
     const license = licensingMock.createLicense({
       license: { type: 'platinum' },
     });
 
-    appMockRender = createAppMockRenderer({ license, features: { alerts: { enabled: false } } });
+    appMockRender = createAppMockRenderer({ license });
 
-    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
-      wrapper: appMockRender.AppWrapper,
-    });
+    const { result } = renderHook(
+      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
+      {
+        wrapper: appMockRender.AppWrapper,
+      }
+    );
 
     expect(result.current).toMatchInlineSnapshot(`
       Object {
@@ -301,31 +281,7 @@ describe('useCasesColumns ', () => {
             "name": "Name",
             "render": [Function],
             "sortable": true,
-            "width": "20%",
-          },
-          Object {
-            "field": "assignees",
-            "name": "Assignees",
-            "render": [Function],
-            "width": "180px",
-          },
-          Object {
-            "field": "tags",
-            "name": "Tags",
-            "render": [Function],
-            "width": "15%",
-          },
-          Object {
-            "align": "right",
-            "field": "owner",
-            "name": "Solution",
-            "render": [Function],
-          },
-          Object {
-            "align": "right",
-            "field": "totalComment",
-            "name": "Comments",
-            "render": [Function],
+            "width": "55%",
           },
           Object {
             "field": "category",
@@ -340,23 +296,6 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "sortable": true,
           },
-          Object {
-            "field": "updatedAt",
-            "name": "Updated on",
-            "render": [Function],
-            "sortable": true,
-          },
-          Object {
-            "name": "External incident",
-            "render": [Function],
-            "width": undefined,
-          },
-          Object {
-            "field": "status",
-            "name": "Status",
-            "render": [Function],
-            "sortable": true,
-          },
           Object {
             "field": "severity",
             "name": "Severity",
@@ -366,18 +305,21 @@ describe('useCasesColumns ', () => {
           },
           Object {
             "align": "right",
-            "name": "Actions",
             "render": [Function],
           },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
 
-  it('does not return the assignees column', async () => {
-    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
-      wrapper: appMockRender.AppWrapper,
-    });
+  it('shows the select button if isSelectorView=true', async () => {
+    const { result } = renderHook(
+      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
+      {
+        wrapper: appMockRender.AppWrapper,
+      }
+    );
 
     expect(result.current).toMatchInlineSnapshot(`
       Object {
@@ -387,33 +329,56 @@ describe('useCasesColumns ', () => {
             "name": "Name",
             "render": [Function],
             "sortable": true,
-            "width": "20%",
+            "width": "55%",
           },
           Object {
-            "field": "tags",
-            "name": "Tags",
+            "field": "category",
+            "name": "Category",
             "render": [Function],
-            "width": "15%",
+            "sortable": true,
+            "width": "100px",
           },
           Object {
-            "align": "right",
-            "field": "totalAlerts",
-            "name": "Alerts",
+            "field": "createdAt",
+            "name": "Created on",
             "render": [Function],
-            "width": "80px",
+            "sortable": true,
           },
           Object {
-            "align": "right",
-            "field": "owner",
-            "name": "Solution",
+            "field": "severity",
+            "name": "Severity",
             "render": [Function],
+            "sortable": true,
+            "width": "90px",
           },
           Object {
             "align": "right",
-            "field": "totalComment",
-            "name": "Comments",
             "render": [Function],
           },
+        ],
+        "isLoadingColumns": false,
+      }
+    `);
+  });
+
+  it('shows the correct columns if isSelectorView=true', async () => {
+    const { result } = renderHook(
+      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
+      {
+        wrapper: appMockRender.AppWrapper,
+      }
+    );
+
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "columns": Array [
+          Object {
+            "field": "title",
+            "name": "Name",
+            "render": [Function],
+            "sortable": true,
+            "width": "55%",
+          },
           Object {
             "field": "category",
             "name": "Category",
@@ -427,23 +392,6 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "sortable": true,
           },
-          Object {
-            "field": "updatedAt",
-            "name": "Updated on",
-            "render": [Function],
-            "sortable": true,
-          },
-          Object {
-            "name": "External incident",
-            "render": [Function],
-            "width": undefined,
-          },
-          Object {
-            "field": "status",
-            "name": "Status",
-            "render": [Function],
-            "sortable": true,
-          },
           Object {
             "field": "severity",
             "name": "Severity",
@@ -453,23 +401,20 @@ describe('useCasesColumns ', () => {
           },
           Object {
             "align": "right",
-            "name": "Actions",
             "render": [Function],
           },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
 
-  it('shows the closedAt column if the filterStatus=closed', async () => {
-    appMockRender = createAppMockRenderer();
+  it('does not shows the actions if the user does not have the right permissions', async () => {
+    appMockRender = createAppMockRenderer({ permissions: readCasesPermissions() });
 
-    const { result } = renderHook(
-      () => useCasesColumns({ ...useCasesColumnsProps, filterStatus: CaseStatuses.closed }),
-      {
-        wrapper: appMockRender.AppWrapper,
-      }
-    );
+    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
+      wrapper: appMockRender.AppWrapper,
+    });
 
     expect(result.current).toMatchInlineSnapshot(`
       Object {
@@ -494,12 +439,6 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "width": "80px",
           },
-          Object {
-            "align": "right",
-            "field": "owner",
-            "name": "Solution",
-            "render": [Function],
-          },
           Object {
             "align": "right",
             "field": "totalComment",
@@ -514,8 +453,8 @@ describe('useCasesColumns ', () => {
             "width": "100px",
           },
           Object {
-            "field": "closedAt",
-            "name": "Closed on",
+            "field": "createdAt",
+            "name": "Created on",
             "render": [Function],
             "sortable": true,
           },
@@ -543,117 +482,46 @@ describe('useCasesColumns ', () => {
             "sortable": true,
             "width": "90px",
           },
-          Object {
-            "align": "right",
-            "name": "Actions",
-            "render": [Function],
-          },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
 
-  it('shows the select button if isSelectorView=true', async () => {
-    const { result } = renderHook(
-      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
-      {
-        wrapper: appMockRender.AppWrapper,
-      }
-    );
+  it('returns custom field columns', async () => {
+    const textKey = 'text_key';
+    const toggleKey = 'toggle_key';
 
-    expect(result.current).toMatchInlineSnapshot(`
-      Object {
-        "columns": Array [
-          Object {
-            "field": "title",
-            "name": "Name",
-            "render": [Function],
-            "sortable": true,
-            "width": "55%",
-          },
-          Object {
-            "field": "category",
-            "name": "Category",
-            "render": [Function],
-            "sortable": true,
-            "width": "100px",
-          },
-          Object {
-            "field": "createdAt",
-            "name": "Created on",
-            "render": [Function],
-            "sortable": true,
-          },
-          Object {
-            "field": "severity",
-            "name": "Severity",
-            "render": [Function],
-            "sortable": true,
-            "width": "90px",
-          },
-          Object {
-            "align": "right",
-            "render": [Function],
-          },
+    const textLabel = 'Text Label';
+    const toggleLabel = 'Toggle Label';
+
+    appMockRender = createAppMockRenderer({ permissions: readCasesPermissions() });
+    useGetCaseConfigurationMock.mockImplementation(() => ({
+      data: {
+        ...useCaseConfigureResponse.data,
+        customFields: [
+          { key: textKey, label: textLabel, type: CustomFieldTypes.TEXT },
+          { key: toggleKey, label: toggleLabel, type: CustomFieldTypes.TOGGLE },
         ],
-      }
-    `);
-  });
+      },
+      isFetching: false,
+    }));
 
-  it('does not shows the actions if isSelectorView=true', async () => {
     const { result } = renderHook(
-      () => useCasesColumns({ ...useCasesColumnsProps, isSelectorView: true }),
+      () =>
+        useCasesColumns({
+          ...useCasesColumnsProps,
+          selectedColumns: [
+            ...DEFAULT_SELECTED_COLUMNS,
+            { field: textKey, name: textLabel, isChecked: true },
+            { field: toggleKey, name: toggleLabel, isChecked: true },
+          ],
+        }),
       {
         wrapper: appMockRender.AppWrapper,
       }
     );
 
-    expect(result.current).toMatchInlineSnapshot(`
-      Object {
-        "columns": Array [
-          Object {
-            "field": "title",
-            "name": "Name",
-            "render": [Function],
-            "sortable": true,
-            "width": "55%",
-          },
-          Object {
-            "field": "category",
-            "name": "Category",
-            "render": [Function],
-            "sortable": true,
-            "width": "100px",
-          },
-          Object {
-            "field": "createdAt",
-            "name": "Created on",
-            "render": [Function],
-            "sortable": true,
-          },
-          Object {
-            "field": "severity",
-            "name": "Severity",
-            "render": [Function],
-            "sortable": true,
-            "width": "90px",
-          },
-          Object {
-            "align": "right",
-            "render": [Function],
-          },
-        ],
-      }
-    `);
-  });
-
-  it('does not shows the actions if the user does not have the right permissions', async () => {
-    appMockRender = createAppMockRenderer({ permissions: readCasesPermissions() });
-
-    const { result } = renderHook(() => useCasesColumns(useCasesColumnsProps), {
-      wrapper: appMockRender.AppWrapper,
-    });
-
     expect(result.current).toMatchInlineSnapshot(`
       Object {
         "columns": Array [
@@ -677,12 +545,6 @@ describe('useCasesColumns ', () => {
             "render": [Function],
             "width": "80px",
           },
-          Object {
-            "align": "right",
-            "field": "owner",
-            "name": "Solution",
-            "render": [Function],
-          },
           Object {
             "align": "right",
             "field": "totalComment",
@@ -726,7 +588,20 @@ describe('useCasesColumns ', () => {
             "sortable": true,
             "width": "90px",
           },
+          Object {
+            "data-test-subj": "text-custom-field-column",
+            "name": "Text Label",
+            "render": [Function],
+            "width": "250px",
+          },
+          Object {
+            "data-test-subj": "toggle-custom-field-column",
+            "name": "Toggle Label",
+            "render": [Function],
+            "width": "100px",
+          },
         ],
+        "isLoadingColumns": false,
       }
     `);
   });
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.tsx
index 0863e51daef5c0..6ef5dcae9fe6b6 100644
--- a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback } from 'react';
+import React, { useCallback, useMemo } from 'react';
 import type {
   EuiTableActionsColumnType,
   EuiTableComputedColumnType,
@@ -27,22 +27,22 @@ import type { UserProfileWithAvatar } from '@kbn/user-profile-components';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
 
 import type { ActionConnector } from '../../../common/types/domain';
-import { CaseSeverity, CaseStatuses } from '../../../common/types/domain';
+import { CaseSeverity } from '../../../common/types/domain';
 import type { CaseUI } from '../../../common/ui/types';
-import { OWNER_INFO } from '../../../common/constants';
-import { getEmptyTagValue } from '../empty_value';
+import type { CasesColumnSelection } from './types';
+import { getEmptyCellValue } from '../empty_value';
 import { FormattedRelativePreferenceDate } from '../formatted_date';
 import { CaseDetailsLink } from '../links';
 import * as i18n from './translations';
-import { ALERTS } from '../../common/translations';
 import { useActions } from './use_actions';
+import { useCasesColumnsConfiguration } from './use_cases_columns_configuration';
 import { useApplicationCapabilities, useKibana } from '../../common/lib/kibana';
 import { TruncatedText } from '../truncated_text';
 import { getConnectorIcon } from '../utils';
-import type { CasesOwners } from '../../client/helpers/can_use_cases';
 import { severities } from '../severity/config';
-import { useCasesFeatures } from '../../common/use_cases_features';
 import { AssigneesColumn } from './assignees_column';
+import { builderMap as customFieldsBuilderMap } from '../custom_fields/builder';
+import { useGetCaseConfiguration } from '../../containers/configure/use_get_case_configuration';
 
 type CasesColumns =
   | EuiTableActionsColumnType<CaseUI>
@@ -67,34 +67,39 @@ const StyledEuiBadge = euiStyled(EuiBadge)`
 `; // to allow for ellipsis
 
 const renderStringField = (field: string, dataTestSubj: string) =>
-  field != null ? <span data-test-subj={dataTestSubj}>{field}</span> : getEmptyTagValue();
+  field != null ? <span data-test-subj={dataTestSubj}>{field}</span> : getEmptyCellValue();
 
 export interface GetCasesColumn {
   filterStatus: string;
   userProfiles: Map<string, UserProfileWithAvatar>;
   isSelectorView: boolean;
+  selectedColumns: CasesColumnSelection[];
   connectors?: ActionConnector[];
   onRowClick?: (theCase: CaseUI) => void;
-  showSolutionColumn?: boolean;
   disableActions?: boolean;
 }
 
 export interface UseCasesColumnsReturnValue {
   columns: CasesColumns[];
+  isLoadingColumns: boolean;
 }
 
 export const useCasesColumns = ({
-  filterStatus,
   userProfiles,
   isSelectorView,
   connectors = [],
   onRowClick,
-  showSolutionColumn,
   disableActions = false,
+  selectedColumns,
 }: GetCasesColumn): UseCasesColumnsReturnValue => {
-  const { isAlertsEnabled, caseAssignmentAuthorized } = useCasesFeatures();
+  const casesColumnsConfig = useCasesColumnsConfiguration(isSelectorView);
   const { actions } = useActions({ disableActions });
 
+  const {
+    data: { customFields },
+    isFetching: isLoadingColumns,
+  } = useGetCaseConfiguration();
+
   const assignCaseAction = useCallback(
     async (theCase: CaseUI) => {
       if (onRowClick) {
@@ -104,275 +109,270 @@ export const useCasesColumns = ({
     [onRowClick]
   );
 
-  const columns: CasesColumns[] = [
-    {
-      field: 'title',
-      name: i18n.NAME,
-      sortable: true,
-      render: (title: string, theCase: CaseUI) => {
-        if (theCase.id != null && theCase.title != null) {
-          const caseDetailsLinkComponent = isSelectorView ? (
-            theCase.title
-          ) : (
-            <CaseDetailsLink detailName={theCase.id} title={theCase.title}>
-              <TruncatedText text={theCase.title} />
-            </CaseDetailsLink>
-          );
-
-          return caseDetailsLinkComponent;
-        }
-        return getEmptyTagValue();
+  const columnsDict: Record<string, CasesColumns> = useMemo(
+    () => ({
+      title: {
+        field: casesColumnsConfig.title.field,
+        name: casesColumnsConfig.title.name,
+        sortable: true,
+        render: (title: string, theCase: CaseUI) => {
+          if (theCase.id != null && theCase.title != null) {
+            const caseDetailsLinkComponent = isSelectorView ? (
+              theCase.title
+            ) : (
+              <CaseDetailsLink detailName={theCase.id} title={theCase.title}>
+                <TruncatedText text={theCase.title} />
+              </CaseDetailsLink>
+            );
+
+            return caseDetailsLinkComponent;
+          }
+          return getEmptyCellValue();
+        },
+        width: !isSelectorView ? '20%' : '55%',
       },
-      width: !isSelectorView ? '20%' : '55%',
-    },
-  ];
-
-  if (caseAssignmentAuthorized && !isSelectorView) {
-    columns.push({
-      field: 'assignees',
-      name: i18n.ASSIGNEES,
-      render: (assignees: CaseUI['assignees']) => (
-        <AssigneesColumn assignees={assignees} userProfiles={userProfiles} />
-      ),
-      width: '180px',
-    });
-  }
-
-  if (!isSelectorView) {
-    columns.push({
-      field: 'tags',
-      name: i18n.TAGS,
-      render: (tags: CaseUI['tags']) => {
-        if (tags != null && tags.length > 0) {
-          const clampedBadges = (
-            <LineClampedEuiBadgeGroup data-test-subj="case-table-column-tags">
-              {tags.map((tag: string, i: number) => (
-                <StyledEuiBadge
-                  color="hollow"
-                  key={`${tag}-${i}`}
-                  data-test-subj={`case-table-column-tags-${tag}`}
-                >
-                  {tag}
-                </StyledEuiBadge>
-              ))}
-            </LineClampedEuiBadgeGroup>
-          );
-
-          const unclampedBadges = (
-            <EuiBadgeGroup data-test-subj="case-table-column-tags">
-              {tags.map((tag: string, i: number) => (
-                <EuiBadge
-                  color="hollow"
-                  key={`${tag}-${i}`}
-                  data-test-subj={`case-table-column-tags-${tag}`}
-                >
-                  {tag}
-                </EuiBadge>
-              ))}
-            </EuiBadgeGroup>
-          );
-
-          return (
-            <EuiToolTip
-              data-test-subj="case-table-column-tags-tooltip"
-              position="left"
-              content={unclampedBadges}
-            >
-              {clampedBadges}
-            </EuiToolTip>
-          );
-        }
-        return getEmptyTagValue();
+      assignees: {
+        field: casesColumnsConfig.assignees.field,
+        name: casesColumnsConfig.assignees.name,
+        render: (assignees: CaseUI['assignees']) => (
+          <AssigneesColumn assignees={assignees} userProfiles={userProfiles} />
+        ),
+        width: '180px',
       },
-      width: '15%',
-    });
-  }
-
-  if (isAlertsEnabled && !isSelectorView) {
-    columns.push({
-      align: RIGHT_ALIGNMENT,
-      field: 'totalAlerts',
-      name: ALERTS,
-      render: (totalAlerts: CaseUI['totalAlerts']) =>
-        totalAlerts != null
-          ? renderStringField(`${totalAlerts}`, `case-table-column-alertsCount`)
-          : getEmptyTagValue(),
-      width: !isSelectorView ? '80px' : '55px',
-    });
-  }
-
-  if (showSolutionColumn && !isSelectorView) {
-    columns.push({
-      align: RIGHT_ALIGNMENT,
-      field: 'owner',
-      name: i18n.SOLUTION,
-      render: (caseOwner: CasesOwners) => {
-        const ownerInfo = OWNER_INFO[caseOwner];
-        return ownerInfo ? (
-          <EuiIcon
-            size="m"
-            type={ownerInfo.iconType}
-            title={ownerInfo.label}
-            data-test-subj={`case-table-column-owner-icon-${caseOwner}`}
-          />
-        ) : (
-          getEmptyTagValue()
-        );
+      tags: {
+        field: casesColumnsConfig.tags.field,
+        name: casesColumnsConfig.tags.name,
+        render: (tags: CaseUI['tags']) => {
+          if (tags != null && tags.length > 0) {
+            const clampedBadges = (
+              <LineClampedEuiBadgeGroup data-test-subj="case-table-column-tags">
+                {tags.map((tag: string, i: number) => (
+                  <StyledEuiBadge
+                    color="hollow"
+                    key={`${tag}-${i}`}
+                    data-test-subj={`case-table-column-tags-${tag}`}
+                  >
+                    {tag}
+                  </StyledEuiBadge>
+                ))}
+              </LineClampedEuiBadgeGroup>
+            );
+
+            const unclampedBadges = (
+              <EuiBadgeGroup data-test-subj="case-table-column-tags">
+                {tags.map((tag: string, i: number) => (
+                  <EuiBadge
+                    color="hollow"
+                    key={`${tag}-${i}`}
+                    data-test-subj={`case-table-column-tags-${tag}`}
+                  >
+                    {tag}
+                  </EuiBadge>
+                ))}
+              </EuiBadgeGroup>
+            );
+
+            return (
+              <EuiToolTip
+                data-test-subj="case-table-column-tags-tooltip"
+                position="left"
+                content={unclampedBadges}
+              >
+                {clampedBadges}
+              </EuiToolTip>
+            );
+          }
+          return getEmptyCellValue();
+        },
+        width: '15%',
       },
-    });
-  }
-
-  if (!isSelectorView) {
-    columns.push({
-      align: RIGHT_ALIGNMENT,
-      field: 'totalComment',
-      name: i18n.COMMENTS,
-      render: (totalComment: CaseUI['totalComment']) =>
-        totalComment != null
-          ? renderStringField(`${totalComment}`, `case-table-column-commentCount`)
-          : getEmptyTagValue(),
-    });
-  }
-
-  columns.push({
-    field: 'category',
-    name: i18n.CATEGORY,
-    sortable: true,
-    render: (category: CaseUI['category']) => {
-      if (category != null) {
-        return <span data-test-subj={`case-table-column-category-${category}`}>{category}</span>;
-      }
-      return getEmptyTagValue();
-    },
-    width: '100px',
-  });
-
-  if (filterStatus === CaseStatuses.closed) {
-    columns.push({
-      field: 'closedAt',
-      name: i18n.CLOSED_ON,
-      sortable: true,
-      render: (closedAt: CaseUI['closedAt']) => {
-        if (closedAt != null) {
-          return (
-            <span data-test-subj={`case-table-column-closedAt`}>
-              <FormattedRelativePreferenceDate value={closedAt} />
-            </span>
-          );
-        }
-        return getEmptyTagValue();
+      totalAlerts: {
+        field: casesColumnsConfig.totalAlerts.field,
+        name: casesColumnsConfig.totalAlerts.name,
+        align: RIGHT_ALIGNMENT,
+        render: (totalAlerts: CaseUI['totalAlerts']) =>
+          totalAlerts != null
+            ? renderStringField(`${totalAlerts}`, `case-table-column-alertsCount`)
+            : getEmptyCellValue(),
+        width: !isSelectorView ? '80px' : '55px',
       },
-    });
-  } else {
-    columns.push({
-      field: 'createdAt',
-      name: i18n.CREATED_ON,
-      sortable: true,
-      render: (createdAt: CaseUI['createdAt']) => {
-        if (createdAt != null) {
-          return (
-            <span data-test-subj={`case-table-column-createdAt`}>
-              <FormattedRelativePreferenceDate value={createdAt} stripMs={true} />
-            </span>
-          );
-        }
-        return getEmptyTagValue();
+      totalComment: {
+        field: casesColumnsConfig.totalComment.field,
+        name: casesColumnsConfig.totalComment.name,
+        align: RIGHT_ALIGNMENT,
+        render: (totalComment: CaseUI['totalComment']) =>
+          totalComment != null
+            ? renderStringField(`${totalComment}`, `case-table-column-commentCount`)
+            : getEmptyCellValue(),
       },
-    });
-  }
-
-  if (!isSelectorView) {
-    columns.push({
-      field: 'updatedAt',
-      name: i18n.UPDATED_ON,
-      sortable: true,
-      render: (updatedAt: CaseUI['updatedAt']) => {
-        if (updatedAt != null) {
-          return (
-            <span data-test-subj="case-table-column-updatedAt">
-              <FormattedRelativePreferenceDate value={updatedAt} stripMs={true} />
-            </span>
-          );
-        }
-        return getEmptyTagValue();
+      category: {
+        field: casesColumnsConfig.category.field,
+        name: casesColumnsConfig.category.name,
+        sortable: true,
+        render: (category: CaseUI['category']) => {
+          if (category != null) {
+            return (
+              <span data-test-subj={`case-table-column-category-${category}`}>{category}</span>
+            );
+          }
+          return getEmptyCellValue();
+        },
+        width: '100px',
       },
-    });
-  }
-
-  if (!isSelectorView) {
-    columns.push(
-      {
-        name: i18n.EXTERNAL_INCIDENT,
+      closedAt: {
+        field: casesColumnsConfig.closedAt.field,
+        name: casesColumnsConfig.closedAt.name,
+        sortable: true,
+        render: (closedAt: CaseUI['closedAt']) => {
+          if (closedAt != null) {
+            return (
+              <span data-test-subj={`case-table-column-closedAt`}>
+                <FormattedRelativePreferenceDate value={closedAt} />
+              </span>
+            );
+          }
+          return getEmptyCellValue();
+        },
+      },
+      createdAt: {
+        field: casesColumnsConfig.createdAt.field,
+        name: casesColumnsConfig.createdAt.name,
+        sortable: true,
+        render: (createdAt: CaseUI['createdAt']) => {
+          if (createdAt != null) {
+            return (
+              <span data-test-subj={`case-table-column-createdAt`}>
+                <FormattedRelativePreferenceDate value={createdAt} stripMs={true} />
+              </span>
+            );
+          }
+          return getEmptyCellValue();
+        },
+      },
+      updatedAt: {
+        field: casesColumnsConfig.updatedAt.field,
+        name: casesColumnsConfig.updatedAt.name,
+        sortable: true,
+        render: (updatedAt: CaseUI['updatedAt']) => {
+          if (updatedAt != null) {
+            return (
+              <span data-test-subj="case-table-column-updatedAt">
+                <FormattedRelativePreferenceDate value={updatedAt} stripMs={true} />
+              </span>
+            );
+          }
+          return getEmptyCellValue();
+        },
+      },
+      externalIncident: {
+        // no field
+        name: casesColumnsConfig.externalIncident.name,
         render: (theCase: CaseUI) => {
           if (theCase.id != null) {
             return <ExternalServiceColumn theCase={theCase} connectors={connectors} />;
           }
-          return getEmptyTagValue();
+          return getEmptyCellValue();
         },
         width: isSelectorView ? '80px' : undefined,
       },
-      {
-        field: 'status',
-        name: i18n.STATUS,
+      status: {
+        field: casesColumnsConfig.status.field,
+        name: casesColumnsConfig.status.name,
         sortable: true,
         render: (status: CaseUI['status']) => {
           if (status != null) {
             return <Status status={status} />;
           }
 
-          return getEmptyTagValue();
+          return getEmptyCellValue();
         },
-      }
-    );
-  }
-  columns.push({
-    field: 'severity',
-    name: i18n.SEVERITY,
-    sortable: true,
-    render: (severity: CaseUI['severity']) => {
-      if (severity != null) {
-        const severityData = severities[severity ?? CaseSeverity.LOW];
-        return (
-          <EuiHealth
-            data-test-subj={`case-table-column-severity-${severity}`}
-            color={severityData.color}
-          >
-            {severityData.label}
-          </EuiHealth>
-        );
-      }
-      return getEmptyTagValue();
-    },
-    width: '90px',
-  });
+      },
+      severity: {
+        field: casesColumnsConfig.severity.field,
+        name: casesColumnsConfig.severity.name,
+        sortable: true,
+        render: (severity: CaseUI['severity']) => {
+          if (severity != null) {
+            const severityData = severities[severity ?? CaseSeverity.LOW];
+            return (
+              <EuiHealth
+                data-test-subj={`case-table-column-severity-${severity}`}
+                color={severityData.color}
+              >
+                {severityData.label}
+              </EuiHealth>
+            );
+          }
+          return getEmptyCellValue();
+        },
+        width: '90px',
+      },
+      assignCaseAction: {
+        // no field
+        align: RIGHT_ALIGNMENT,
+        render: (theCase: CaseUI) => {
+          if (theCase.id != null) {
+            return (
+              <EuiButton
+                data-test-subj={`cases-table-row-select-${theCase.id}`}
+                onClick={() => {
+                  assignCaseAction(theCase);
+                }}
+                size="s"
+              >
+                {i18n.SELECT}
+              </EuiButton>
+            );
+          }
+          return getEmptyCellValue();
+        },
+      },
+    }),
+    [assignCaseAction, casesColumnsConfig, connectors, isSelectorView, userProfiles]
+  );
 
-  if (isSelectorView) {
-    columns.push({
-      align: RIGHT_ALIGNMENT,
-      render: (theCase: CaseUI) => {
-        if (theCase.id != null) {
-          return (
-            <EuiButton
-              data-test-subj={`cases-table-row-select-${theCase.id}`}
-              onClick={() => {
-                assignCaseAction(theCase);
-              }}
-              size="s"
-            >
-              {i18n.SELECT}
-            </EuiButton>
+  // we need to extend the columnsDict with the columns of
+  // the customFields
+  customFields.forEach(({ key, type, label }) => {
+    if (type in customFieldsBuilderMap) {
+      const columnDefinition = customFieldsBuilderMap[type]().getEuiTableColumn({ label });
+
+      columnsDict[key] = {
+        ...columnDefinition,
+        render: (theCase: CaseUI) => {
+          const customField = theCase.customFields.find(
+            (element) => element.key === key && element.value !== null
           );
-        }
-        return getEmptyTagValue();
-      },
-    });
-  }
 
-  if (!isSelectorView && actions) {
+          if (!customField) {
+            return getEmptyCellValue();
+          }
+
+          return columnDefinition.render(customField);
+        },
+      };
+    }
+  });
+
+  const columns: CasesColumns[] = [];
+
+  selectedColumns.forEach(({ field, isChecked }) => {
+    if (
+      field in columnsDict &&
+      (isChecked || isSelectorView) &&
+      casesColumnsConfig[field].canDisplay
+    ) {
+      columns.push(columnsDict[field]);
+    }
+  });
+
+  if (isSelectorView) {
+    columns.push(columnsDict.assignCaseAction);
+  } else if (actions) {
     columns.push(actions);
   }
 
-  return { columns };
+  return { columns, isLoadingColumns };
 };
 
 interface Props {
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.test.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.test.tsx
new file mode 100644
index 00000000000000..761da1d6316e8b
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.test.tsx
@@ -0,0 +1,199 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { licensingMock } from '@kbn/licensing-plugin/public/mocks';
+import { renderHook } from '@testing-library/react-hooks';
+
+import type { AppMockRenderer } from '../../common/mock';
+import { createAppMockRenderer } from '../../common/mock';
+import { useCasesFeatures } from '../../common/use_cases_features';
+
+import { useCasesColumnsConfiguration } from './use_cases_columns_configuration';
+import { useGetCaseConfiguration } from '../../containers/configure/use_get_case_configuration';
+import { useCaseConfigureResponse } from '../configure_cases/__mock__';
+import { CustomFieldTypes } from '../../../common/types/domain';
+
+jest.mock('../../common/use_cases_features');
+jest.mock('../../containers/configure/use_get_case_configuration');
+
+const useGetCaseConfigurationMock = useGetCaseConfiguration as jest.Mock;
+const useCasesFeaturesMock = useCasesFeatures as jest.Mock;
+
+describe('useCasesColumnsConfiguration ', () => {
+  let appMockRender: AppMockRenderer;
+  const license = licensingMock.createLicense({
+    license: { type: 'platinum' },
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    appMockRender = createAppMockRenderer({ license });
+    useCasesFeaturesMock.mockReturnValue({
+      caseAssignmentAuthorized: true,
+      isAlertsEnabled: true,
+    });
+    useGetCaseConfigurationMock.mockImplementation(() => useCaseConfigureResponse);
+  });
+
+  it('returns all columns correctly', async () => {
+    const { result } = renderHook(() => useCasesColumnsConfiguration(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "assignees": Object {
+          "canDisplay": true,
+          "field": "assignees",
+          "isCheckedDefault": true,
+          "name": "Assignees",
+        },
+        "category": Object {
+          "canDisplay": true,
+          "field": "category",
+          "isCheckedDefault": true,
+          "name": "Category",
+        },
+        "closedAt": Object {
+          "canDisplay": true,
+          "field": "closedAt",
+          "isCheckedDefault": false,
+          "name": "Closed on",
+        },
+        "createdAt": Object {
+          "canDisplay": true,
+          "field": "createdAt",
+          "isCheckedDefault": true,
+          "name": "Created on",
+        },
+        "externalIncident": Object {
+          "canDisplay": true,
+          "field": "externalIncident",
+          "isCheckedDefault": true,
+          "name": "External incident",
+        },
+        "severity": Object {
+          "canDisplay": true,
+          "field": "severity",
+          "isCheckedDefault": true,
+          "name": "Severity",
+        },
+        "status": Object {
+          "canDisplay": true,
+          "field": "status",
+          "isCheckedDefault": true,
+          "name": "Status",
+        },
+        "tags": Object {
+          "canDisplay": true,
+          "field": "tags",
+          "isCheckedDefault": true,
+          "name": "Tags",
+        },
+        "title": Object {
+          "canDisplay": true,
+          "field": "title",
+          "isCheckedDefault": true,
+          "name": "Name",
+        },
+        "totalAlerts": Object {
+          "canDisplay": true,
+          "field": "totalAlerts",
+          "isCheckedDefault": true,
+          "name": "Alerts",
+        },
+        "totalComment": Object {
+          "canDisplay": true,
+          "field": "totalComment",
+          "isCheckedDefault": true,
+          "name": "Comments",
+        },
+        "updatedAt": Object {
+          "canDisplay": true,
+          "field": "updatedAt",
+          "isCheckedDefault": true,
+          "name": "Updated on",
+        },
+      }
+    `);
+  });
+
+  it('cannot display assignees when case assignment is not authorized', async () => {
+    useCasesFeaturesMock.mockReturnValue({
+      caseAssignmentAuthorized: false,
+      isAlertsEnabled: true,
+    });
+
+    const { result } = renderHook(() => useCasesColumnsConfiguration(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current.assignees).toMatchInlineSnapshot(`
+      Object {
+        "canDisplay": false,
+        "field": "assignees",
+        "isCheckedDefault": true,
+        "name": "Assignees",
+      }
+    `);
+  });
+
+  it('cannot display alerts if alerts are not enabled', async () => {
+    useCasesFeaturesMock.mockReturnValue({
+      caseAssignmentAuthorized: true,
+      isAlertsEnabled: false,
+    });
+
+    const { result } = renderHook(() => useCasesColumnsConfiguration(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current.totalAlerts).toMatchInlineSnapshot(`
+      Object {
+        "canDisplay": false,
+        "field": "totalAlerts",
+        "isCheckedDefault": true,
+        "name": "Alerts",
+      }
+    `);
+  });
+
+  it('includes custom field columns correctly', async () => {
+    const textKey = 'text_key';
+    const toggleKey = 'toggle_key';
+
+    const textLabel = 'Text Label';
+    const toggleLabel = 'Toggle Label';
+
+    useGetCaseConfigurationMock.mockImplementation(() => ({
+      data: {
+        ...useCaseConfigureResponse.data,
+        customFields: [
+          { key: textKey, label: textLabel, type: CustomFieldTypes.TEXT },
+          { key: toggleKey, label: toggleLabel, type: CustomFieldTypes.TOGGLE },
+        ],
+      },
+    }));
+
+    const { result } = renderHook(() => useCasesColumnsConfiguration(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current[textKey]).toEqual({
+      field: textKey,
+      name: textLabel,
+      canDisplay: true,
+      isCheckedDefault: false,
+    });
+    expect(result.current[toggleKey]).toEqual({
+      field: toggleKey,
+      name: toggleLabel,
+      canDisplay: true,
+      isCheckedDefault: false,
+    });
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.tsx
new file mode 100644
index 00000000000000..fd795320bcf99c
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_configuration.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as i18n from './translations';
+import { ALERTS } from '../../common/translations';
+import { useCasesFeatures } from '../../common/use_cases_features';
+import { useGetCaseConfiguration } from '../../containers/configure/use_get_case_configuration';
+
+export type CasesColumnsConfiguration = Record<
+  string,
+  {
+    field: string;
+    name: string;
+    canDisplay: boolean;
+    isCheckedDefault: boolean;
+  }
+>;
+
+export const useCasesColumnsConfiguration = (
+  isSelectorView?: boolean
+): CasesColumnsConfiguration => {
+  const { isAlertsEnabled, caseAssignmentAuthorized } = useCasesFeatures();
+  const {
+    data: { customFields },
+  } = useGetCaseConfiguration();
+
+  const canDisplayDefault = true;
+
+  const result: CasesColumnsConfiguration = {
+    title: {
+      field: 'title',
+      name: i18n.NAME,
+      canDisplay: canDisplayDefault,
+      isCheckedDefault: true,
+    },
+    assignees: {
+      field: 'assignees',
+      name: i18n.ASSIGNEES,
+      canDisplay: caseAssignmentAuthorized && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    tags: {
+      field: 'tags',
+      name: i18n.TAGS,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    totalAlerts: {
+      field: 'totalAlerts',
+      name: ALERTS,
+      canDisplay: isAlertsEnabled && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    totalComment: {
+      field: 'totalComment',
+      name: i18n.COMMENTS,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    category: {
+      field: 'category',
+      name: i18n.CATEGORY,
+      canDisplay: canDisplayDefault,
+      isCheckedDefault: true,
+    },
+    closedAt: {
+      field: 'closedAt',
+      name: i18n.CLOSED_ON,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: false,
+    },
+    createdAt: {
+      field: 'createdAt',
+      name: i18n.CREATED_ON,
+      canDisplay: canDisplayDefault,
+      isCheckedDefault: true,
+    },
+    updatedAt: {
+      field: 'updatedAt',
+      name: i18n.UPDATED_ON,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    externalIncident: {
+      field: 'externalIncident',
+      name: i18n.EXTERNAL_INCIDENT,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    status: {
+      field: 'status',
+      name: i18n.STATUS,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: true,
+    },
+    severity: {
+      field: 'severity',
+      name: i18n.SEVERITY,
+      canDisplay: canDisplayDefault,
+      isCheckedDefault: true,
+    },
+  };
+
+  // we need to extend the configuration with the customFields
+  customFields.forEach(({ key, label }) => {
+    result[key] = {
+      field: key,
+      name: label,
+      canDisplay: canDisplayDefault && !isSelectorView,
+      isCheckedDefault: false,
+    };
+  });
+
+  return result;
+};
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.test.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.test.tsx
new file mode 100644
index 00000000000000..98f4e33ee91323
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.test.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { licensingMock } from '@kbn/licensing-plugin/public/mocks';
+import { renderHook } from '@testing-library/react-hooks';
+
+import type { AppMockRenderer } from '../../common/mock';
+
+import { createAppMockRenderer } from '../../common/mock';
+import { useCasesColumnsSelection } from './use_cases_columns_selection';
+import { useCasesColumnsConfiguration } from './use_cases_columns_configuration';
+
+jest.mock('./use_cases_columns_configuration');
+
+const useCasesColumnsConfigurationMock = useCasesColumnsConfiguration as jest.Mock;
+
+const localStorageKey = 'testAppId.cases.list.tableColumns';
+const casesColumnsConfig = {
+  title: {
+    field: 'title',
+    name: 'Name',
+    canDisplay: true,
+  },
+  assignees: {
+    field: 'assignees',
+    name: 'Assignees',
+    canDisplay: true,
+  },
+  tags: {
+    field: 'tags',
+    name: 'Tags',
+    canDisplay: true,
+  },
+};
+
+describe('useCasesColumnsSelection ', () => {
+  let appMockRender: AppMockRenderer;
+  const license = licensingMock.createLicense({
+    license: { type: 'platinum' },
+  });
+
+  beforeEach(() => {
+    appMockRender = createAppMockRenderer({ license });
+
+    useCasesColumnsConfigurationMock.mockReturnValue(casesColumnsConfig);
+
+    localStorage.clear();
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns the expected selectedColumns when the localstorage is empty', async () => {
+    const { result } = renderHook(() => useCasesColumnsSelection(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "selectedColumns": Array [
+          Object {
+            "field": "title",
+            "isChecked": undefined,
+            "name": "Name",
+          },
+          Object {
+            "field": "assignees",
+            "isChecked": undefined,
+            "name": "Assignees",
+          },
+          Object {
+            "field": "tags",
+            "isChecked": undefined,
+            "name": "Tags",
+          },
+        ],
+        "setSelectedColumns": [Function],
+      }
+    `);
+  });
+
+  it('calls mergeSelectedColumnsWithConfiguration with existing localstorage value', async () => {
+    const selectedColumns = [
+      {
+        field: 'title',
+        name: 'Name',
+        isChecked: false,
+      },
+    ];
+
+    localStorage.setItem(localStorageKey, JSON.stringify(selectedColumns));
+
+    const { result } = renderHook(() => useCasesColumnsSelection(), {
+      wrapper: appMockRender.AppWrapper,
+    });
+
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "selectedColumns": Array [
+          Object {
+            "field": "title",
+            "isChecked": false,
+            "name": "Name",
+          },
+          Object {
+            "field": "assignees",
+            "isChecked": undefined,
+            "name": "Assignees",
+          },
+          Object {
+            "field": "tags",
+            "isChecked": undefined,
+            "name": "Tags",
+          },
+        ],
+        "setSelectedColumns": [Function],
+      }
+    `);
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.tsx b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.tsx
new file mode 100644
index 00000000000000..a7c32ee939a198
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/all_cases/use_cases_columns_selection.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import useLocalStorage from 'react-use/lib/useLocalStorage';
+
+import type { CasesColumnSelection } from './types';
+
+import { LOCAL_STORAGE_KEYS } from '../../../common/constants';
+import { useCasesContext } from '../cases_context/use_cases_context';
+import { useCasesColumnsConfiguration } from './use_cases_columns_configuration';
+import { mergeSelectedColumnsWithConfiguration } from './utils';
+
+const getTableColumnsLocalStorageKey = (appId: string) => {
+  const filteringKey = LOCAL_STORAGE_KEYS.casesTableColumns;
+  return `${appId}.${filteringKey}`;
+};
+
+export function useCasesColumnsSelection() {
+  const { appId } = useCasesContext();
+  const casesColumnsConfig = useCasesColumnsConfiguration();
+
+  const [selectedColumns, setSelectedColumns] = useLocalStorage<CasesColumnSelection[]>(
+    getTableColumnsLocalStorageKey(appId)
+  );
+
+  const columns = selectedColumns || [];
+
+  return {
+    selectedColumns: mergeSelectedColumnsWithConfiguration({
+      selectedColumns: columns,
+      casesColumnsConfig,
+    }),
+    setSelectedColumns,
+  };
+}
diff --git a/x-pack/plugins/cases/public/components/all_cases/utility_bar.test.tsx b/x-pack/plugins/cases/public/components/all_cases/utility_bar.test.tsx
index 4d740c2fb9552a..ce776e77e83046 100644
--- a/x-pack/plugins/cases/public/components/all_cases/utility_bar.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/utility_bar.test.tsx
@@ -34,6 +34,8 @@ describe('Severity form field', () => {
       pageSize: 10,
       totalItemCount: 5,
     },
+    selectedColumns: [],
+    onSelectedColumnsChange: jest.fn(),
   };
 
   beforeEach(() => {
@@ -88,11 +90,23 @@ describe('Severity form field', () => {
         pageIndex: 1,
         totalItemCount: 0,
       },
+      selectedColumns: [],
+      onSelectedColumnsChange: jest.fn(),
     };
     appMockRender.render(<CasesTableUtilityBar {...updatedProps} />);
     expect(screen.getByText('Showing 0 of 0 cases')).toBeInTheDocument();
   });
 
+  it('renders columns popover button when isSelectorView=False', async () => {
+    appMockRender.render(<CasesTableUtilityBar {...props} />);
+    expect(screen.getByTestId('column-selection-popover-button')).toBeInTheDocument();
+  });
+
+  it('does not render columns popover button when isSelectorView=True', async () => {
+    appMockRender.render(<CasesTableUtilityBar {...props} isSelectorView={true} />);
+    expect(screen.queryByTestId('column-selection-popover-button')).not.toBeInTheDocument();
+  });
+
   it('opens the bulk actions correctly', async () => {
     appMockRender.render(<CasesTableUtilityBar {...props} />);
 
diff --git a/x-pack/plugins/cases/public/components/all_cases/utility_bar.tsx b/x-pack/plugins/cases/public/components/all_cases/utility_bar.tsx
index 2c2aebdb30bb2a..ee80e0ffb38b18 100644
--- a/x-pack/plugins/cases/public/components/all_cases/utility_bar.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/utility_bar.tsx
@@ -23,10 +23,12 @@ import {
 } from '@elastic/eui';
 import * as i18n from './translations';
 import type { CasesUI } from '../../../common/ui/types';
+import type { CasesColumnSelection } from './types';
 import { MAX_DOCS_PER_PAGE } from '../../../common/constants';
 import { useRefreshCases } from './use_on_refresh_cases';
 import { useBulkActions } from './use_bulk_actions';
 import { useCasesContext } from '../cases_context/use_cases_context';
+import { ColumnsPopover } from './columns_popover';
 
 interface Props {
   isSelectorView?: boolean;
@@ -34,10 +36,20 @@ interface Props {
   selectedCases: CasesUI;
   deselectCases: () => void;
   pagination: Pagination;
+  selectedColumns: CasesColumnSelection[];
+  onSelectedColumnsChange: (columns: CasesColumnSelection[]) => void;
 }
 
 export const CasesTableUtilityBar: FunctionComponent<Props> = React.memo(
-  ({ isSelectorView, totalCases, selectedCases, deselectCases, pagination }) => {
+  ({
+    isSelectorView,
+    totalCases,
+    selectedCases,
+    deselectCases,
+    pagination,
+    selectedColumns,
+    onSelectedColumnsChange,
+  }) => {
     const { euiTheme } = useEuiTheme();
     const refreshCases = useRefreshCases();
     const { permissions, appId } = useCasesContext();
@@ -126,8 +138,8 @@ export const CasesTableUtilityBar: FunctionComponent<Props> = React.memo(
     return (
       <>
         <EuiFlexGroup
+          justifyContent="spaceBetween"
           alignItems="center"
-          justifyContent="flexStart"
           gutterSize="s"
           css={{
             borderBottom: euiTheme.border.thin,
@@ -137,69 +149,81 @@ export const CasesTableUtilityBar: FunctionComponent<Props> = React.memo(
             paddingBottom: euiTheme.size.s,
           }}
         >
-          <EuiFlexItem
-            data-test-subj="case-table-case-count"
-            grow={false}
-            css={{
-              borderRight: euiTheme.border.thin,
-              paddingRight: euiTheme.size.s,
-            }}
-          >
-            <EuiText size="xs" color="subdued">
-              {i18n.SHOWING_CASES(totalCases, visibleCases)}
-            </EuiText>
-          </EuiFlexItem>
-          <EuiFlexItem data-test-subj="case-table-utility-bar-actions" grow={false}>
-            <EuiFlexGroup alignItems="center" justifyContent="flexStart" gutterSize="s">
-              {!isSelectorView && showBulkActions && (
-                <>
-                  <EuiFlexItem data-test-subj="case-table-selected-case-count" grow={false}>
-                    <EuiText size="xs" color="subdued">
-                      {i18n.SHOWING_SELECTED_CASES(selectedCases.length)}
-                    </EuiText>
-                  </EuiFlexItem>
-                  <EuiFlexItem grow={false}>
-                    <EuiPopover
-                      isOpen={isPopoverOpen}
-                      closePopover={closePopover}
-                      panelPaddingSize="none"
-                      data-test-subj="case-table-bulk-actions-popover"
-                      button={
-                        <EuiButtonEmpty
-                          onClick={togglePopover}
-                          size="xs"
-                          iconSide="right"
-                          iconType="arrowDown"
-                          flush="left"
-                          data-test-subj="case-table-bulk-actions-link-icon"
+          <EuiFlexItem grow={false}>
+            <EuiFlexGroup justifyContent="flexStart" gutterSize="s" alignItems="center">
+              <EuiFlexItem
+                data-test-subj="case-table-case-count"
+                grow={false}
+                css={{
+                  borderRight: euiTheme.border.thin,
+                  paddingRight: euiTheme.size.s,
+                }}
+              >
+                <EuiText size="xs" color="subdued">
+                  {i18n.SHOWING_CASES(totalCases, visibleCases)}
+                </EuiText>
+              </EuiFlexItem>
+              <EuiFlexItem data-test-subj="case-table-utility-bar-actions" grow={false}>
+                <EuiFlexGroup alignItems="center" justifyContent="flexStart" gutterSize="s">
+                  {!isSelectorView && showBulkActions && (
+                    <>
+                      <EuiFlexItem data-test-subj="case-table-selected-case-count" grow={false}>
+                        <EuiText size="xs" color="subdued">
+                          {i18n.SHOWING_SELECTED_CASES(selectedCases.length)}
+                        </EuiText>
+                      </EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <EuiPopover
+                          isOpen={isPopoverOpen}
+                          closePopover={closePopover}
+                          panelPaddingSize="none"
+                          data-test-subj="case-table-bulk-actions-popover"
+                          button={
+                            <EuiButtonEmpty
+                              onClick={togglePopover}
+                              size="xs"
+                              iconSide="right"
+                              iconType="arrowDown"
+                              flush="left"
+                              data-test-subj="case-table-bulk-actions-link-icon"
+                            >
+                              {i18n.BULK_ACTIONS}
+                            </EuiButtonEmpty>
+                          }
                         >
-                          {i18n.BULK_ACTIONS}
-                        </EuiButtonEmpty>
-                      }
+                          <EuiContextMenu
+                            panels={panels}
+                            initialPanelId={0}
+                            data-test-subj="case-table-bulk-actions-context-menu"
+                          />
+                        </EuiPopover>
+                      </EuiFlexItem>
+                    </>
+                  )}
+                  <EuiFlexItem grow={false}>
+                    <EuiButtonEmpty
+                      onClick={onRefresh}
+                      size="xs"
+                      iconSide="left"
+                      iconType="refresh"
+                      flush="left"
+                      data-test-subj="all-cases-refresh-link-icon"
                     >
-                      <EuiContextMenu
-                        panels={panels}
-                        initialPanelId={0}
-                        data-test-subj="case-table-bulk-actions-context-menu"
-                      />
-                    </EuiPopover>
+                      {i18n.REFRESH}
+                    </EuiButtonEmpty>
                   </EuiFlexItem>
-                </>
-              )}
-              <EuiFlexItem grow={false}>
-                <EuiButtonEmpty
-                  onClick={onRefresh}
-                  size="xs"
-                  iconSide="left"
-                  iconType="refresh"
-                  flush="left"
-                  data-test-subj="all-cases-refresh-link-icon"
-                >
-                  {i18n.REFRESH}
-                </EuiButtonEmpty>
+                </EuiFlexGroup>
               </EuiFlexItem>
             </EuiFlexGroup>
           </EuiFlexItem>
+          {!isSelectorView && (
+            <EuiFlexItem grow={false}>
+              <ColumnsPopover
+                selectedColumns={selectedColumns}
+                onSelectedColumnsChange={onSelectedColumnsChange}
+              />
+            </EuiFlexItem>
+          )}
         </EuiFlexGroup>
         {modals}
         {flyouts}
diff --git a/x-pack/plugins/cases/public/components/all_cases/utils.test.tsx b/x-pack/plugins/cases/public/components/all_cases/utils.test.tsx
index 6606f2e18d735b..5e5d91e9a5926f 100644
--- a/x-pack/plugins/cases/public/components/all_cases/utils.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/utils.test.tsx
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-import { parseUrlQueryParams } from './utils';
+import type { CasesColumnsConfiguration } from './use_cases_columns_configuration';
+import type { CasesColumnSelection } from './types';
+
+import { mergeSelectedColumnsWithConfiguration, parseUrlQueryParams } from './utils';
 import { DEFAULT_QUERY_PARAMS } from '../../containers/use_get_cases';
 
 const DEFAULT_STRING_QUERY_PARAMS = {
@@ -68,4 +71,78 @@ describe('utils', () => {
       ).toStrictEqual(DEFAULT_QUERY_PARAMS);
     });
   });
+
+  describe('mergeSelectedColumnsWithConfiguration', () => {
+    const mockConfiguration: CasesColumnsConfiguration = {
+      foo: { field: 'foo', name: 'foo', canDisplay: true, isCheckedDefault: true },
+      bar: { field: 'bar', name: 'bar', canDisplay: true, isCheckedDefault: true },
+    };
+    const mockSelectedColumns: CasesColumnSelection[] = [
+      { field: 'foo', name: 'foo', isChecked: true },
+      { field: 'bar', name: 'bar', isChecked: true },
+    ];
+
+    it('does not return selectedColumns without a matching configuration', () => {
+      expect(
+        mergeSelectedColumnsWithConfiguration({
+          selectedColumns: [
+            ...mockSelectedColumns,
+            { field: 'foobar', name: 'foobar', isChecked: true },
+          ],
+          casesColumnsConfig: mockConfiguration,
+        })
+      ).toStrictEqual(mockSelectedColumns);
+    });
+
+    it('does not return selectedColumns with canDisplay value false in configuration', () => {
+      expect(
+        mergeSelectedColumnsWithConfiguration({
+          selectedColumns: mockSelectedColumns,
+          casesColumnsConfig: {
+            ...mockConfiguration,
+            bar: { ...mockConfiguration.bar, canDisplay: false },
+          },
+        })
+      ).toStrictEqual([mockSelectedColumns[0]]);
+    });
+
+    it('does not return selectedColumns without a field in the configuration', () => {
+      expect(
+        mergeSelectedColumnsWithConfiguration({
+          selectedColumns: mockSelectedColumns,
+          casesColumnsConfig: {
+            ...mockConfiguration,
+            bar: { ...mockConfiguration.bar, field: '' },
+          },
+        })
+      ).toStrictEqual([mockSelectedColumns[0]]);
+    });
+
+    it('result contains columns missing in the selectedColumns with isChecked false', () => {
+      expect(
+        mergeSelectedColumnsWithConfiguration({
+          selectedColumns: [],
+          casesColumnsConfig: mockConfiguration,
+        })
+      ).toStrictEqual([
+        { field: 'foo', name: 'foo', isChecked: true },
+        { field: 'bar', name: 'bar', isChecked: true },
+      ]);
+    });
+
+    it('result does not include columns missing in the selectedColumns when canDisplay=false', () => {
+      expect(
+        mergeSelectedColumnsWithConfiguration({
+          selectedColumns: [],
+          casesColumnsConfig: {
+            ...mockConfiguration,
+            foobar: { field: 'foobar', name: 'foobar', canDisplay: false, isCheckedDefault: false },
+          },
+        })
+      ).toStrictEqual([
+        { field: 'foo', name: 'foo', isChecked: true },
+        { field: 'bar', name: 'bar', isChecked: true },
+      ]);
+    });
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/all_cases/utils.ts b/x-pack/plugins/cases/public/components/all_cases/utils.ts
index 834bfa1085755e..82ba4484701a8f 100644
--- a/x-pack/plugins/cases/public/components/all_cases/utils.ts
+++ b/x-pack/plugins/cases/public/components/all_cases/utils.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import { difference } from 'lodash';
 import type { ParsedUrlQueryParams, PartialQueryParams } from '../../../common/ui/types';
+import type { CasesColumnSelection } from './types';
+import type { CasesColumnsConfiguration } from './use_cases_columns_configuration';
 
 export const parseUrlQueryParams = (parsedUrlParams: ParsedUrlQueryParams): PartialQueryParams => {
   const urlParams: PartialQueryParams = {
@@ -28,3 +31,45 @@ export const parseUrlQueryParams = (parsedUrlParams: ParsedUrlQueryParams): Part
 
   return urlParams;
 };
+
+export const mergeSelectedColumnsWithConfiguration = ({
+  selectedColumns,
+  casesColumnsConfig,
+}: {
+  selectedColumns: CasesColumnSelection[];
+  casesColumnsConfig: CasesColumnsConfiguration;
+}): CasesColumnSelection[] => {
+  const result = selectedColumns.reduce((accumulator, { field, isChecked }) => {
+    if (
+      field in casesColumnsConfig &&
+      casesColumnsConfig[field].field !== '' &&
+      casesColumnsConfig[field].canDisplay
+    ) {
+      accumulator.push({
+        field: casesColumnsConfig[field].field,
+        name: casesColumnsConfig[field].name,
+        isChecked,
+      });
+    }
+    return accumulator;
+  }, [] as CasesColumnSelection[]);
+
+  // This will include any new customFields and/or changes to the case attributes
+  const missingColumns = difference(
+    Object.keys(casesColumnsConfig),
+    selectedColumns.map(({ field }) => field)
+  );
+
+  missingColumns.forEach((field) => {
+    // can be an empty string
+    if (casesColumnsConfig[field].field && casesColumnsConfig[field].canDisplay) {
+      result.push({
+        field: casesColumnsConfig[field].field,
+        name: casesColumnsConfig[field].name,
+        isChecked: casesColumnsConfig[field].isCheckedDefault,
+      });
+    }
+  });
+
+  return result;
+};
diff --git a/x-pack/plugins/cases/public/components/case_view/metrics/status.tsx b/x-pack/plugins/cases/public/components/case_view/metrics/status.tsx
index d77d6466a102ed..d6c93417cbcd9e 100644
--- a/x-pack/plugins/cases/public/components/case_view/metrics/status.tsx
+++ b/x-pack/plugins/cases/public/components/case_view/metrics/status.tsx
@@ -21,7 +21,7 @@ import {
 } from './translations';
 import { getMaybeDate } from '../../formatted_date/maybe_date';
 import { FormattedRelativePreferenceDate } from '../../formatted_date';
-import { getEmptyTagValue } from '../../empty_value';
+import { getEmptyCellValue } from '../../empty_value';
 
 export const CaseStatusMetrics = React.memo(
   ({ metrics, features }: { metrics: SingleCaseMetrics; features: SingleCaseMetricsFeature[] }) => {
@@ -112,7 +112,7 @@ const useGetLifespanMetrics = (
 const CreationDate: React.FC<{ date: string }> = React.memo(({ date }) => {
   const creationDate = getMaybeDate(date);
   if (!creationDate.isValid()) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   }
 
   return (
@@ -127,7 +127,7 @@ CreationDate.displayName = 'CreationDate';
 
 const getInProgressDuration = (duration: number) => {
   if (duration <= 0) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   }
 
   return formatDuration(duration);
@@ -190,7 +190,7 @@ CaseStatusMetricsOpenCloseDuration.displayName = 'OpenCloseDuration';
 
 const getOpenCloseDurationText = (value: string | undefined, reopens: string[]) => {
   if (value == null) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   } else if (reopens.length > 0) {
     return `${value} ${CASE_REOPENED}`;
   }
diff --git a/x-pack/plugins/cases/public/components/configure_cases/__mock__/index.tsx b/x-pack/plugins/cases/public/components/configure_cases/__mock__/index.tsx
index 908d270d9cc1e8..c44e5fbc223127 100644
--- a/x-pack/plugins/cases/public/components/configure_cases/__mock__/index.tsx
+++ b/x-pack/plugins/cases/public/components/configure_cases/__mock__/index.tsx
@@ -32,6 +32,7 @@ export const useCaseConfigureResponse = {
     id: '',
   },
   isLoading: false,
+  isFetching: false,
   refetch: jest.fn(),
 };
 
diff --git a/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.test.ts b/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.test.ts
index 0b5a4966ee7304..9ce931b1fa293d 100644
--- a/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.test.ts
+++ b/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.test.ts
@@ -18,6 +18,7 @@ describe('configureTextCustomFieldFactory ', () => {
     expect(builder).toEqual({
       id: 'text',
       label: 'Text',
+      getEuiTableColumn: expect.any(Function),
       build: expect.any(Function),
     });
   });
diff --git a/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.ts b/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.ts
index 0081a2449a3f88..908d7c678d3dd3 100644
--- a/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.ts
+++ b/x-pack/plugins/cases/public/components/custom_fields/text/configure_text_field.ts
@@ -4,11 +4,12 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import type { CustomFieldFactory } from '../types';
 import type { CaseCustomFieldText } from '../../../../common/types/domain';
+
 import { CustomFieldTypes } from '../../../../common/types/domain';
 import * as i18n from '../translations';
+import { getEuiTableColumn } from './get_eui_table_column';
 import { Edit } from './edit';
 import { View } from './view';
 import { Configure } from './configure';
@@ -17,6 +18,7 @@ import { Create } from './create';
 export const configureTextCustomFieldFactory: CustomFieldFactory<CaseCustomFieldText> = () => ({
   id: CustomFieldTypes.TEXT,
   label: i18n.TEXT_LABEL,
+  getEuiTableColumn,
   build: () => ({
     Configure,
     Edit,
diff --git a/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.test.tsx b/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.test.tsx
new file mode 100644
index 00000000000000..4330452fddeef1
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.test.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+
+import { screen } from '@testing-library/react';
+
+import { CustomFieldTypes } from '../../../../common/types/domain';
+import type { AppMockRenderer } from '../../../common/mock';
+import { createAppMockRenderer } from '../../../common/mock';
+import { getEuiTableColumn } from './get_eui_table_column';
+
+describe('getEuiTableColumn ', () => {
+  let appMockRender: AppMockRenderer;
+
+  beforeEach(() => {
+    appMockRender = createAppMockRenderer();
+
+    jest.clearAllMocks();
+  });
+
+  it('returns a name and a render function', async () => {
+    const label = 'MockLabel';
+
+    expect(getEuiTableColumn({ label })).toEqual({
+      name: label,
+      render: expect.any(Function),
+      width: '250px',
+      'data-test-subj': 'text-custom-field-column',
+    });
+  });
+
+  it('render function renders a text column correctly', async () => {
+    const key = 'test_key_1';
+    const value = 'foobar';
+    const column = getEuiTableColumn({ label: 'MockLabel' });
+
+    appMockRender.render(<div>{column.render({ key, type: CustomFieldTypes.TEXT, value })}</div>);
+
+    expect(screen.getByTestId(`text-custom-field-column-view-${key}`)).toBeInTheDocument();
+    expect(screen.getByTestId(`text-custom-field-column-view-${key}`)).toHaveTextContent(value);
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.tsx b/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.tsx
new file mode 100644
index 00000000000000..ceef3b821d356d
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/custom_fields/text/get_eui_table_column.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import type { CaseCustomField } from '../../../../common/types/domain';
+import type { CustomFieldEuiTableColumn } from '../types';
+
+export const getEuiTableColumn = ({ label }: { label: string }): CustomFieldEuiTableColumn => ({
+  name: label,
+  width: '250px',
+  render: (customField: CaseCustomField) => (
+    <p
+      className="eui-textTruncate"
+      data-test-subj={`text-custom-field-column-view-${customField.key}`}
+    >
+      {customField.value}
+    </p>
+  ),
+  'data-test-subj': 'text-custom-field-column',
+});
diff --git a/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_text_field.test.ts b/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_text_field.test.ts
index c32dac659adfe0..2cebda62800a31 100644
--- a/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_text_field.test.ts
+++ b/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_text_field.test.ts
@@ -18,6 +18,7 @@ describe('configureToggleCustomFieldFactory ', () => {
     expect(builder).toEqual({
       id: 'toggle',
       label: 'Toggle',
+      getEuiTableColumn: expect.any(Function),
       build: expect.any(Function),
     });
   });
diff --git a/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_toggle_field.ts b/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_toggle_field.ts
index 00f103fcfdd6a4..5076cff23a21ac 100644
--- a/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_toggle_field.ts
+++ b/x-pack/plugins/cases/public/components/custom_fields/toggle/configure_toggle_field.ts
@@ -7,8 +7,10 @@
 
 import type { CustomFieldFactory } from '../types';
 import type { CaseCustomFieldToggle } from '../../../../common/types/domain';
+
 import { CustomFieldTypes } from '../../../../common/types/domain';
 import * as i18n from '../translations';
+import { getEuiTableColumn } from './get_eui_table_column';
 import { Edit } from './edit';
 import { View } from './view';
 import { Configure } from './configure';
@@ -17,6 +19,7 @@ import { Create } from './create';
 export const configureToggleCustomFieldFactory: CustomFieldFactory<CaseCustomFieldToggle> = () => ({
   id: CustomFieldTypes.TOGGLE,
   label: i18n.TOGGLE_LABEL,
+  getEuiTableColumn,
   build: () => ({
     Configure,
     Edit,
diff --git a/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.test.tsx b/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.test.tsx
new file mode 100644
index 00000000000000..157159342bee25
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.test.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+
+import { screen } from '@testing-library/react';
+
+import { CustomFieldTypes } from '../../../../common/types/domain';
+import type { AppMockRenderer } from '../../../common/mock';
+import { createAppMockRenderer } from '../../../common/mock';
+import { getEuiTableColumn } from './get_eui_table_column';
+
+describe('getEuiTableColumn ', () => {
+  let appMockRender: AppMockRenderer;
+  const key = 'test_key_1';
+
+  beforeEach(() => {
+    appMockRender = createAppMockRenderer();
+    jest.clearAllMocks();
+  });
+
+  it('returns a name and a render function', async () => {
+    const label = 'MockLabel';
+
+    expect(getEuiTableColumn({ label })).toEqual({
+      name: label,
+      render: expect.any(Function),
+      width: '100px',
+      'data-test-subj': 'toggle-custom-field-column',
+    });
+  });
+
+  it.each([
+    ['true', 'check', { key, type: CustomFieldTypes.TOGGLE as const, value: true }],
+    ['false', 'cross', { key, type: CustomFieldTypes.TOGGLE as const, value: false }],
+    ['null', 'cross', { key, type: CustomFieldTypes.TOGGLE as const, value: null }],
+  ])(
+    'render function renders a toggle column with value %s correctly',
+    async (_, expectedResult, customField) => {
+      const label = 'MockLabel';
+      const column = getEuiTableColumn({ label });
+
+      appMockRender.render(<div>{column.render(customField)}</div>);
+
+      expect(
+        screen.getByTestId(`toggle-custom-field-column-view-${key}-${expectedResult}`)
+      ).toBeInTheDocument();
+    }
+  );
+});
diff --git a/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.tsx b/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.tsx
new file mode 100644
index 00000000000000..b60c034cdd8e99
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/custom_fields/toggle/get_eui_table_column.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { EuiIcon } from '@elastic/eui';
+
+import type { CaseCustomField } from '../../../../common/types/domain';
+import type { CustomFieldEuiTableColumn } from '../types';
+
+export const getEuiTableColumn = ({ label }: { label: string }): CustomFieldEuiTableColumn => ({
+  name: label,
+  width: '100px',
+  render: (customField: CaseCustomField) => (
+    <EuiIcon
+      data-test-subj={`toggle-custom-field-column-view-${customField.key}-${
+        customField?.value ? 'check' : 'cross'
+      }`}
+      type={customField?.value ? 'check' : 'cross'}
+    />
+  ),
+  'data-test-subj': 'toggle-custom-field-column',
+});
diff --git a/x-pack/plugins/cases/public/components/custom_fields/types.ts b/x-pack/plugins/cases/public/components/custom_fields/types.ts
index e4cddebe59821b..6e87cbb8c6cd02 100644
--- a/x-pack/plugins/cases/public/components/custom_fields/types.ts
+++ b/x-pack/plugins/cases/public/components/custom_fields/types.ts
@@ -6,8 +6,14 @@
  */
 
 import type React from 'react';
-import type { CustomFieldTypes } from '../../../common/types/domain';
-import type { CasesConfigurationUICustomField, CaseUICustomField } from '../../containers/types';
+import type { EuiTableComputedColumnType } from '@elastic/eui';
+
+import type { CaseCustomField, CustomFieldTypes } from '../../../common/types/domain';
+import type {
+  CasesConfigurationUICustomField,
+  CaseUI,
+  CaseUICustomField,
+} from '../../containers/types';
 
 export interface CustomFieldType<T extends CaseUICustomField> {
   Configure: React.FC;
@@ -27,9 +33,17 @@ export interface CustomFieldType<T extends CaseUICustomField> {
   }>;
 }
 
+export type CustomFieldEuiTableColumn = Pick<
+  EuiTableComputedColumnType<CaseUI>,
+  'name' | 'width' | 'data-test-subj'
+> & {
+  render: (customField: CaseCustomField) => React.ReactNode;
+};
+
 export type CustomFieldFactory<T extends CaseUICustomField> = () => {
   id: string;
   label: string;
+  getEuiTableColumn: (params: { label: string }) => CustomFieldEuiTableColumn;
   build: () => CustomFieldType<T>;
 };
 
diff --git a/x-pack/plugins/cases/public/components/empty_value/empty_value.test.tsx b/x-pack/plugins/cases/public/components/empty_value/empty_value.test.tsx
index 47e6ec259640c4..04863cc558bede 100644
--- a/x-pack/plugins/cases/public/components/empty_value/empty_value.test.tsx
+++ b/x-pack/plugins/cases/public/components/empty_value/empty_value.test.tsx
@@ -14,7 +14,7 @@ import {
   defaultToEmptyTag,
   getEmptyString,
   getEmptyStringTag,
-  getEmptyTagValue,
+  getEmptyCellValue,
   getEmptyValue,
   getOrEmptyTag,
 } from '.';
@@ -43,10 +43,10 @@ describe('EmptyValue', () => {
     });
   });
 
-  describe('#getEmptyTagValue', () => {
+  describe('#getEmptyCellValue', () => {
     const wrapper = mount(
       <ThemeProvider theme={mockTheme}>
-        <p>{getEmptyTagValue()}</p>
+        <p>{getEmptyCellValue()}</p>
       </ThemeProvider>
     );
     test('should return an empty tag value', () => expect(wrapper.text()).toBe('—'));
diff --git a/x-pack/plugins/cases/public/components/empty_value/index.tsx b/x-pack/plugins/cases/public/components/empty_value/index.tsx
index 86efb4a78277ac..c11ac37a304e74 100644
--- a/x-pack/plugins/cases/public/components/empty_value/index.tsx
+++ b/x-pack/plugins/cases/public/components/empty_value/index.tsx
@@ -20,12 +20,12 @@ EmptyWrapper.displayName = 'EmptyWrapper';
 export const getEmptyValue = () => '—';
 export const getEmptyString = () => `(${i18n.EMPTY_STRING})`;
 
-export const getEmptyTagValue = () => <EmptyWrapper>{getEmptyValue()}</EmptyWrapper>;
+export const getEmptyCellValue = () => <EmptyWrapper>{getEmptyValue()}</EmptyWrapper>;
 export const getEmptyStringTag = () => <EmptyWrapper>{getEmptyString()}</EmptyWrapper>;
 
 export const defaultToEmptyTag = <T extends unknown>(item: T): JSX.Element => {
   if (item == null) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   } else if (isString(item) && item === '') {
     return getEmptyStringTag();
   } else {
@@ -40,7 +40,7 @@ export const getOrEmptyTag = (path: string, item: unknown): JSX.Element => {
 
 export const getOrEmptyTagFromValue = (value: string | number | null | undefined): JSX.Element => {
   if (value == null) {
-    return getEmptyTagValue();
+    return getEmptyCellValue();
   } else if (value === '') {
     return getEmptyStringTag();
   } else {
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_open_visualization.tsx b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_open_visualization.tsx
index d9e78330113ee4..d4f6ddee3a6570 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_open_visualization.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_open_visualization.tsx
@@ -8,6 +8,7 @@
 import { useCallback } from 'react';
 import type { TypedLensByValueInput } from '@kbn/lens-plugin/public';
 
+import { isOfAggregateQueryType } from '@kbn/es-query';
 import { AttachmentActionType } from '../../../../client/attachment_framework/types';
 import { useKibana } from '../../../../common/lib/kibana';
 import {
@@ -24,6 +25,8 @@ export const useLensOpenVisualization = ({ comment }: { comment: string }) => {
     lens: { navigateToPrefilledEditor, canUseEditor },
   } = useKibana().services;
 
+  const hasLensPermissions = canUseEditor();
+
   const handleClick = useCallback(() => {
     navigateToPrefilledEditor(
       {
@@ -38,15 +41,26 @@ export const useLensOpenVisualization = ({ comment }: { comment: string }) => {
     );
   }, [lensVisualization, navigateToPrefilledEditor]);
 
+  if (!lensVisualization.length || lensVisualization?.[0]?.attributes == null) {
+    return { canUseEditor: hasLensPermissions, actionConfig: null };
+  }
+
+  const lensAttributes = lensVisualization[0]
+    .attributes as unknown as TypedLensByValueInput['attributes'];
+
+  const isESQLQuery = isOfAggregateQueryType(lensAttributes.state.query);
+
+  if (isESQLQuery) {
+    return { canUseEditor: hasLensPermissions, actionConfig: null };
+  }
+
   return {
-    canUseEditor: canUseEditor(),
-    actionConfig: !lensVisualization.length
-      ? null
-      : {
-          type: AttachmentActionType.BUTTON as const,
-          iconType: 'lensApp',
-          label: OPEN_IN_VISUALIZATION,
-          onClick: handleClick,
-        },
+    canUseEditor: hasLensPermissions,
+    actionConfig: {
+      type: AttachmentActionType.BUTTON as const,
+      iconType: 'lensApp',
+      label: OPEN_IN_VISUALIZATION,
+      onClick: handleClick,
+    },
   };
 };
diff --git a/x-pack/plugins/cases/public/components/visualizations/attachment.test.tsx b/x-pack/plugins/cases/public/components/visualizations/attachment.test.tsx
index 4c5acc11372d86..ab22f3133b49f9 100644
--- a/x-pack/plugins/cases/public/components/visualizations/attachment.test.tsx
+++ b/x-pack/plugins/cases/public/components/visualizations/attachment.test.tsx
@@ -24,7 +24,10 @@ describe('getVisualizationAttachmentType', () => {
 
   const attachmentViewProps: PersistableStateAttachmentViewProps = {
     persistableStateAttachmentTypeId: LENS_ATTACHMENT_TYPE,
-    persistableStateAttachmentState: { attributes: {}, timeRange: {} },
+    persistableStateAttachmentState: {
+      attributes: { state: { query: {} } },
+      timeRange: {},
+    },
     attachmentId: 'test',
     caseData: { title: basicCase.title, id: basicCase.id },
   };
diff --git a/x-pack/plugins/cases/public/components/visualizations/open_lens_button.test.tsx b/x-pack/plugins/cases/public/components/visualizations/open_lens_button.test.tsx
index ed3908c279ac0f..4bd996baa16872 100644
--- a/x-pack/plugins/cases/public/components/visualizations/open_lens_button.test.tsx
+++ b/x-pack/plugins/cases/public/components/visualizations/open_lens_button.test.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { set } from 'lodash';
 import React from 'react';
 import { screen } from '@testing-library/react';
 import type { AppMockRenderer } from '../../common/mock';
@@ -60,4 +61,18 @@ describe('OpenLensButton', () => {
 
     expect(screen.queryByText('Open visualization')).not.toBeInTheDocument();
   });
+
+  it('does not show the button if the query is an ESQL', () => {
+    const esqlProps = {
+      attachmentId: 'test',
+      ...lensVisualization,
+    };
+
+    set(esqlProps, 'attributes.state.query', { esql: '' });
+
+    // @ts-expect-error: props are correct
+    appMockRender.render(<OpenLensButton {...esqlProps} />);
+
+    expect(screen.queryByText('Open visualization')).not.toBeInTheDocument();
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/visualizations/open_lens_button.tsx b/x-pack/plugins/cases/public/components/visualizations/open_lens_button.tsx
index 365f2134a0d0ad..c6a49bb285a2f1 100644
--- a/x-pack/plugins/cases/public/components/visualizations/open_lens_button.tsx
+++ b/x-pack/plugins/cases/public/components/visualizations/open_lens_button.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { isOfAggregateQueryType } from '@kbn/es-query';
 import { EuiButtonEmpty } from '@elastic/eui';
 import React, { useCallback } from 'react';
 import { useKibana } from '../../common/lib/kibana';
@@ -32,8 +33,9 @@ const OpenLensButtonComponent: React.FC<Props> = ({ attachmentId, attributes, ti
   }, [attachmentId, attributes, navigateToPrefilledEditor, timeRange]);
 
   const hasLensPermissions = canUseEditor();
+  const isESQLQuery = isOfAggregateQueryType(attributes.state.query);
 
-  if (!hasLensPermissions) {
+  if (!hasLensPermissions || isESQLQuery) {
     return null;
   }
 
diff --git a/x-pack/plugins/cases/server/client/cases/client.ts b/x-pack/plugins/cases/server/client/cases/client.ts
index 4a3ed9e6c4b055..2c19df9b4c0f1f 100644
--- a/x-pack/plugins/cases/server/client/cases/client.ts
+++ b/x-pack/plugins/cases/server/client/cases/client.ts
@@ -8,7 +8,6 @@
 import type { Case, Cases, User } from '../../../common/types/domain';
 import type {
   CasePostRequest,
-  CasesFindRequest,
   CasesFindResponse,
   CaseResolveResponse,
   CasesBulkGetRequest,
@@ -20,6 +19,7 @@ import type {
   CasesBulkGetResponse,
   BulkCreateCasesRequest,
   BulkCreateCasesResponse,
+  CasesSearchRequest,
 } from '../../../common/types/api';
 import type { CasesClient } from '../client';
 import type { CasesClientInternal } from '../client_internal';
@@ -27,7 +27,7 @@ import type { CasesClientArgs } from '../types';
 import { bulkGet } from './bulk_get';
 import { create } from './create';
 import { deleteCases } from './delete';
-import { find } from './find';
+import { search } from './search';
 import type { CasesByAlertIDParams, GetParams } from './get';
 import { get, resolve, getCasesByAlertID, getReporters, getTags, getCategories } from './get';
 import type { PushParams } from './push';
@@ -52,7 +52,7 @@ export interface CasesSubClient {
    *
    * If the `owner` field is left empty then all the cases that the user has access to will be returned.
    */
-  find(params: CasesFindRequest): Promise<CasesFindResponse>;
+  search(params: CasesSearchRequest): Promise<CasesFindResponse>;
   /**
    * Retrieves a single case with the specified ID.
    */
@@ -111,7 +111,7 @@ export const createCasesSubClient = (
   const casesSubClient: CasesSubClient = {
     create: (data: CasePostRequest) => create(data, clientArgs, casesClient),
     bulkCreate: (data: BulkCreateCasesRequest) => bulkCreate(data, clientArgs, casesClient),
-    find: (params: CasesFindRequest) => find(params, clientArgs),
+    search: (params: CasesSearchRequest) => search(params, clientArgs, casesClient),
     get: (params: GetParams) => get(params, clientArgs),
     resolve: (params: GetParams) => resolve(params, clientArgs),
     bulkGet: (params) => bulkGet(params, clientArgs),
diff --git a/x-pack/plugins/cases/server/client/cases/find.test.ts b/x-pack/plugins/cases/server/client/cases/find.test.ts
deleted file mode 100644
index 8acb91b40c383f..00000000000000
--- a/x-pack/plugins/cases/server/client/cases/find.test.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { v1 as uuidv1 } from 'uuid';
-
-import type { Case } from '../../../common/types/domain';
-
-import {
-  MAX_ASSIGNEES_FILTER_LENGTH,
-  MAX_CASES_PER_PAGE,
-  MAX_CATEGORY_FILTER_LENGTH,
-  MAX_DOCS_PER_PAGE,
-  MAX_REPORTERS_FILTER_LENGTH,
-  MAX_TAGS_FILTER_LENGTH,
-} from '../../../common/constants';
-import { flattenCaseSavedObject } from '../../common/utils';
-import { mockCases } from '../../mocks';
-import { createCasesClientMockArgs, createCasesClientMockFindRequest } from '../mocks';
-import { find } from './find';
-
-describe('find', () => {
-  describe('constructSearch', () => {
-    const clientArgs = createCasesClientMockArgs();
-    const casesMap = new Map<string, Case>(
-      mockCases.map((obj) => {
-        return [obj.id, flattenCaseSavedObject({ savedObject: obj, totalComment: 2 })];
-      })
-    );
-    clientArgs.services.caseService.findCasesGroupedByID.mockResolvedValue({
-      page: 1,
-      perPage: 10,
-      total: casesMap.size,
-      casesMap,
-    });
-    clientArgs.services.caseService.getCaseStatusStats.mockResolvedValue({
-      open: 1,
-      'in-progress': 2,
-      closed: 3,
-    });
-
-    afterEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it('search by uuid updates search term and adds rootSearchFields', async () => {
-      const search = uuidv1();
-      const findRequest = createCasesClientMockFindRequest({ search });
-
-      await find(findRequest, clientArgs);
-      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
-
-      const call = clientArgs.services.caseService.findCasesGroupedByID.mock.calls[0][0];
-
-      expect(call.caseOptions.search).toBe(`"${search}" "cases:${search}"`);
-      expect(call.caseOptions).toHaveProperty('rootSearchFields', ['_id']);
-    });
-
-    it('regular search term does not cause rootSearchFields to be appended', async () => {
-      const search = 'foobar';
-      const findRequest = createCasesClientMockFindRequest({ search });
-      await find(findRequest, clientArgs);
-      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
-
-      const call = clientArgs.services.caseService.findCasesGroupedByID.mock.calls[0][0];
-
-      expect(call.caseOptions.search).toBe(search);
-      expect(call.caseOptions).not.toHaveProperty('rootSearchFields');
-    });
-  });
-
-  describe('errors', () => {
-    const clientArgs = createCasesClientMockArgs();
-
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it('when foo:bar attribute in request payload', async () => {
-      const search = 'sample_text';
-      const findRequest = createCasesClientMockFindRequest({ search });
-      await expect(
-        // @ts-expect-error foo is an invalid field
-        find({ ...findRequest, foo: 'bar' }, clientArgs)
-      ).rejects.toThrowErrorMatchingInlineSnapshot(
-        `"Failed to find cases: {\\"search\\":\\"sample_text\\",\\"searchFields\\":[\\"title\\",\\"description\\"],\\"severity\\":\\"low\\",\\"assignees\\":[],\\"reporters\\":[],\\"status\\":\\"open\\",\\"tags\\":[],\\"owner\\":[],\\"sortField\\":\\"createdAt\\",\\"sortOrder\\":\\"desc\\",\\"foo\\":\\"bar\\"}: Error: invalid keys \\"foo\\""`
-      );
-    });
-
-    it('invalid searchFields with array', async () => {
-      const searchFields = ['foobar'];
-
-      // @ts-expect-error
-      const findRequest = createCasesClientMockFindRequest({ searchFields });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrow(
-        'Error: Invalid value "foobar" supplied to "searchFields"'
-      );
-    });
-
-    it('invalid searchFields with single string', async () => {
-      const searchFields = 'foobar';
-
-      // @ts-expect-error
-      const findRequest = createCasesClientMockFindRequest({ searchFields });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrow(
-        'Error: Invalid value "foobar" supplied to "searchFields"'
-      );
-    });
-
-    it('invalid sortField', async () => {
-      const sortField = 'foobar';
-
-      // @ts-expect-error
-      const findRequest = createCasesClientMockFindRequest({ sortField });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrow(
-        'Error: Invalid value "foobar" supplied to "sortField"'
-      );
-    });
-
-    it(`throws an error when the category array has ${MAX_CATEGORY_FILTER_LENGTH} items`, async () => {
-      const category = Array(MAX_CATEGORY_FILTER_LENGTH + 1).fill('foobar');
-
-      const findRequest = createCasesClientMockFindRequest({ category });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrow(
-        `Error: The length of the field category is too long. Array must be of length <= ${MAX_CATEGORY_FILTER_LENGTH}`
-      );
-    });
-
-    it(`throws an error when the tags array has ${MAX_TAGS_FILTER_LENGTH} items`, async () => {
-      const tags = Array(MAX_TAGS_FILTER_LENGTH + 1).fill('foobar');
-
-      const findRequest = createCasesClientMockFindRequest({ tags });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrowError(
-        `Error: The length of the field tags is too long. Array must be of length <= ${MAX_TAGS_FILTER_LENGTH}`
-      );
-    });
-
-    it(`throws an error when the assignees array has ${MAX_ASSIGNEES_FILTER_LENGTH} items`, async () => {
-      const assignees = Array(MAX_ASSIGNEES_FILTER_LENGTH + 1).fill('foobar');
-
-      const findRequest = createCasesClientMockFindRequest({ assignees });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrowError(
-        `Error: The length of the field assignees is too long. Array must be of length <= ${MAX_ASSIGNEES_FILTER_LENGTH}`
-      );
-    });
-
-    it(`throws an error when the reporters array has ${MAX_REPORTERS_FILTER_LENGTH} items`, async () => {
-      const reporters = Array(MAX_REPORTERS_FILTER_LENGTH + 1).fill('foobar');
-
-      const findRequest = createCasesClientMockFindRequest({ reporters });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrowError(
-        `Error: The length of the field reporters is too long. Array must be of length <= ${MAX_REPORTERS_FILTER_LENGTH}.`
-      );
-    });
-
-    it('Invalid total items results in error', async () => {
-      const findRequest = createCasesClientMockFindRequest({ page: 209, perPage: 100 });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrowError(
-        `Error: The number of documents is too high. Paginating through more than ${MAX_DOCS_PER_PAGE} documents is not possible.`
-      );
-    });
-
-    it('Invalid perPage items results in error', async () => {
-      const findRequest = createCasesClientMockFindRequest({
-        page: 1,
-        perPage: MAX_CASES_PER_PAGE + 1,
-      });
-
-      await expect(find(findRequest, clientArgs)).rejects.toThrowError(
-        `Error: The provided perPage value is too high. The maximum allowed perPage value is ${MAX_CASES_PER_PAGE}.`
-      );
-    });
-  });
-});
diff --git a/x-pack/plugins/cases/server/client/cases/search.test.ts b/x-pack/plugins/cases/server/client/cases/search.test.ts
new file mode 100644
index 00000000000000..0bf0eb6d613209
--- /dev/null
+++ b/x-pack/plugins/cases/server/client/cases/search.test.ts
@@ -0,0 +1,330 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { v1 as uuidv1 } from 'uuid';
+
+import type { Case } from '../../../common/types/domain';
+import { CustomFieldTypes } from '../../../common/types/domain';
+
+import {
+  MAX_ASSIGNEES_FILTER_LENGTH,
+  MAX_CASES_PER_PAGE,
+  MAX_CATEGORY_FILTER_LENGTH,
+  MAX_DOCS_PER_PAGE,
+  MAX_REPORTERS_FILTER_LENGTH,
+  MAX_TAGS_FILTER_LENGTH,
+} from '../../../common/constants';
+import { flattenCaseSavedObject } from '../../common/utils';
+import { mockCases } from '../../mocks';
+import {
+  createCasesClientMock,
+  createCasesClientMockArgs,
+  createCasesClientMockSearchRequest,
+} from '../mocks';
+import { search } from './search';
+
+describe('search', () => {
+  const configureMock = [
+    {
+      customFields: [
+        {
+          key: 'first_key',
+          type: CustomFieldTypes.TEXT,
+          label: 'Text field',
+          required: true,
+        },
+        {
+          key: 'second_key',
+          type: CustomFieldTypes.TOGGLE,
+          label: 'Toggle field',
+          required: true,
+        },
+        {
+          key: 'third_key',
+          type: CustomFieldTypes.TOGGLE,
+          label: 'another toggle field',
+          required: false,
+        },
+      ],
+    },
+  ];
+  const casesClientMock = createCasesClientMock();
+  casesClientMock.configure.get = jest.fn().mockResolvedValue(configureMock);
+
+  describe('constructSearch', () => {
+    const clientArgs = createCasesClientMockArgs();
+    const casesMap = new Map<string, Case>(
+      mockCases.map((obj) => {
+        return [obj.id, flattenCaseSavedObject({ savedObject: obj, totalComment: 2 })];
+      })
+    );
+    clientArgs.services.caseService.findCasesGroupedByID.mockResolvedValue({
+      page: 1,
+      perPage: 10,
+      total: casesMap.size,
+      casesMap,
+    });
+    clientArgs.services.caseService.getCaseStatusStats.mockResolvedValue({
+      open: 1,
+      'in-progress': 2,
+      closed: 3,
+    });
+
+    afterEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('search by uuid updates search term and adds rootSearchFields', async () => {
+      const searchId = uuidv1();
+      const findRequest = createCasesClientMockSearchRequest({ search: searchId });
+
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+
+      const call = clientArgs.services.caseService.findCasesGroupedByID.mock.calls[0][0];
+
+      expect(call.caseOptions.search).toBe(`"${searchId}" "cases:${searchId}"`);
+      expect(call.caseOptions).toHaveProperty('rootSearchFields', ['_id']);
+    });
+
+    it('regular search term does not cause rootSearchFields to be appended', async () => {
+      const searchTerm = 'foobar';
+      const findRequest = createCasesClientMockSearchRequest({ search: searchTerm });
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+
+      const call = clientArgs.services.caseService.findCasesGroupedByID.mock.calls[0][0];
+
+      expect(call.caseOptions.search).toBe(searchTerm);
+      expect(call.caseOptions).not.toHaveProperty('rootSearchFields');
+    });
+
+    it('search with single custom field', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true] },
+        owner: 'cases',
+      });
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+    });
+
+    it('search with single custom field with multiple values', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true, null] },
+        owner: ['cases'],
+      });
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+    });
+
+    it('search with multiple custom fields', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true], third_key: [true] },
+        owner: ['cases'],
+      });
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+    });
+
+    it('search with null custom fields', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [null] },
+        owner: 'cases',
+      });
+      await search(findRequest, clientArgs, casesClientMock);
+      await expect(clientArgs.services.caseService.findCasesGroupedByID).toHaveBeenCalled();
+    });
+  });
+
+  describe('errors', () => {
+    const clientArgs = createCasesClientMockArgs();
+    casesClientMock.configure.get = jest.fn().mockResolvedValue(configureMock);
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('when foo:bar attribute in request payload', async () => {
+      const searchTerm = 'sample_text';
+      const findRequest = createCasesClientMockSearchRequest({ search: searchTerm });
+      await expect(
+        // @ts-expect-error foo is an invalid field
+        search({ ...findRequest, foo: 'bar' }, clientArgs)
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"Failed to find cases: {\\"search\\":\\"sample_text\\",\\"searchFields\\":[\\"title\\",\\"description\\"],\\"severity\\":\\"low\\",\\"assignees\\":[],\\"reporters\\":[],\\"status\\":\\"open\\",\\"tags\\":[],\\"owner\\":[],\\"sortField\\":\\"createdAt\\",\\"sortOrder\\":\\"desc\\",\\"customFields\\":{},\\"foo\\":\\"bar\\"}: Error: invalid keys \\"foo\\""`
+      );
+    });
+
+    it('invalid searchFields with array', async () => {
+      const searchFields = ['foobar'];
+
+      // @ts-expect-error
+      const findRequest = createCasesClientMockSearchRequest({ searchFields });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrow(
+        'Error: Invalid value "foobar" supplied to "searchFields"'
+      );
+    });
+
+    it('invalid searchFields with single string', async () => {
+      const searchFields = 'foobar';
+
+      // @ts-expect-error
+      const findRequest = createCasesClientMockSearchRequest({ searchFields });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrow(
+        'Error: Invalid value "foobar" supplied to "searchFields"'
+      );
+    });
+
+    it('invalid sortField', async () => {
+      const sortField = 'foobar';
+
+      // @ts-expect-error
+      const findRequest = createCasesClientMockSearchRequest({ sortField });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrow(
+        'Error: Invalid value "foobar" supplied to "sortField"'
+      );
+    });
+
+    it(`throws an error when the category array has ${MAX_CATEGORY_FILTER_LENGTH} items`, async () => {
+      const category = Array(MAX_CATEGORY_FILTER_LENGTH + 1).fill('foobar');
+
+      const findRequest = createCasesClientMockSearchRequest({ category });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrow(
+        `Error: The length of the field category is too long. Array must be of length <= ${MAX_CATEGORY_FILTER_LENGTH}`
+      );
+    });
+
+    it(`throws an error when the tags array has ${MAX_TAGS_FILTER_LENGTH} items`, async () => {
+      const tags = Array(MAX_TAGS_FILTER_LENGTH + 1).fill('foobar');
+
+      const findRequest = createCasesClientMockSearchRequest({ tags });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        `Error: The length of the field tags is too long. Array must be of length <= ${MAX_TAGS_FILTER_LENGTH}`
+      );
+    });
+
+    it(`throws an error when the assignees array has ${MAX_ASSIGNEES_FILTER_LENGTH} items`, async () => {
+      const assignees = Array(MAX_ASSIGNEES_FILTER_LENGTH + 1).fill('foobar');
+
+      const findRequest = createCasesClientMockSearchRequest({ assignees });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        `Error: The length of the field assignees is too long. Array must be of length <= ${MAX_ASSIGNEES_FILTER_LENGTH}`
+      );
+    });
+
+    it(`throws an error when the reporters array has ${MAX_REPORTERS_FILTER_LENGTH} items`, async () => {
+      const reporters = Array(MAX_REPORTERS_FILTER_LENGTH + 1).fill('foobar');
+
+      const findRequest = createCasesClientMockSearchRequest({ reporters });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        `Error: The length of the field reporters is too long. Array must be of length <= ${MAX_REPORTERS_FILTER_LENGTH}.`
+      );
+    });
+
+    it('Invalid total items results in error', async () => {
+      const findRequest = createCasesClientMockSearchRequest({ page: 209, perPage: 100 });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        `Error: The number of documents is too high. Paginating through more than ${MAX_DOCS_PER_PAGE} documents is not possible.`
+      );
+    });
+
+    it('Invalid perPage items results in error', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        page: 1,
+        perPage: MAX_CASES_PER_PAGE + 1,
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        `Error: The provided perPage value is too high. The maximum allowed perPage value is ${MAX_CASES_PER_PAGE}.`
+      );
+    });
+
+    it('throws error when search with customFields and no owner', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true] },
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Owner must be provided. Multiple owners are not supported.`
+      );
+    });
+
+    it('throws error when search with customFields and owner as empty string array', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true] },
+        owner: [''],
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Owner must be provided. Multiple owners are not supported.`
+      );
+    });
+
+    it('throws error when search with customFields and multiple owners', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true] },
+        owner: ['cases', 'observability'],
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Owner must be provided. Multiple owners are not supported.`
+      );
+    });
+
+    it('throws error when no customField is not same as configuration', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { test_custom_field_key: [true] },
+        owner: 'cases',
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Invalid custom field key: test_custom_field_key.`
+      );
+    });
+
+    it('throws error when search with non filterable custom field', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { first_key: ['hello'] },
+        owner: 'cases',
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Filtering by custom field of type text is not allowed.`
+      );
+    });
+
+    it('throws error when search with invalid value', async () => {
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: ['hello'] },
+        owner: 'cases',
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: Unsupported filtering value for custom field of type toggle.`
+      );
+    });
+
+    it('throws error when no customFields in configuration', async () => {
+      casesClientMock.configure.get = jest.fn().mockResolvedValue([]);
+      const findRequest = createCasesClientMockSearchRequest({
+        customFields: { second_key: [true] },
+        owner: 'cases',
+      });
+
+      await expect(search(findRequest, clientArgs, casesClientMock)).rejects.toThrowError(
+        ` Error: No custom fields configured.`
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/cases/server/client/cases/find.ts b/x-pack/plugins/cases/server/client/cases/search.ts
similarity index 51%
rename from x-pack/plugins/cases/server/client/cases/find.ts
rename to x-pack/plugins/cases/server/client/cases/search.ts
index c61c4ba71ffde4..554f0c8055aaa8 100644
--- a/x-pack/plugins/cases/server/client/cases/find.ts
+++ b/x-pack/plugins/cases/server/client/cases/search.ts
@@ -5,30 +5,33 @@
  * 2.0.
  */
 
-import { isEmpty } from 'lodash';
+import { isEmpty, isArray } from 'lodash';
 import Boom from '@hapi/boom';
 
-import type { CasesFindRequest, CasesFindResponse } from '../../../common/types/api';
-import { CasesFindRequestRt, CasesFindResponseRt } from '../../../common/types/api';
+import type { CustomFieldsConfiguration } from '../../../common/types/domain';
+import type { CasesSearchRequest, CasesFindResponse } from '../../../common/types/api';
+import { CasesSearchRequestRt, CasesFindResponseRt } from '../../../common/types/api';
 import { decodeWithExcessOrThrow } from '../../../common/api';
 
 import { createCaseError } from '../../common/error';
 import { asArray, transformCases } from '../../common/utils';
 import { constructQueryOptions, constructSearch } from '../utils';
 import { Operations } from '../../authorization';
-import type { CasesClientArgs } from '..';
+import type { CasesClient, CasesClientArgs } from '..';
 import { LICENSING_CASE_ASSIGNMENT_FEATURE } from '../../common/constants';
-import type { CasesFindQueryParams } from '../types';
+import type { CasesSearchParams } from '../types';
 import { decodeOrThrow } from '../../../common/api/runtime_types';
+import { validateSearchCasesCustomFields } from './validators';
 
 /**
  * Retrieves a case and optionally its comments.
  *
  * @ignore
  */
-export const find = async (
-  params: CasesFindRequest,
-  clientArgs: CasesClientArgs
+export const search = async (
+  params: CasesSearchRequest,
+  clientArgs: CasesClientArgs,
+  casesClient: CasesClient
 ): Promise<CasesFindResponse> => {
   const {
     services: { caseService, licensingService },
@@ -39,13 +42,18 @@ export const find = async (
   } = clientArgs;
 
   try {
-    const queryParams = decodeWithExcessOrThrow(CasesFindRequestRt)(params);
+    const paramArgs = decodeWithExcessOrThrow(CasesSearchRequestRt)(params);
+    const configArgs = paramArgs.owner ? { owner: paramArgs.owner } : {};
+    const configurations = await casesClient.configure.get(configArgs);
+    const customFieldsConfiguration: CustomFieldsConfiguration = configurations
+      .map((config) => config.customFields)
+      .flat();
 
     /**
      * Assign users to a case is only available to Platinum+
      */
 
-    if (!isEmpty(queryParams.assignees)) {
+    if (!isEmpty(paramArgs.assignees)) {
       const hasPlatinumLicenseOrGreater = await licensingService.isAtLeastPlatinum();
 
       if (!hasPlatinumLicenseOrGreater) {
@@ -57,39 +65,67 @@ export const find = async (
       licensingService.notifyUsage(LICENSING_CASE_ASSIGNMENT_FEATURE);
     }
 
+    /**
+     * Validate custom fields
+     */
+    if (paramArgs?.customFields && !isEmpty(paramArgs?.customFields)) {
+      /**
+       * throw error if params has customFields and no owner
+       */
+
+      const isValidArray =
+        isArray(paramArgs.owner) &&
+        (!paramArgs.owner.length || paramArgs.owner.length > 1 || isEmpty(paramArgs.owner[0]));
+
+      if (!paramArgs.owner || isValidArray) {
+        throw Boom.badRequest('Owner must be provided. Multiple owners are not supported.');
+      }
+
+      validateSearchCasesCustomFields({
+        customFieldsConfiguration,
+        customFields: paramArgs.customFields,
+      });
+    }
+
     const { filter: authorizationFilter, ensureSavedObjectsAreAuthorized } =
       await authorization.getAuthorizationFilter(Operations.findCases);
 
-    const queryArgs: CasesFindQueryParams = {
-      tags: queryParams.tags,
-      reporters: queryParams.reporters,
-      sortField: queryParams.sortField,
-      status: queryParams.status,
-      severity: queryParams.severity,
-      owner: queryParams.owner,
-      from: queryParams.from,
-      to: queryParams.to,
-      assignees: queryParams.assignees,
-      category: queryParams.category,
+    const options: CasesSearchParams = {
+      tags: paramArgs.tags,
+      reporters: paramArgs.reporters,
+      sortField: paramArgs.sortField,
+      status: paramArgs.status,
+      severity: paramArgs.severity,
+      owner: paramArgs.owner,
+      from: paramArgs.from,
+      to: paramArgs.to,
+      assignees: paramArgs.assignees,
+      category: paramArgs.category,
+      customFields: paramArgs.customFields,
     };
 
     const statusStatsOptions = constructQueryOptions({
-      ...queryArgs,
+      ...options,
       status: undefined,
+      customFieldsConfiguration,
       authorizationFilter,
     });
 
-    const caseQueryOptions = constructQueryOptions({ ...queryArgs, authorizationFilter });
+    const caseQueryOptions = constructQueryOptions({
+      ...options,
+      customFieldsConfiguration,
+      authorizationFilter,
+    });
 
-    const caseSearch = constructSearch(queryParams.search, spaceId, savedObjectsSerializer);
+    const caseSearch = constructSearch(paramArgs.search, spaceId, savedObjectsSerializer);
 
     const [cases, statusStats] = await Promise.all([
       caseService.findCasesGroupedByID({
         caseOptions: {
-          ...queryParams,
+          ...paramArgs,
           ...caseQueryOptions,
           ...caseSearch,
-          searchFields: asArray(queryParams.searchFields),
+          searchFields: asArray(paramArgs.searchFields),
         },
       }),
       caseService.getCaseStatusStats({
diff --git a/x-pack/plugins/cases/server/client/cases/validators.test.ts b/x-pack/plugins/cases/server/client/cases/validators.test.ts
index 888852e6f90ed0..abc4c27385b02d 100644
--- a/x-pack/plugins/cases/server/client/cases/validators.test.ts
+++ b/x-pack/plugins/cases/server/client/cases/validators.test.ts
@@ -7,10 +7,13 @@
 
 import type { CustomFieldsConfiguration, CaseCustomFields } from '../../../common/types/domain';
 import { CustomFieldTypes } from '../../../common/types/domain';
+import type { CasesSearchRequest } from '../../../common/types/api';
+import { MAX_CUSTOM_FIELDS_PER_CASE } from '../../../common/constants';
 import {
   validateCustomFieldKeysAgainstConfiguration,
   validateCustomFieldTypesInRequest,
   validateRequiredCustomFields,
+  validateSearchCasesCustomFields,
 } from './validators';
 
 describe('validators', () => {
@@ -440,4 +443,134 @@ describe('validators', () => {
       );
     });
   });
+
+  describe('validateSearchCasesCustomFields', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    const customFieldsConfiguration: CustomFieldsConfiguration = [
+      {
+        key: 'first_key',
+        type: CustomFieldTypes.TEXT,
+        label: 'Text field',
+        required: true,
+      },
+      {
+        key: 'second_key',
+        type: CustomFieldTypes.TOGGLE,
+        label: 'Toggle field',
+        required: true,
+      },
+    ];
+
+    const customFields: CasesSearchRequest['customFields'] = {
+      second_key: [true],
+    };
+
+    it('does not throw when custom fields are correct', () => {
+      const newConfig = [
+        ...customFieldsConfiguration,
+        {
+          key: 'third_key',
+          type: CustomFieldTypes.TOGGLE,
+          label: 'Another toggle field',
+          required: false,
+        },
+      ];
+
+      const newCustomFields = { ...customFields, third_key: [false] };
+
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration: newConfig,
+          customFields: newCustomFields,
+        })
+      ).not.toThrow();
+    });
+
+    it('does not throw when multiple custom fields', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields,
+        })
+      ).not.toThrow();
+    });
+
+    it('does not throw when custom fields are empty', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: {},
+        })
+      ).not.toThrow();
+    });
+
+    it('does not throw when custom field value is null', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: { second_key: [null] },
+        })
+      ).not.toThrow();
+    });
+
+    it('throws error when custom fields configurations is empty', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration: [],
+          customFields,
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"No custom fields configured."`);
+    });
+
+    it('throws error when custom fields key does not match with configuration', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: { random_key: [true] },
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"Invalid custom field key: random_key."`);
+    });
+
+    it('throws error when custom field is not filterable', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: { first_key: ['hello'] },
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"Filtering by custom field of type text is not allowed."`
+      );
+    });
+
+    it('throws error when custom field is searched with invalid value', () => {
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: { second_key: ['foobar', true, 1234] },
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"Unsupported filtering value for custom field of type toggle."`
+      );
+    });
+
+    it('throws error when custom fields reach maximum', () => {
+      let customFieldsMax = {};
+
+      for (let i = 0; i <= MAX_CUSTOM_FIELDS_PER_CASE + 1; i++) {
+        customFieldsMax = { ...customFieldsMax, [`test_key_${i}`]: [true] };
+      }
+
+      expect(() =>
+        validateSearchCasesCustomFields({
+          customFieldsConfiguration,
+          customFields: customFieldsMax,
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"Maximum ${MAX_CUSTOM_FIELDS_PER_CASE} customFields are allowed."`
+      );
+    });
+  });
 });
diff --git a/x-pack/plugins/cases/server/client/cases/validators.ts b/x-pack/plugins/cases/server/client/cases/validators.ts
index 7817e6646695a6..0d76875be01144 100644
--- a/x-pack/plugins/cases/server/client/cases/validators.ts
+++ b/x-pack/plugins/cases/server/client/cases/validators.ts
@@ -5,11 +5,14 @@
  * 2.0.
  */
 
-import { differenceWith, intersectionWith } from 'lodash';
+import { differenceWith, intersectionWith, isEmpty } from 'lodash';
 import Boom from '@hapi/boom';
 import type { CustomFieldsConfiguration } from '../../../common/types/domain';
-import type { CaseRequestCustomFields } from '../../../common/types/api';
+import type { CaseRequestCustomFields, CasesSearchRequest } from '../../../common/types/api';
 import { validateDuplicatedCustomFieldKeysInRequest } from '../validators';
+import type { ICasesCustomField } from '../../custom_fields';
+import { casesCustomFields } from '../../custom_fields';
+import { MAX_CUSTOM_FIELDS_PER_CASE } from '../../../common/constants';
 
 interface CustomFieldValidationParams {
   requestCustomFields?: CaseRequestCustomFields;
@@ -133,3 +136,43 @@ export const validateRequiredCustomFields = ({
     );
   }
 };
+
+export const validateSearchCasesCustomFields = ({
+  customFieldsConfiguration,
+  customFields,
+}: {
+  customFieldsConfiguration: CustomFieldsConfiguration;
+  customFields: CasesSearchRequest['customFields'];
+}) => {
+  let customFieldsMapping: ICasesCustomField | null = null;
+
+  if (!customFields || isEmpty(customFields)) {
+    return;
+  }
+
+  if (!customFieldsConfiguration.length) {
+    throw Boom.badRequest('No custom fields configured.');
+  }
+
+  if (Object.keys(customFields).length > MAX_CUSTOM_FIELDS_PER_CASE) {
+    throw Boom.badRequest(`Maximum ${MAX_CUSTOM_FIELDS_PER_CASE} customFields are allowed.`);
+  }
+
+  Object.entries(customFields).forEach(([key, value]) => {
+    const customFieldConfig = customFieldsConfiguration.find((config) => config.key === key);
+
+    if (!customFieldConfig) {
+      throw Boom.badRequest(`Invalid custom field key: ${key}.`);
+    }
+
+    customFieldsMapping = casesCustomFields.get(customFieldConfig.type);
+
+    if (!customFieldsMapping?.isFilterable) {
+      throw Boom.badRequest(
+        `Filtering by custom field of type ${customFieldConfig.type} is not allowed.`
+      );
+    }
+
+    customFieldsMapping?.validateFilteringValues(value);
+  });
+};
diff --git a/x-pack/plugins/cases/server/client/mocks.ts b/x-pack/plugins/cases/server/client/mocks.ts
index 7d4015d15a085d..f9d02c094e425b 100644
--- a/x-pack/plugins/cases/server/client/mocks.ts
+++ b/x-pack/plugins/cases/server/client/mocks.ts
@@ -15,7 +15,7 @@ import { actionsClientMock } from '@kbn/actions-plugin/server/actions_client/act
 import { makeLensEmbeddableFactory } from '@kbn/lens-plugin/server/embeddable/make_lens_embeddable_factory';
 import { serializerMock } from '@kbn/core-saved-objects-base-server-mocks';
 
-import type { CasesFindRequest } from '../../common/types/api';
+import type { CasesSearchRequest } from '../../common/types/api';
 import type { CasesClient, CasesClientInternal } from '.';
 import type { AttachmentsSubClient } from './attachments/client';
 import type { CasesSubClient } from './cases/client';
@@ -48,7 +48,7 @@ const createCasesSubClientMock = (): CasesSubClientMock => {
   return {
     create: jest.fn(),
     bulkCreate: jest.fn(),
-    find: jest.fn(),
+    search: jest.fn(),
     resolve: jest.fn(),
     get: jest.fn(),
     bulkGet: jest.fn(),
@@ -213,9 +213,9 @@ export const createCasesClientMockArgs = () => {
   };
 };
 
-export const createCasesClientMockFindRequest = (
-  overwrites?: CasesFindRequest
-): CasesFindRequest => ({
+export const createCasesClientMockSearchRequest = (
+  overwrites?: CasesSearchRequest
+): CasesSearchRequest => ({
   search: '',
   searchFields: ['title', 'description'],
   severity: CaseSeverity.LOW,
@@ -226,5 +226,6 @@ export const createCasesClientMockFindRequest = (
   owner: [],
   sortField: SortFieldCase.createdAt,
   sortOrder: 'desc',
+  customFields: {},
   ...overwrites,
 });
diff --git a/x-pack/plugins/cases/server/client/types.ts b/x-pack/plugins/cases/server/client/types.ts
index 23e35b592efa54..e36b80563e77e3 100644
--- a/x-pack/plugins/cases/server/client/types.ts
+++ b/x-pack/plugins/cases/server/client/types.ts
@@ -14,7 +14,7 @@ import type { IBasePath } from '@kbn/core-http-browser';
 import type { ISavedObjectsSerializer } from '@kbn/core-saved-objects-server';
 import type { KueryNode } from '@kbn/es-query';
 import type { FileServiceStart } from '@kbn/files-plugin/server';
-import type { CasesFindRequest } from '../../common/types/api';
+import type { CasesSearchRequest } from '../../common/types/api';
 import type { Authorization } from '../authorization/authorization';
 import type {
   CaseConfigureService,
@@ -61,9 +61,9 @@ export interface CasesClientArgs {
   readonly fileService: FileServiceStart;
 }
 
-export type CasesFindQueryParams = Partial<
+export type CasesSearchParams = Partial<
   Pick<
-    CasesFindRequest,
+    CasesSearchRequest,
     | 'tags'
     | 'reporters'
     | 'status'
@@ -74,5 +74,6 @@ export type CasesFindQueryParams = Partial<
     | 'assignees'
     | 'category'
     | 'sortField'
+    | 'customFields'
   > & { authorizationFilter?: KueryNode }
 >;
diff --git a/x-pack/plugins/cases/server/client/utils.test.ts b/x-pack/plugins/cases/server/client/utils.test.ts
index 1b4ae12a3f429d..8fb54f907927eb 100644
--- a/x-pack/plugins/cases/server/client/utils.test.ts
+++ b/x-pack/plugins/cases/server/client/utils.test.ts
@@ -8,7 +8,8 @@
 import { v1 as uuidv1 } from 'uuid';
 
 import { DEFAULT_NAMESPACE_STRING } from '@kbn/core-saved-objects-utils-server';
-import { toElasticsearchQuery } from '@kbn/es-query';
+import type { KueryNode } from '@kbn/es-query';
+import { toElasticsearchQuery, toKqlExpression } from '@kbn/es-query';
 
 import { createSavedObjectsSerializerMock } from './mocks';
 import {
@@ -20,7 +21,8 @@ import {
   convertSortField,
 } from './utils';
 import { CasePersistedSeverity, CasePersistedStatus } from '../common/types/case';
-import { CaseSeverity, CaseStatuses } from '../../common/types/domain';
+import type { CustomFieldsConfiguration } from '../../common/types/domain';
+import { CaseSeverity, CaseStatuses, CustomFieldTypes } from '../../common/types/domain';
 
 describe('utils', () => {
   describe('buildFilter', () => {
@@ -674,6 +676,162 @@ describe('utils', () => {
         }
       `);
     });
+
+    describe('customFields', () => {
+      const customFieldsConfiguration: CustomFieldsConfiguration = [
+        {
+          key: 'first_key',
+          type: CustomFieldTypes.TEXT,
+          label: 'Text field',
+          required: true,
+        },
+        {
+          key: 'second_key',
+          type: CustomFieldTypes.TOGGLE,
+          label: 'Toggle field',
+          required: true,
+        },
+        {
+          key: 'third_key',
+          type: CustomFieldTypes.TOGGLE,
+          label: 'another toggle field',
+          required: false,
+        },
+      ];
+
+      it('creates a filter with toggle customField', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { second_key: [true] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"cases.attributes.customFields: { (key: second_key AND value.boolean: true) }"`
+        );
+      });
+
+      it('creates a filter with text customField', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { first_key: ['hello'] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"cases.attributes.customFields: { (key: first_key AND value.string: hello) }"`
+        );
+      });
+
+      it('creates a filter with null customField value', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { first_key: [null] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"cases.attributes.customFields: { (key: first_key AND NOT value: *) }"`
+        );
+      });
+
+      it('creates a filter with multiple customFields', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { second_key: [true], third_key: [false] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"(cases.attributes.customFields: { (key: second_key AND value.boolean: true) } AND cases.attributes.customFields: { (key: third_key AND value.boolean: false) })"`
+        );
+      });
+
+      it('creates a filter with multiple customFields values', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { second_key: [true, null], third_key: [false] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"((cases.attributes.customFields: { (key: second_key AND value.boolean: true) } OR cases.attributes.customFields: { (key: second_key AND NOT value: *) }) AND cases.attributes.customFields: { (key: third_key AND value.boolean: false) })"`
+        );
+      });
+
+      it('creates a filter with only key when value is empty', () => {
+        const kqlFilter = toKqlExpression(
+          constructQueryOptions({
+            customFields: { second_key: [], third_key: [] },
+            customFieldsConfiguration,
+          }).filter as KueryNode
+        );
+
+        expect(kqlFilter).toMatchInlineSnapshot(
+          `"(cases.attributes.customFields: { key: second_key } AND cases.attributes.customFields: { key: third_key })"`
+        );
+      });
+
+      it('does not create a filter when customFields is undefined', () => {
+        expect(
+          constructQueryOptions({
+            customFields: undefined,
+            customFieldsConfiguration,
+          }).filter
+        ).toBeUndefined();
+      });
+
+      it('does not create a filter when customFieldsConfiguration is undefined', () => {
+        expect(
+          constructQueryOptions({
+            customFields: { second_key: [true] },
+            customFieldsConfiguration: undefined,
+          }).filter
+        ).toBeUndefined();
+      });
+
+      it('does not create a filter when customFieldsConfiguration is empty', () => {
+        expect(
+          constructQueryOptions({
+            customFields: { second_key: [true] },
+            customFieldsConfiguration: [],
+          }).filter
+        ).toBeUndefined();
+      });
+
+      it('does not create a filter when customFields key does not match with any key of customFieldsConfiguration', () => {
+        expect(
+          constructQueryOptions({
+            customFields: { random_key: [true] },
+            customFieldsConfiguration,
+          }).filter
+        ).toBeUndefined();
+      });
+
+      it('does not create a filter when no customFields mapping found', () => {
+        const newCustomFieldsConfiguration = [
+          ...customFieldsConfiguration,
+          {
+            key: 'fourth_key',
+            type: 'number',
+            label: 'Number field',
+            required: true,
+          },
+        ];
+
+        expect(
+          constructQueryOptions({
+            customFields: { fourth_key: [1] },
+            // @ts-expect-error: need to create a mapping check
+            customFieldsConfiguration: newCustomFieldsConfiguration,
+          }).filter
+        ).toBeUndefined();
+      });
+    });
   });
 
   describe('arraysDifference', () => {
diff --git a/x-pack/plugins/cases/server/client/utils.ts b/x-pack/plugins/cases/server/client/utils.ts
index 4cd8cb84e45f80..d0911758ca58f9 100644
--- a/x-pack/plugins/cases/server/client/utils.ts
+++ b/x-pack/plugins/cases/server/client/utils.ts
@@ -19,6 +19,7 @@ import { spaceIdToNamespace } from '@kbn/spaces-plugin/server/lib/utils/namespac
 import type {
   CaseSeverity,
   CaseStatuses,
+  CustomFieldsConfiguration,
   ExternalReferenceAttachmentPayload,
 } from '../../common/types/domain';
 import {
@@ -31,7 +32,7 @@ import {
   UserCommentAttachmentPayloadRt,
 } from '../../common/types/domain';
 import type { SavedObjectFindOptionsKueryNode } from '../common/types';
-import type { CasesFindQueryParams } from './types';
+import type { CasesSearchParams } from './types';
 
 import { decodeWithExcessOrThrow } from '../../common/api';
 import {
@@ -54,6 +55,8 @@ import {
 } from '../common/utils';
 import type { ExternalReferenceAttachmentTypeRegistry } from '../attachment_framework/external_reference_registry';
 import type { AttachmentRequest, CasesFindRequestSortFields } from '../../common/types/api';
+import type { ICasesCustomField } from '../custom_fields';
+import { casesCustomFields } from '../custom_fields';
 
 // TODO: I think we can remove most of this function since we're using a different excess
 export const decodeCommentRequest = (
@@ -165,9 +168,7 @@ const addSeverityFilter = (severity: CaseSeverity): KueryNode => {
   );
 };
 
-const buildCategoryFilter = (
-  categories: CasesFindQueryParams['category']
-): KueryNode | undefined => {
+const buildCategoryFilter = (categories: CasesSearchParams['category']): KueryNode | undefined => {
   if (categories === undefined) {
     return;
   }
@@ -302,7 +303,7 @@ export const buildRangeFilter = ({
 export const buildAssigneesFilter = ({
   assignees,
 }: {
-  assignees: CasesFindQueryParams['assignees'];
+  assignees: CasesSearchParams['assignees'];
 }): KueryNode | undefined => {
   if (assignees === undefined) {
     return;
@@ -336,6 +337,64 @@ export const buildAssigneesFilter = ({
   return nodeBuilder.or([...assigneesFilter, filterCasesWithoutAssigneesKueryNode]);
 };
 
+export const buildCustomFieldsFilter = ({
+  customFields,
+  customFieldsConfiguration,
+}: {
+  customFields: CasesSearchParams['customFields'];
+  customFieldsConfiguration?: CustomFieldsConfiguration;
+}): KueryNode | undefined => {
+  if (!customFields || !customFieldsConfiguration?.length) {
+    return;
+  }
+
+  const customFieldsMappings: Array<Record<string, ICasesCustomField>> = [];
+
+  Object.keys(customFields).forEach((item: string) => {
+    const customFieldConfig = customFieldsConfiguration.find((config) => config.key === item);
+
+    if (!customFieldConfig) {
+      return;
+    }
+
+    const mapping = casesCustomFields.get(customFieldConfig.type);
+
+    if (!mapping) {
+      return;
+    }
+
+    customFieldsMappings.push({ [item]: mapping });
+  });
+
+  if (!customFieldsMappings.length) {
+    return;
+  }
+
+  const customFieldsFilter = Object.entries(customFields).map(([key, value]) => {
+    const customFieldMapping = customFieldsMappings.find((mapping) => mapping[key]) ?? {};
+
+    if (!Object.values(value).length) {
+      return fromKueryExpression(`${CASE_SAVED_OBJECT}.attributes.customFields:{key: ${key}}`);
+    }
+
+    return nodeBuilder.or(
+      Object.values(value).map((filterValue) => {
+        if (filterValue === null) {
+          return fromKueryExpression(
+            `${CASE_SAVED_OBJECT}.attributes.customFields:{key: ${key} and (not value:*)}`
+          );
+        }
+
+        return fromKueryExpression(
+          `${CASE_SAVED_OBJECT}.attributes.customFields:{key: ${key} and value.${customFieldMapping[key].savedObjectMappingType}: ${filterValue}}`
+        );
+      })
+    );
+  });
+
+  return nodeBuilder.and([...customFieldsFilter]);
+};
+
 export const constructQueryOptions = ({
   tags,
   reporters,
@@ -348,7 +407,11 @@ export const constructQueryOptions = ({
   to,
   assignees,
   category,
-}: CasesFindQueryParams): SavedObjectFindOptionsKueryNode => {
+  customFields,
+  customFieldsConfiguration,
+}: CasesSearchParams & {
+  customFieldsConfiguration?: CustomFieldsConfiguration;
+}): SavedObjectFindOptionsKueryNode => {
   const tagsFilter = buildFilter({ filters: tags, field: 'tags', operator: 'or' });
   const reportersFilter = createReportersFilter(reporters);
   const sortByField = convertSortField(sortField);
@@ -358,6 +421,7 @@ export const constructQueryOptions = ({
   const rangeFilter = buildRangeFilter({ from, to });
   const assigneesFilter = buildAssigneesFilter({ assignees });
   const categoryFilter = buildCategoryFilter(category);
+  const customFieldsFilter = buildCustomFieldsFilter({ customFields, customFieldsConfiguration });
 
   const filters = combineFilters([
     statusFilter,
@@ -368,6 +432,7 @@ export const constructQueryOptions = ({
     ownerFilter,
     assigneesFilter,
     categoryFilter,
+    customFieldsFilter,
   ]);
 
   return {
diff --git a/x-pack/plugins/cases/server/custom_fields/factory.ts b/x-pack/plugins/cases/server/custom_fields/factory.ts
new file mode 100644
index 00000000000000..d9e1bc86671fe6
--- /dev/null
+++ b/x-pack/plugins/cases/server/custom_fields/factory.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CustomFieldTypes } from '../../common/types/domain';
+import type { ICasesCustomField, CasesCustomFieldsMap } from './types';
+import { getCasesTextCustomField } from './text';
+import { getCasesToggleCustomField } from './toggle';
+
+const mapping: Record<CustomFieldTypes, ICasesCustomField> = {
+  [CustomFieldTypes.TEXT]: getCasesTextCustomField(),
+  [CustomFieldTypes.TOGGLE]: getCasesToggleCustomField(),
+};
+
+export const casesCustomFields: CasesCustomFieldsMap = {
+  get: (type: CustomFieldTypes): ICasesCustomField | null => mapping[type] ?? null,
+};
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/index.ts b/x-pack/plugins/cases/server/custom_fields/index.ts
similarity index 77%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource/index.ts
rename to x-pack/plugins/cases/server/custom_fields/index.ts
index 0656f8593a514c..ace73a6014106e 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/index.ts
+++ b/x-pack/plugins/cases/server/custom_fields/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { CsvSearchSourceExportType } from './csv_searchsource';
+export * from './types';
+export { casesCustomFields } from './factory';
diff --git a/x-pack/plugins/cases/server/custom_fields/text.ts b/x-pack/plugins/cases/server/custom_fields/text.ts
new file mode 100644
index 00000000000000..9a627dce109cc0
--- /dev/null
+++ b/x-pack/plugins/cases/server/custom_fields/text.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Boom from '@hapi/boom';
+import { isString } from 'lodash';
+
+export const getCasesTextCustomField = () => ({
+  isFilterable: false,
+  isSortable: false,
+  savedObjectMappingType: 'string',
+  validateFilteringValues: (values: Array<string | number | boolean | null>) => {
+    values.forEach((value) => {
+      if (value !== null && !isString(value)) {
+        throw Boom.badRequest(`Unsupported filtering value for custom field of type text.`);
+      }
+    });
+  },
+});
diff --git a/x-pack/plugins/cases/server/custom_fields/toggle.ts b/x-pack/plugins/cases/server/custom_fields/toggle.ts
new file mode 100644
index 00000000000000..c250bf85ea168f
--- /dev/null
+++ b/x-pack/plugins/cases/server/custom_fields/toggle.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Boom from '@hapi/boom';
+import { isBoolean } from 'lodash';
+
+export const getCasesToggleCustomField = () => ({
+  isFilterable: true,
+  isSortable: false,
+  savedObjectMappingType: 'boolean',
+  validateFilteringValues: (values: Array<string | number | boolean | null>) => {
+    values.forEach((value) => {
+      if (value !== null && !isBoolean(value)) {
+        throw Boom.badRequest(`Unsupported filtering value for custom field of type toggle.`);
+      }
+    });
+  },
+});
diff --git a/x-pack/plugins/cases/server/custom_fields/types.ts b/x-pack/plugins/cases/server/custom_fields/types.ts
new file mode 100644
index 00000000000000..7a0df91682a689
--- /dev/null
+++ b/x-pack/plugins/cases/server/custom_fields/types.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { CustomFieldTypes } from '../../common/types/domain';
+
+export interface ICasesCustomField {
+  isFilterable: boolean;
+  isSortable: boolean;
+  savedObjectMappingType: string;
+  validateFilteringValues: (values: Array<string | number | boolean | null>) => void;
+}
+
+export interface CasesCustomFieldsMap {
+  get: (type: CustomFieldTypes) => ICasesCustomField | null;
+}
diff --git a/x-pack/plugins/cases/server/files/index.test.ts b/x-pack/plugins/cases/server/files/index.test.ts
index 29c58c8b1d6853..177392660225ce 100644
--- a/x-pack/plugins/cases/server/files/index.test.ts
+++ b/x-pack/plugins/cases/server/files/index.test.ts
@@ -122,6 +122,11 @@ describe('server files', () => {
                 "allowedMimeTypes": Array [
                   "image/png",
                 ],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -160,6 +165,11 @@ describe('server files', () => {
                 "allowedMimeTypes": Array [
                   "image/png",
                 ],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -198,6 +208,11 @@ describe('server files', () => {
                 "allowedMimeTypes": Array [
                   "image/png",
                 ],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -238,6 +253,11 @@ describe('server files', () => {
             Array [
               Object {
                 "allowedMimeTypes": Array [],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -274,6 +294,11 @@ describe('server files', () => {
             Array [
               Object {
                 "allowedMimeTypes": Array [],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -310,6 +335,11 @@ describe('server files', () => {
             Array [
               Object {
                 "allowedMimeTypes": Array [],
+                "hashes": Array [
+                  "md5",
+                  "sha1",
+                  "sha256",
+                ],
                 "http": Object {
                   "create": Object {
                     "tags": Array [
@@ -439,6 +469,11 @@ describe('server files', () => {
                 "application/x-tar",
                 "application/pdf",
               ],
+              "hashes": Array [
+                "md5",
+                "sha1",
+                "sha256",
+              ],
               "http": Object {
                 "create": Object {
                   "tags": Array [
@@ -563,6 +598,11 @@ describe('server files', () => {
                 "application/x-tar",
                 "application/pdf",
               ],
+              "hashes": Array [
+                "md5",
+                "sha1",
+                "sha256",
+              ],
               "http": Object {
                 "create": Object {
                   "tags": Array [
@@ -687,6 +727,11 @@ describe('server files', () => {
                 "application/x-tar",
                 "application/pdf",
               ],
+              "hashes": Array [
+                "md5",
+                "sha1",
+                "sha256",
+              ],
               "http": Object {
                 "create": Object {
                   "tags": Array [
diff --git a/x-pack/plugins/cases/server/files/index.ts b/x-pack/plugins/cases/server/files/index.ts
index af8f0c1440277f..b1e7f6cf9c0f02 100644
--- a/x-pack/plugins/cases/server/files/index.ts
+++ b/x-pack/plugins/cases/server/files/index.ts
@@ -26,6 +26,7 @@ const buildFileKind = (config: FilesConfig, owner: Owner): FileKind => {
     http: fileKindHttpTags(owner),
     maxSizeBytes: createMaxCallback(config),
     allowedMimeTypes: config.allowedMimeTypes,
+    hashes: ['md5', 'sha1', 'sha256'],
   };
 };
 
diff --git a/x-pack/plugins/cases/server/index.ts b/x-pack/plugins/cases/server/index.ts
index b1cadb43f147c6..911c59bc4d46ab 100644
--- a/x-pack/plugins/cases/server/index.ts
+++ b/x-pack/plugins/cases/server/index.ts
@@ -9,7 +9,6 @@ import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core
 export { CasesClient } from './client';
 import type { ConfigType } from './config';
 import { ConfigSchema } from './config';
-import { CasePlugin } from './plugin';
 
 export const config: PluginConfigDescriptor<ConfigType> = {
   schema: ConfigSchema,
@@ -22,7 +21,9 @@ export const config: PluginConfigDescriptor<ConfigType> = {
     renameFromRoot('xpack.case.enabled', 'xpack.cases.enabled', { level: 'critical' }),
   ],
 };
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new CasePlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { CasePlugin } = await import('./plugin');
+  return new CasePlugin(initializerContext);
+};
 
 export type { CasesSetup, CasesStart } from './types';
diff --git a/x-pack/plugins/cases/server/routes/api/cases/find_cases.ts b/x-pack/plugins/cases/server/routes/api/cases/find_cases.ts
index bb14557c58ae5b..1bfb5b4007c114 100644
--- a/x-pack/plugins/cases/server/routes/api/cases/find_cases.ts
+++ b/x-pack/plugins/cases/server/routes/api/cases/find_cases.ts
@@ -17,9 +17,10 @@ export const findCaseRoute = createCasesRoute({
     try {
       const caseContext = await context.cases;
       const casesClient = await caseContext.getCasesClient();
+
       const options = request.query as caseApiV1.CasesFindRequest;
 
-      const res: caseApiV1.CasesFindResponse = await casesClient.cases.find({ ...options });
+      const res: caseApiV1.CasesFindResponse = await casesClient.cases.search({ ...options });
 
       return response.ok({
         body: res,
diff --git a/x-pack/plugins/cases/server/routes/api/get_internal_routes.ts b/x-pack/plugins/cases/server/routes/api/get_internal_routes.ts
index a28d254161d07a..e6c57930645452 100644
--- a/x-pack/plugins/cases/server/routes/api/get_internal_routes.ts
+++ b/x-pack/plugins/cases/server/routes/api/get_internal_routes.ts
@@ -18,6 +18,7 @@ import { bulkDeleteFileAttachments } from './internal/bulk_delete_file_attachmen
 import { getCategoriesRoute } from './cases/categories/get_categories';
 import { getCaseMetricRoute } from './internal/get_case_metrics';
 import { getCasesMetricRoute } from './internal/get_cases_metrics';
+import { searchCasesRoute } from './internal/search_cases';
 
 export const getInternalRoutes = (userProfileService: UserProfileService) =>
   [
@@ -32,4 +33,5 @@ export const getInternalRoutes = (userProfileService: UserProfileService) =>
     getCategoriesRoute,
     getCaseMetricRoute,
     getCasesMetricRoute,
+    searchCasesRoute,
   ] as CaseRoute[];
diff --git a/x-pack/plugins/cases/server/routes/api/internal/search_cases.ts b/x-pack/plugins/cases/server/routes/api/internal/search_cases.ts
new file mode 100644
index 00000000000000..193b9dab706499
--- /dev/null
+++ b/x-pack/plugins/cases/server/routes/api/internal/search_cases.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import Boom from '@hapi/boom';
+
+import { CASES_INTERNAL_URL } from '../../../../common/constants';
+import { createCaseError } from '../../../common/error';
+import { createCasesRoute } from '../create_cases_route';
+import type { caseApiV1 } from '../../../../common/types/api';
+
+export const searchCasesRoute = createCasesRoute({
+  method: 'post',
+  path: `${CASES_INTERNAL_URL}/_search`,
+  handler: async ({ context, request, response }) => {
+    try {
+      const caseContext = await context.cases;
+      const casesClient = await caseContext.getCasesClient();
+
+      const options = request.body as caseApiV1.CasesSearchRequest;
+
+      /**
+       * throw error if request body does not have owner
+       */
+      if (!Object.hasOwn(options, 'owner')) {
+        throw Boom.badRequest('Owner is required.');
+      }
+
+      const res: caseApiV1.CasesFindResponse = await casesClient.cases.search({ ...options });
+
+      return response.ok({
+        body: res,
+      });
+    } catch (error) {
+      throw createCaseError({
+        message: `Failed to find cases in route: ${error}`,
+        error,
+      });
+    }
+  },
+});
diff --git a/x-pack/plugins/cloud/server/index.ts b/x-pack/plugins/cloud/server/index.ts
index 0328ebe89e1cfd..c9d5c44390442a 100644
--- a/x-pack/plugins/cloud/server/index.ts
+++ b/x-pack/plugins/cloud/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CloudPlugin } from './plugin';
 
 export type { CloudSetup, CloudStart } from './plugin';
 export { config } from './config';
-export const plugin = (initializerContext: PluginInitializerContext) => {
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { CloudPlugin } = await import('./plugin');
   return new CloudPlugin(initializerContext);
 };
diff --git a/x-pack/plugins/cloud_defend/server/index.ts b/x-pack/plugins/cloud_defend/server/index.ts
index 2cb2e1c2b55e59..c03b311bd24948 100644
--- a/x-pack/plugins/cloud_defend/server/index.ts
+++ b/x-pack/plugins/cloud_defend/server/index.ts
@@ -6,12 +6,12 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CloudDefendPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CloudDefendPlugin } = await import('./plugin');
   return new CloudDefendPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/cloud_integrations/cloud_chat/server/index.ts b/x-pack/plugins/cloud_integrations/cloud_chat/server/index.ts
index 71f0c7c23355e6..fee69b5f756fc9 100755
--- a/x-pack/plugins/cloud_integrations/cloud_chat/server/index.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_chat/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { CloudChatPlugin } from './plugin';
 
 export { config } from './config';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CloudChatPlugin } = await import('./plugin');
   return new CloudChatPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/cloud_integrations/cloud_data_migration/server/index.ts b/x-pack/plugins/cloud_integrations/cloud_data_migration/server/index.ts
index 5d5388e653cc8d..91f0552696baed 100644
--- a/x-pack/plugins/cloud_integrations/cloud_data_migration/server/index.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_data_migration/server/index.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-import { CloudDataMigrationPlugin } from './plugin';
-
 export { config } from './config';
 
-export const plugin = () => new CloudDataMigrationPlugin();
+export const plugin = async () => {
+  const { CloudDataMigrationPlugin } = await import('./plugin');
+  return new CloudDataMigrationPlugin();
+};
diff --git a/x-pack/plugins/cloud_integrations/cloud_experiments/server/index.ts b/x-pack/plugins/cloud_integrations/cloud_experiments/server/index.ts
index 6222c8108c0f56..ebf82f07ea4c9e 100755
--- a/x-pack/plugins/cloud_integrations/cloud_experiments/server/index.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_experiments/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { CloudExperimentsPlugin } from './plugin';
 
 export { config } from './config';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CloudExperimentsPlugin } = await import('./plugin');
   return new CloudExperimentsPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.test.ts b/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.test.ts
index 5f241f3ee7f9be..836cafa8ac7afb 100644
--- a/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.test.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.test.ts
@@ -20,9 +20,11 @@ describe('Cloud Plugin', () => {
       const setupPlugin = async ({
         config = {},
         isCloudEnabled = true,
+        isElasticStaffOwned = false,
       }: {
         config?: Partial<CloudFullStoryConfigType>;
         isCloudEnabled?: boolean;
+        isElasticStaffOwned?: boolean;
       }) => {
         const initContext = coreMock.createPluginInitializerContext(config);
 
@@ -30,7 +32,7 @@ describe('Cloud Plugin', () => {
 
         const coreSetup = coreMock.createSetup();
 
-        const cloud = { ...cloudMock.createSetup(), isCloudEnabled };
+        const cloud = { ...cloudMock.createSetup(), isCloudEnabled, isElasticStaffOwned };
 
         plugin.setup(coreSetup, { cloud });
 
@@ -61,6 +63,15 @@ describe('Cloud Plugin', () => {
         expect(coreSetup.analytics.registerShipper).not.toHaveBeenCalled();
       });
 
+      it('does set up FullStory when isCloudEnabled=true but the deployment is owned by an Elastician', async () => {
+        const { coreSetup } = await setupPlugin({
+          config: { org_id: 'foo' },
+          isCloudEnabled: true,
+          isElasticStaffOwned: true,
+        });
+        expect(coreSetup.analytics.registerShipper).not.toHaveBeenCalled();
+      });
+
       it('does not call initializeFullStory when org_id is undefined', async () => {
         const { coreSetup } = await setupPlugin({ config: {} });
         expect(coreSetup.analytics.registerShipper).not.toHaveBeenCalled();
diff --git a/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.ts b/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.ts
index 66adac5f5fc228..a248b27f937145 100755
--- a/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_full_story/public/plugin.ts
@@ -37,6 +37,12 @@ export class CloudFullStoryPlugin implements Plugin {
 
   public setup(core: CoreSetup, { cloud }: CloudFullStorySetupDeps) {
     if (cloud.isCloudEnabled) {
+      if (cloud.isElasticStaffOwned) {
+        this.initializerContext.logger
+          .get()
+          .info('Skipping FullStory setup for a Elastic-owned deployments');
+        return;
+      }
       this.setupFullStory({ analytics: core.analytics, basePath: core.http.basePath }).catch((e) =>
         // eslint-disable-next-line no-console
         console.debug(`Error setting up FullStory: ${e.toString()}`)
diff --git a/x-pack/plugins/cloud_integrations/cloud_full_story/server/index.ts b/x-pack/plugins/cloud_integrations/cloud_full_story/server/index.ts
index fe50e3d2944c31..55b049d66e264f 100755
--- a/x-pack/plugins/cloud_integrations/cloud_full_story/server/index.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_full_story/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CloudFullStoryPlugin } from './plugin';
 
 export { config } from './config';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CloudFullStoryPlugin } = await import('./plugin');
   return new CloudFullStoryPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/cloud_integrations/cloud_gain_sight/server/index.ts b/x-pack/plugins/cloud_integrations/cloud_gain_sight/server/index.ts
index 3e104ddd68f6c0..09d79aabf8f4dc 100755
--- a/x-pack/plugins/cloud_integrations/cloud_gain_sight/server/index.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_gain_sight/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CloudGainsightPlugin } from './plugin';
 
 export { config } from './config';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CloudGainsightPlugin } = await import('./plugin');
   return new CloudGainsightPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_findings_transform.ts b/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_findings_transform.ts
index 0b01724870e8c9..21f25edf17783c 100644
--- a/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_findings_transform.ts
+++ b/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_findings_transform.ts
@@ -38,6 +38,7 @@ export const latestFindingsTransform: TransformPutTransformRequest = {
     sort: '@timestamp',
     unique_key: ['resource.id', 'rule.id'],
   },
+  settings: { unattended: true },
   _meta: {
     package: {
       name: CLOUD_SECURITY_POSTURE_PACKAGE_NAME,
diff --git a/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_vulnerabilities_transforms.ts b/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_vulnerabilities_transforms.ts
index fcd3faee437a24..13f130784892ce 100644
--- a/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_vulnerabilities_transforms.ts
+++ b/x-pack/plugins/cloud_security_posture/server/create_transforms/latest_vulnerabilities_transforms.ts
@@ -40,6 +40,7 @@ export const latestVulnerabilitiesTransform: TransformPutTransformRequest = {
     sort: '@timestamp',
     unique_key: ['vulnerability.id', 'resource.id', 'package.name', 'package.version'],
   },
+  settings: { unattended: true },
   _meta: {
     package: {
       name: CLOUD_SECURITY_POSTURE_PACKAGE_NAME,
diff --git a/x-pack/plugins/cloud_security_posture/server/index.ts b/x-pack/plugins/cloud_security_posture/server/index.ts
index 1462eccda6cca6..038c013ba746bc 100755
--- a/x-pack/plugins/cloud_security_posture/server/index.ts
+++ b/x-pack/plugins/cloud_security_posture/server/index.ts
@@ -5,11 +5,12 @@
  * 2.0.
  */
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { CspPlugin } from './plugin';
 
 export type { CspServerPluginSetup, CspServerPluginStart } from './types';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new CspPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { CspPlugin } = await import('./plugin');
+  return new CspPlugin(initializerContext);
+};
 
 export { config } from './config';
diff --git a/x-pack/plugins/cross_cluster_replication/server/index.ts b/x-pack/plugins/cross_cluster_replication/server/index.ts
index a24e95bddede10..4a4e4663277633 100644
--- a/x-pack/plugins/cross_cluster_replication/server/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/index.ts
@@ -6,9 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { CrossClusterReplicationServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
-  new CrossClusterReplicationServerPlugin(pluginInitializerContext);
+export const plugin = async (pluginInitializerContext: PluginInitializerContext) => {
+  const { CrossClusterReplicationServerPlugin } = await import('./plugin');
+  return new CrossClusterReplicationServerPlugin(pluginInitializerContext);
+};
diff --git a/x-pack/plugins/custom_branding/server/index.ts b/x-pack/plugins/custom_branding/server/index.ts
index d0387671278d27..3ac85738baa6ef 100755
--- a/x-pack/plugins/custom_branding/server/index.ts
+++ b/x-pack/plugins/custom_branding/server/index.ts
@@ -7,8 +7,7 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { CustomBrandingPlugin } from './plugin';
-
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { CustomBrandingPlugin } = await import('./plugin');
   return new CustomBrandingPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/dashboard_enhanced/server/index.ts b/x-pack/plugins/dashboard_enhanced/server/index.ts
index 8fa8ea33c17887..6b436893691c16 100644
--- a/x-pack/plugins/dashboard_enhanced/server/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { DashboardEnhancedPlugin } from './plugin';
 
 export type {
   SetupContract as DashboardEnhancedSetupContract,
@@ -15,6 +14,7 @@ export type {
   StartDependencies as DashboardEnhancedStartDependencies,
 } from './plugin';
 
-export function plugin(context: PluginInitializerContext) {
+export async function plugin(context: PluginInitializerContext) {
+  const { DashboardEnhancedPlugin } = await import('./plugin');
   return new DashboardEnhancedPlugin(context);
 }
diff --git a/x-pack/plugins/data_visualizer/public/application/common/hooks/use_document_count_stats.ts b/x-pack/plugins/data_visualizer/public/application/common/hooks/use_document_count_stats.ts
index 87a9a37d4d2c5c..93bf37eb839161 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/hooks/use_document_count_stats.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/hooks/use_document_count_stats.ts
@@ -10,7 +10,7 @@ import { stringHash } from '@kbn/ml-string-hash';
 import { extractErrorProperties } from '@kbn/ml-error-utils';
 import { Query } from '@kbn/es-query';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import { SignificantTerm } from '@kbn/ml-agg-utils';
+import { SignificantItem } from '@kbn/ml-agg-utils';
 import {
   createRandomSamplerWrapper,
   RandomSampler,
@@ -50,8 +50,8 @@ export interface DocumentStatsSearchStrategyParams {
   timeFieldName?: string;
   runtimeFieldMap?: estypes.MappingRuntimeFields;
   fieldsToFetch?: string[];
-  selectedSignificantTerm?: SignificantTerm;
-  includeSelectedSignificantTerm?: boolean;
+  selectedSignificantItem?: SignificantItem;
+  includeSelectedSignificantItem?: boolean;
   trackTotalHits?: boolean;
 }
 
@@ -167,8 +167,8 @@ export interface DocumentStatsSearchStrategyParams {
   timeFieldName?: string;
   runtimeFieldMap?: estypes.MappingRuntimeFields;
   fieldsToFetch?: string[];
-  selectedSignificantTerm?: SignificantTerm;
-  includeSelectedSignificantTerm?: boolean;
+  selectedSignificantItem?: SignificantItem;
+  includeSelectedSignificantItem?: boolean;
   trackTotalHits?: boolean;
 }
 
diff --git a/x-pack/plugins/data_visualizer/server/index.ts b/x-pack/plugins/data_visualizer/server/index.ts
index 08b06005539b0c..1f15b498f8777a 100644
--- a/x-pack/plugins/data_visualizer/server/index.ts
+++ b/x-pack/plugins/data_visualizer/server/index.ts
@@ -6,6 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { DataVisualizerPlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) => new DataVisualizerPlugin();
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { DataVisualizerPlugin } = await import('./plugin');
+  return new DataVisualizerPlugin();
+};
diff --git a/x-pack/plugins/dataset_quality/README.md b/x-pack/plugins/dataset_quality/README.md
new file mode 100755
index 00000000000000..cd5bfc30658d4b
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/README.md
@@ -0,0 +1,3 @@
+# Dataset Quality
+
+In order to make ongoing maintenance of log collection easy we want to introduce the concept of dataset quality, where users can easily get an overview on the datasets they have with information such as integration, size, last activity, among others.
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/index.ts b/x-pack/plugins/dataset_quality/common/index.ts
similarity index 80%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf_v2/index.ts
rename to x-pack/plugins/dataset_quality/common/index.ts
index f27635ae6fc493..440e8780e6bf52 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/index.ts
+++ b/x-pack/plugins/dataset_quality/common/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { PdfExportType } from './printable_pdf_v2';
+export type { DatasetQualityConfig } from './plugin_config';
diff --git a/x-pack/plugins/dataset_quality/common/plugin_config.ts b/x-pack/plugins/dataset_quality/common/plugin_config.ts
new file mode 100644
index 00000000000000..d0dac3d6cfdbb7
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/common/plugin_config.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface DatasetQualityConfig {}
diff --git a/x-pack/plugins/dataset_quality/jest.config.js b/x-pack/plugins/dataset_quality/jest.config.js
new file mode 100644
index 00000000000000..fdd27a97fc347b
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/jest.config.js
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/x-pack/plugins/dataset_quality'],
+  coverageDirectory: '<rootDir>/target/kibana-coverage/jest/x-pack/plugins/dataset_quality',
+  coverageReporters: ['text', 'html'],
+  collectCoverageFrom: ['<rootDir>/x-pack/plugins/dataset_quality/{common,public}/**/*.{ts,tsx}'],
+};
diff --git a/x-pack/plugins/dataset_quality/kibana.jsonc b/x-pack/plugins/dataset_quality/kibana.jsonc
new file mode 100644
index 00000000000000..133537a76d831c
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/kibana.jsonc
@@ -0,0 +1,16 @@
+{
+  "type": "plugin",
+  "id": "@kbn/dataset-quality-plugin",
+  "owner": "@elastic/obs-ux-logs-team",
+  "description": "This plugin introduces the concept of dataset quality, where users can easily get an overview on the datasets they have.",
+  "plugin": {
+    "id": "datasetQuality",
+    "server": true,
+    "browser": true,
+    "configPath": ["xpack", "datasetQuality"],
+    "requiredPlugins": ["data", "kibanaReact", "kibanaUtils", "controls", "embeddable", "share"],
+    "optionalPlugins": [],
+    "requiredBundles": [],
+    "extraPublicDirs": ["common"]
+  }
+}
diff --git a/x-pack/plugins/dataset_quality/public/index.ts b/x-pack/plugins/dataset_quality/public/index.ts
new file mode 100644
index 00000000000000..339be1ec1de9b0
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/public/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PluginInitializerContext } from '@kbn/core/public';
+import { DatasetQualityConfig } from '../common/plugin_config';
+import { DatasetQualityPlugin } from './plugin';
+
+export type { DatasetQualityPluginSetup, DatasetQualityPluginStart } from './types';
+
+export function plugin(context: PluginInitializerContext<DatasetQualityConfig>) {
+  return new DatasetQualityPlugin(context);
+}
diff --git a/x-pack/plugins/dataset_quality/public/plugin.ts b/x-pack/plugins/dataset_quality/public/plugin.ts
new file mode 100644
index 00000000000000..520c02481cd604
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/public/plugin.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from '@kbn/core/public';
+import {
+  DatasetQualityPluginSetup,
+  DatasetQualityPluginStart,
+  DatasetQualitySetupDependencies,
+  DatasetQualityStartDependencies,
+} from './types';
+
+export class DatasetQualityPlugin
+  implements Plugin<DatasetQualityPluginSetup, DatasetQualityPluginStart>
+{
+  constructor(context: PluginInitializerContext) {}
+
+  public setup(core: CoreSetup, plugins: DatasetQualitySetupDependencies) {
+    return {};
+  }
+
+  public start(
+    core: CoreStart,
+    plugins: DatasetQualityStartDependencies
+  ): DatasetQualityPluginStart {
+    return {};
+  }
+}
diff --git a/x-pack/plugins/dataset_quality/public/types.ts b/x-pack/plugins/dataset_quality/public/types.ts
new file mode 100644
index 00000000000000..2d57bd6bb1b2e4
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/public/types.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface DatasetQualityPluginSetup {}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface DatasetQualityPluginStart {}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface DatasetQualityStartDependencies {}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface DatasetQualitySetupDependencies {}
diff --git a/x-pack/plugins/dataset_quality/server/index.ts b/x-pack/plugins/dataset_quality/server/index.ts
new file mode 100644
index 00000000000000..17b028aa19431b
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/server/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DatasetQualityServerPlugin } from './plugin';
+
+export const plugin = () => new DatasetQualityServerPlugin();
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts b/x-pack/plugins/dataset_quality/server/plugin.ts
similarity index 65%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts
rename to x-pack/plugins/dataset_quality/server/plugin.ts
index 1fef8eb47a8c96..b673fed3ad622b 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts
+++ b/x-pack/plugins/dataset_quality/server/plugin.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-export type {
-  JobParamsCSV,
-  TaskPayloadCSV,
-} from '../../../common/types/export_types/csv_searchsource';
+import { Plugin } from '@kbn/core/server';
+
+export class DatasetQualityServerPlugin implements Plugin {
+  setup() {}
+
+  start() {}
+}
diff --git a/x-pack/plugins/dataset_quality/tsconfig.json b/x-pack/plugins/dataset_quality/tsconfig.json
new file mode 100644
index 00000000000000..efe7ece5983ac8
--- /dev/null
+++ b/x-pack/plugins/dataset_quality/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types"
+  },
+  "include": [
+    "../../../typings/**/*",
+    "common/**/*",
+    "public/**/*",
+    "server/**/*.ts",
+    "../../typings/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/core",
+  ],
+  "exclude": ["target/**/*"]
+}
diff --git a/x-pack/plugins/discover_enhanced/server/index.ts b/x-pack/plugins/discover_enhanced/server/index.ts
index 95ce6a4b8d3ba8..853d529d28c8e3 100644
--- a/x-pack/plugins/discover_enhanced/server/index.ts
+++ b/x-pack/plugins/discover_enhanced/server/index.ts
@@ -6,8 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { DiscoverEnhancedPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (context: PluginInitializerContext) => new DiscoverEnhancedPlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { DiscoverEnhancedPlugin } = await import('./plugin');
+  return new DiscoverEnhancedPlugin(context);
+};
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
index e7b580e50a7625..bd83becac07b3f 100755
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/index.ts
@@ -6,12 +6,12 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { EcsDataQualityDashboardPlugin } from './plugin';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { EcsDataQualityDashboardPlugin } = await import('./plugin');
   return new EcsDataQualityDashboardPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/elastic_assistant/server/index.ts b/x-pack/plugins/elastic_assistant/server/index.ts
index a375e036d82389..0cccc1ba27a7a3 100755
--- a/x-pack/plugins/elastic_assistant/server/index.ts
+++ b/x-pack/plugins/elastic_assistant/server/index.ts
@@ -6,9 +6,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ElasticAssistantPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ElasticAssistantPlugin } = await import('./plugin');
   return new ElasticAssistantPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/encrypted_saved_objects/server/index.ts b/x-pack/plugins/encrypted_saved_objects/server/index.ts
index 4a75e0f6855b8f..8b3982c292caaa 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/index.ts
@@ -8,7 +8,6 @@
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { ConfigSchema } from './config';
-import { EncryptedSavedObjectsPlugin } from './plugin';
 
 export type { EncryptedSavedObjectTypeRegistration, AttributeToEncrypt } from './crypto';
 export { EncryptionError, EncryptionErrorOperation } from './crypto';
@@ -27,5 +26,7 @@ export type {
 export const config: PluginConfigDescriptor = {
   schema: ConfigSchema,
 };
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new EncryptedSavedObjectsPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { EncryptedSavedObjectsPlugin } = await import('./plugin');
+  return new EncryptedSavedObjectsPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/enterprise_search/common/constants.ts b/x-pack/plugins/enterprise_search/common/constants.ts
index 8f0b7a80282e2f..5d7ae07a246d3a 100644
--- a/x-pack/plugins/enterprise_search/common/constants.ts
+++ b/x-pack/plugins/enterprise_search/common/constants.ts
@@ -197,7 +197,7 @@ export const DEFAULT_PIPELINE_VALUES: IngestPipelineParams = {
   extract_binary_content: true,
   name: DEFAULT_PIPELINE_NAME,
   reduce_whitespace: true,
-  run_ml_inference: false,
+  run_ml_inference: true,
 };
 
 export interface DefaultConnectorsPipelineMeta {
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ingest_pipelines/ingest_pipelines_card.test.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ingest_pipelines/ingest_pipelines_card.test.tsx
index 3b3e80d4d9758f..0028d2aff6d3d0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ingest_pipelines/ingest_pipelines_card.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ingest_pipelines/ingest_pipelines_card.test.tsx
@@ -33,7 +33,7 @@ const DEFAULT_VALUES = {
     extract_binary_content: true,
     name: DEFAULT_PIPELINE_NAME,
     reduce_whitespace: true,
-    run_ml_inference: false,
+    run_ml_inference: true,
   },
   showModal: false,
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/pipelines_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/pipelines_logic.test.ts
index 69e01d45750fe5..df02a53fe0ab03 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/pipelines_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/pipelines_logic.test.ts
@@ -23,7 +23,7 @@ const DEFAULT_PIPELINE_VALUES = {
   extract_binary_content: true,
   name: 'ent-search-generic-ingestion',
   reduce_whitespace: true,
-  run_ml_inference: false,
+  run_ml_inference: true,
 };
 
 const DEFAULT_VALUES = {
@@ -104,6 +104,7 @@ describe('PipelinesLogic', () => {
       });
       expect(PipelinesLogic.values).toEqual({
         ...DEFAULT_VALUES,
+        canUseMlInferencePipeline: true,
         hasIndexIngestionPipeline: true,
         pipelineName: 'new_pipeline_name',
         pipelineState: { ...DEFAULT_PIPELINE_VALUES, name: 'new_pipeline_name' },
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/search_indices.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/search_indices.tsx
index 7085784d660f29..8e778228857e1c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/search_indices.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/search_indices.tsx
@@ -319,7 +319,6 @@ export const SearchIndices: React.FC = () => {
           </>
         )}
       </EnterpriseSearchContentPageTemplate>
-      )
     </>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/server/index.ts b/x-pack/plugins/enterprise_search/server/index.ts
index 3b9372f339acf6..53d8cbca7f5409 100644
--- a/x-pack/plugins/enterprise_search/server/index.ts
+++ b/x-pack/plugins/enterprise_search/server/index.ts
@@ -8,9 +8,8 @@
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
 
-import { EnterpriseSearchPlugin } from './plugin';
-
-export const plugin = (initializerContext: PluginInitializerContext) => {
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { EnterpriseSearchPlugin } = await import('./plugin');
   return new EnterpriseSearchPlugin(initializerContext);
 };
 
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
index cd15faf6b90c1b..9bb2a18d6a4bb4 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/add_connector.test.ts
@@ -52,7 +52,7 @@ describe('addConnector lib function', () => {
             default_extract_binary_content: true,
             default_name: 'ent-search-generic-ingestion',
             default_reduce_whitespace: true,
-            default_run_ml_inference: false,
+            default_run_ml_inference: true,
           },
           version: '1',
         },
@@ -87,7 +87,7 @@ describe('addConnector lib function', () => {
         extract_binary_content: true,
         name: 'ent-search-generic-ingestion',
         reduce_whitespace: true,
-        run_ml_inference: false,
+        run_ml_inference: true,
       },
     });
     expect(mockClient.asCurrentUser.indices.create).toHaveBeenCalledWith({
@@ -205,7 +205,7 @@ describe('addConnector lib function', () => {
         extract_binary_content: true,
         name: 'ent-search-generic-ingestion',
         reduce_whitespace: true,
-        run_ml_inference: false,
+        run_ml_inference: true,
       },
     });
     expect(mockClient.asCurrentUser.indices.create).toHaveBeenCalledWith({
diff --git a/x-pack/plugins/enterprise_search/server/lib/pipelines/get_index_pipeline.test.ts b/x-pack/plugins/enterprise_search/server/lib/pipelines/get_index_pipeline.test.ts
index 58476ed18b741f..07260423b45909 100644
--- a/x-pack/plugins/enterprise_search/server/lib/pipelines/get_index_pipeline.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/pipelines/get_index_pipeline.test.ts
@@ -87,7 +87,7 @@ describe('getIndexPipelineParameters', () => {
       extract_binary_content: true,
       name: 'my-index',
       reduce_whitespace: true,
-      run_ml_inference: false,
+      run_ml_inference: true,
     });
   });
   it('returns default connector index pipeline if found in mapping', async () => {
diff --git a/x-pack/plugins/event_log/server/index.ts b/x-pack/plugins/event_log/server/index.ts
index cd386483fef8f9..e070f0cf0c940d 100644
--- a/x-pack/plugins/event_log/server/index.ts
+++ b/x-pack/plugins/event_log/server/index.ts
@@ -7,7 +7,6 @@
 
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
 import { ConfigSchema, IEventLogConfig } from './types';
-import { Plugin } from './plugin';
 
 export { millisToNanos, nanosToMillis } from '../common';
 
@@ -30,4 +29,7 @@ export { createReadySignal } from './lib/ready_signal';
 export const config: PluginConfigDescriptor<IEventLogConfig> = {
   schema: ConfigSchema,
 };
-export const plugin = (context: PluginInitializerContext) => new Plugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { Plugin } = await import('./plugin');
+  return new Plugin(context);
+};
diff --git a/x-pack/plugins/exploratory_view/public/application/index.tsx b/x-pack/plugins/exploratory_view/public/application/index.tsx
index e16565b3a8f368..a534048540b2d8 100644
--- a/x-pack/plugins/exploratory_view/public/application/index.tsx
+++ b/x-pack/plugins/exploratory_view/public/application/index.tsx
@@ -12,11 +12,8 @@ import { i18n } from '@kbn/i18n';
 import { Router, Routes, Route } from '@kbn/shared-ux-router';
 import { AppMountParameters, APP_WRAPPER_CLASS, CoreStart } from '@kbn/core/public';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  RedirectAppLinks,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { Storage } from '@kbn/kibana-utils-plugin/public';
 import { UsageCollectionSetup } from '@kbn/usage-collection-plugin/public';
 import { ObservabilityAIAssistantProvider } from '@kbn/observability-ai-assistant-plugin/public';
@@ -94,13 +91,18 @@ export const renderApp = ({
                 <Router history={history}>
                   <EuiThemeProvider darkMode={isDarkMode}>
                     <i18nCore.Context>
-                      <RedirectAppLinks
-                        application={core.application}
+                      <div
                         className={APP_WRAPPER_CLASS}
                         data-test-subj="exploratoryViewMainContainer"
                       >
-                        <App />
-                      </RedirectAppLinks>
+                        <RedirectAppLinks
+                          coreStart={{
+                            application: core.application,
+                          }}
+                        >
+                          <App />
+                        </RedirectAppLinks>
+                      </div>
                     </i18nCore.Context>
                   </EuiThemeProvider>
                 </Router>
diff --git a/x-pack/plugins/exploratory_view/tsconfig.json b/x-pack/plugins/exploratory_view/tsconfig.json
index 4f1f44f4845054..c18721855bfa1e 100644
--- a/x-pack/plugins/exploratory_view/tsconfig.json
+++ b/x-pack/plugins/exploratory_view/tsconfig.json
@@ -39,7 +39,8 @@
     "@kbn/core-application-browser",
     "@kbn/observability-shared-plugin",
     "@kbn/core-ui-settings-browser-mocks",
-    "@kbn/observability-ai-assistant-plugin"
+    "@kbn/observability-ai-assistant-plugin",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": ["target/**/*"]
 }
diff --git a/x-pack/plugins/features/server/index.ts b/x-pack/plugins/features/server/index.ts
index 5882d0a4e339a5..b40094dee92d4f 100644
--- a/x-pack/plugins/features/server/index.ts
+++ b/x-pack/plugins/features/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { FeaturesPlugin } from './plugin';
 
 // These exports are part of public Features plugin contract, any change in signature of exported
 // functions or removal of exports should be considered as a breaking change. Ideally we should
@@ -23,5 +22,7 @@ export type {
 export { KibanaFeature, ElasticsearchFeature } from '../common';
 export type { PluginSetupContract, PluginStartContract } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new FeaturesPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { FeaturesPlugin } = await import('./plugin');
+  return new FeaturesPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/file_upload/server/index.ts b/x-pack/plugins/file_upload/server/index.ts
index c818e74c0ddc50..8078c19cc4f6fa 100644
--- a/x-pack/plugins/file_upload/server/index.ts
+++ b/x-pack/plugins/file_upload/server/index.ts
@@ -6,7 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { FileUploadPlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new FileUploadPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { FileUploadPlugin } = await import('./plugin');
+  return new FileUploadPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/fleet/common/services/is_agent_upgradeable.test.ts b/x-pack/plugins/fleet/common/services/is_agent_upgradeable.test.ts
index ad8138abbce7fc..7ab016239702de 100644
--- a/x-pack/plugins/fleet/common/services/is_agent_upgradeable.test.ts
+++ b/x-pack/plugins/fleet/common/services/is_agent_upgradeable.test.ts
@@ -5,23 +5,29 @@
  * 2.0.
  */
 
-import type { Agent } from '../types/models/agent';
+import type { Agent, AgentUpgradeDetails } from '../types/models/agent';
 
-import { getRecentUpgradeInfoForAgent, isAgentUpgradeable } from './is_agent_upgradeable';
+import {
+  getRecentUpgradeInfoForAgent,
+  isAgentUpgradeable,
+  isAgentUpgrading,
+} from './is_agent_upgradeable';
 
 const getAgent = ({
   version,
   upgradeable = false,
   unenrolling = false,
   unenrolled = false,
-  updating = false,
+  upgrading = false,
+  upgradeDetails,
   minutesSinceUpgrade,
 }: {
   version: string;
   upgradeable?: boolean;
   unenrolling?: boolean;
   unenrolled?: boolean;
-  updating?: boolean;
+  upgrading?: boolean;
+  upgradeDetails?: AgentUpgradeDetails;
   minutesSinceUpgrade?: number;
 }): Agent => {
   const agent: Agent = {
@@ -98,9 +104,12 @@ const getAgent = ({
   if (unenrolled) {
     agent.unenrolled_at = '2020-10-01T14:43:27.255Z';
   }
-  if (updating) {
+  if (upgrading) {
     agent.upgrade_started_at = new Date(Date.now()).toISOString();
   }
+  if (upgradeDetails) {
+    agent.upgrade_details = upgradeDetails;
+  }
   if (minutesSinceUpgrade) {
     agent.upgraded_at = new Date(Date.now() - minutesSinceUpgrade * 6e4).toISOString();
   }
@@ -171,11 +180,49 @@ describe('Fleet - isAgentUpgradeable', () => {
       isAgentUpgradeable(getAgent({ version: '7.9.0', upgradeable: true }), '8.0.0', '7.9.0')
     ).toBe(false);
   });
-  it('returns false if agent reports upgradeable, but is already updating', () => {
+  it('returns false if agent with no upgrade details reports upgradeable, but is already upgrading', () => {
+    expect(
+      isAgentUpgradeable(
+        getAgent({ version: '7.9.0', upgradeable: true, upgrading: true }),
+        '8.0.0'
+      )
+    ).toBe(false);
+  });
+  it('returns false if agent reports upgradeable, but has an upgrade status other than failed', () => {
     expect(
-      isAgentUpgradeable(getAgent({ version: '7.9.0', upgradeable: true, updating: true }), '8.0.0')
+      isAgentUpgradeable(
+        getAgent({
+          version: '7.9.0',
+          upgradeable: true,
+          upgradeDetails: {
+            target_version: '8.0.0',
+            action_id: 'XXX',
+            state: 'UPG_REQUESTED',
+          },
+        }),
+        '8.0.0'
+      )
     ).toBe(false);
   });
+  it('returns true if agent reports upgradeable and has a failed upgrade status', () => {
+    expect(
+      isAgentUpgradeable(
+        getAgent({
+          version: '7.9.0',
+          upgradeable: true,
+          upgradeDetails: {
+            target_version: '8.0.0',
+            action_id: 'XXX',
+            state: 'UPG_FAILED',
+            metadata: {
+              error_msg: 'Upgrade timed out',
+            },
+          },
+        }),
+        '8.0.0'
+      )
+    ).toBe(true);
+  });
   it('returns false if the agent reports upgradeable but was upgraded less than 10 minutes ago', () => {
     expect(
       isAgentUpgradeable(
@@ -215,3 +262,49 @@ describe('hasAgentBeenUpgradedRecently', () => {
     ).toBe(false);
   });
 });
+
+describe('isAgentUpgrading', () => {
+  it('returns true if the agent has an upgrade status other than failed', () => {
+    expect(
+      isAgentUpgrading(
+        getAgent({
+          version: '7.9.0',
+          upgradeDetails: {
+            target_version: '8.0.0',
+            action_id: 'XXX',
+            state: 'UPG_REQUESTED',
+          },
+        })
+      )
+    ).toBe(true);
+  });
+
+  it('returns false if the agent has a failed upgrade status', () => {
+    expect(
+      isAgentUpgrading(
+        getAgent({
+          version: '7.9.0',
+          upgradeDetails: {
+            target_version: '8.0.0',
+            action_id: 'XXX',
+            state: 'UPG_FAILED',
+            metadata: {
+              error_msg: 'Upgrade timed out',
+            },
+          },
+        })
+      )
+    ).toBe(false);
+  });
+
+  it('returns true if the agent is upgrading but has no upgrade details', () => {
+    expect(
+      isAgentUpgrading(
+        getAgent({
+          version: '7.9.0',
+          upgrading: true,
+        })
+      )
+    ).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/fleet/common/services/is_agent_upgradeable.ts b/x-pack/plugins/fleet/common/services/is_agent_upgradeable.ts
index c7bd21c45af4a7..ac21e24520c768 100644
--- a/x-pack/plugins/fleet/common/services/is_agent_upgradeable.ts
+++ b/x-pack/plugins/fleet/common/services/is_agent_upgradeable.ts
@@ -30,11 +30,9 @@ export function isAgentUpgradeable(
   if (!agent.local_metadata.elastic.agent.upgradeable) {
     return false;
   }
-  // check that the agent is not already in the process of updating
-  if (agent.upgrade_started_at && !agent.upgraded_at) {
+  if (isAgentUpgrading(agent)) {
     return false;
   }
-  // check that the agent has not been upgraded more recently than the monitoring period
   if (getRecentUpgradeInfoForAgent(agent).hasBeenUpgradedRecently) {
     return false;
   }
@@ -80,3 +78,10 @@ export function getRecentUpgradeInfoForAgent(agent: Agent): {
 
   return { hasBeenUpgradedRecently, timeToWaitMs };
 }
+
+export function isAgentUpgrading(agent: Agent) {
+  if (agent.upgrade_details) {
+    return agent.upgrade_details.state !== 'UPG_FAILED';
+  }
+  return agent.upgrade_started_at && !agent.upgraded_at;
+}
diff --git a/x-pack/plugins/fleet/common/types/models/agent.ts b/x-pack/plugins/fleet/common/types/models/agent.ts
index 934ca7ecd2641d..120f0bc883e1d8 100644
--- a/x-pack/plugins/fleet/common/types/models/agent.ts
+++ b/x-pack/plugins/fleet/common/types/models/agent.ts
@@ -443,7 +443,7 @@ export interface AgentUpgradeDetails {
   target_version: string;
   action_id: string;
   state: AgentUpgradeStateType;
-  metadata: {
+  metadata?: {
     scheduled_at?: string;
     download_percent?: number;
     failed_state?: AgentUpgradeStateType;
diff --git a/x-pack/plugins/fleet/common/types/models/package_spec.ts b/x-pack/plugins/fleet/common/types/models/package_spec.ts
index 60bc051af04fc9..9a42745cd89bbf 100644
--- a/x-pack/plugins/fleet/common/types/models/package_spec.ts
+++ b/x-pack/plugins/fleet/common/types/models/package_spec.ts
@@ -26,7 +26,7 @@ export interface PackageSpecManifest {
   screenshots?: PackageSpecScreenshot[];
   policy_templates?: RegistryPolicyTemplate[];
   vars?: RegistryVarsEntry[];
-  owner: { github: string };
+  owner: { github: string; type?: 'elastic' | 'partner' | 'community' };
   elasticsearch?: Pick<
     RegistryElasticsearch,
     'index_template.settings' | 'index_template.mappings' | 'index_template.data_stream'
diff --git a/x-pack/plugins/fleet/public/applications/fleet/app.tsx b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
index e7a513e113c4f0..e425b6e2b6fdec 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
@@ -23,7 +23,8 @@ import type { TopNavMenuData } from '@kbn/navigation-plugin/public';
 
 import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
 
-import { KibanaContextProvider, RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
 
 import type { FleetConfigType, FleetStartServices } from '../../plugin';
@@ -259,7 +260,11 @@ export const FleetAppContext: React.FC<{
     const isDarkMode = darkModeObservable && darkModeObservable.darkMode;
 
     return (
-      <RedirectAppLinks application={startServices.application}>
+      <RedirectAppLinks
+        coreStart={{
+          application: startServices.application,
+        }}
+      >
         <startServices.i18n.Context>
           <KibanaContextProvider services={{ ...startServices, theme: { theme$ } }}>
             <EuiErrorBoundary>
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.test.tsx
index af044c793f28a6..6de1a3caaa2c10 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.test.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { type ReactNode } from 'react';
 import { render } from '@testing-library/react';
 
 import { useStartServices } from '../../../../../hooks';
@@ -26,9 +26,9 @@ jest.mock('@kbn/logs-shared-plugin/public', () => {
   };
 });
 
-jest.mock('@kbn/kibana-react-plugin/public', () => {
+jest.mock('@kbn/shared-ux-link-redirect-app', () => {
   return {
-    RedirectAppLinks: ({ children }: { children: any }) => <div>{children}</div>,
+    RedirectAppLinks: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   };
 });
 
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx
index e7eaac45204114..8efef6592f870d 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/agent_logs.tsx
@@ -29,7 +29,7 @@ import semverGte from 'semver/functions/gte';
 import semverCoerce from 'semver/functions/coerce';
 
 import { createStateContainerReactHelpers } from '@kbn/kibana-utils-plugin/public';
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import type { TimeRange } from '@kbn/es-query';
 import { LogStream, type LogStreamProps } from '@kbn/logs-shared-plugin/public';
 
@@ -352,7 +352,11 @@ export const AgentLogsUI: React.FunctionComponent<AgentLogsProps> = memo(
               />
             </DatePickerFlexItem>
             <EuiFlexItem grow={false}>
-              <RedirectAppLinks application={application}>
+              <RedirectAppLinks
+                coreStart={{
+                  application,
+                }}
+              >
                 {isLogsUIAvailable ? (
                   <EuiButtonEmpty
                     href={viewInLogsUrl}
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx
index de9767c2f0b548..572b86d62c73d6 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx
@@ -77,7 +77,7 @@ function getStatusComponents(agentUpgradeDetails?: AgentUpgradeDetails) {
             id="xpack.fleet.agentUpgradeStatusTooltip.upgradeScheduled"
             defaultMessage="The agent has been instructed to upgrade.{upgradeStartDelay}"
             values={{
-              upgradeStartDelay: getUpgradeStartDelay(agentUpgradeDetails.metadata.scheduled_at),
+              upgradeStartDelay: getUpgradeStartDelay(agentUpgradeDetails.metadata?.scheduled_at),
             }}
           />
         ),
@@ -97,7 +97,9 @@ function getStatusComponents(agentUpgradeDetails?: AgentUpgradeDetails) {
             id="xpack.fleet.agentUpgradeStatusTooltip.upgradeDownloading"
             defaultMessage="Downloading the new agent artifact version{downloadEstimate}."
             values={{
-              downloadEstimate: getDownloadEstimate(agentUpgradeDetails?.metadata.download_percent),
+              downloadEstimate: getDownloadEstimate(
+                agentUpgradeDetails?.metadata?.download_percent
+              ),
             }}
           />
         ),
@@ -202,7 +204,7 @@ function getStatusComponents(agentUpgradeDetails?: AgentUpgradeDetails) {
             id="xpack.fleet.agentUpgradeStatusTooltip.upgradeFailed"
             defaultMessage="Upgrade failed: {errorMsg}."
             values={{
-              errorMsg: agentUpgradeDetails?.metadata.error_msg,
+              errorMsg: agentUpgradeDetails?.metadata?.error_msg,
             }}
           />
         ),
diff --git a/x-pack/plugins/fleet/public/applications/integrations/app.tsx b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
index ef8f099b903bbb..5fba3d98860708 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
@@ -15,7 +15,8 @@ import useObservable from 'react-use/lib/useObservable';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
 
-import { KibanaContextProvider, RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
 
 import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
@@ -80,7 +81,11 @@ export const IntegrationsAppContext: React.FC<{
     const CloudContext = startServices.cloud?.CloudContextProvider || EmptyContext;
 
     return (
-      <RedirectAppLinks application={startServices.application}>
+      <RedirectAppLinks
+        coreStart={{
+          application: startServices.application,
+        }}
+      >
         <startServices.i18n.Context>
           <KibanaContextProvider services={{ ...startServices }}>
             <EuiErrorBoundary>
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
index 8100f07e192ea7..f905ac8ca55fa8 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/overview/details.tsx
@@ -179,6 +179,45 @@ export const Details: React.FC<Props> = memo(({ packageInfo }) => {
       ),
     });
 
+    let ownerTypeDescription: React.ReactNode;
+    switch (packageInfo.owner.type) {
+      case 'community':
+        ownerTypeDescription = (
+          <FormattedMessage
+            id="xpack.fleet.epm.ownerTypeCommunityDescription"
+            defaultMessage="Community"
+          />
+        );
+        break;
+      case 'partner':
+        ownerTypeDescription = (
+          <FormattedMessage
+            id="xpack.fleet.epm.ownerTypePartnerDescription"
+            defaultMessage="Partner"
+          />
+        );
+        break;
+      case 'elastic':
+        ownerTypeDescription = (
+          <FormattedMessage
+            id="xpack.fleet.epm.ownerTypeElasticDescription"
+            defaultMessage="Elastic"
+          />
+        );
+        break;
+    }
+
+    if (ownerTypeDescription) {
+      items.push({
+        title: (
+          <EuiTextColor color="subdued">
+            <FormattedMessage id="xpack.fleet.epm.ownerTypeLabel" defaultMessage="Developed by" />
+          </EuiTextColor>
+        ),
+        description: ownerTypeDescription,
+      });
+    }
+
     // License details
     if (packageInfo.licensePath || packageInfo.source?.license || packageInfo.notice) {
       items.push({
@@ -233,6 +272,7 @@ export const Details: React.FC<Props> = memo(({ packageInfo }) => {
     packageInfo.licensePath,
     packageInfo.notice,
     packageInfo.source?.license,
+    packageInfo.owner.type,
     packageInfo.version,
     toggleLicenseModal,
     toggleNoticeModal,
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/confirm_agent_enrollment.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/confirm_agent_enrollment.tsx
index 173bb2ba0f14a1..342f5f8f732497 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/confirm_agent_enrollment.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/confirm_agent_enrollment.tsx
@@ -25,6 +25,7 @@ interface Props {
   onClickViewAgents?: () => void;
   agentCount: number;
   showLoading?: boolean;
+  isLongEnrollment?: boolean;
 }
 
 interface UsePollingAgentCountOptions {
@@ -97,6 +98,7 @@ export const ConfirmAgentEnrollment: React.FunctionComponent<Props> = ({
   onClickViewAgents,
   agentCount,
   showLoading = false,
+  isLongEnrollment = false,
 }) => {
   const { getHref } = useLink();
   const { application } = useStartServices();
@@ -139,10 +141,17 @@ export const ConfirmAgentEnrollment: React.FunctionComponent<Props> = ({
           color="primary"
           iconType={EuiLoadingSpinner}
           title={
-            <FormattedMessage
-              id="xpack.fleet.agentEnrollment.loading.listening"
-              defaultMessage="Listening for agent..."
-            />
+            isLongEnrollment ? (
+              <FormattedMessage
+                id="xpack.fleet.agentEnrollment.loading.listeninglongenrollemnt"
+                defaultMessage="Listening for agent... this can take several minutes"
+              />
+            ) : (
+              <FormattedMessage
+                id="xpack.fleet.agentEnrollment.loading.listening"
+                defaultMessage="Listening for agent"
+              />
+            )
           }
         />
         <EuiSpacer size="m" />
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/agent_enrollment_confirmation_step.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/agent_enrollment_confirmation_step.tsx
index 8736e0bf31bc42..fc2ee7d131baf2 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/agent_enrollment_confirmation_step.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/agent_enrollment_confirmation_step.tsx
@@ -46,6 +46,7 @@ export const AgentEnrollmentConfirmationStep = ({
   agentCount,
   showLoading,
   poll = true,
+  isLongEnrollment = false,
 }: {
   selectedPolicyId?: string;
   troubleshootLink: string;
@@ -53,6 +54,7 @@ export const AgentEnrollmentConfirmationStep = ({
   agentCount: number;
   poll?: boolean;
   showLoading?: boolean;
+  isLongEnrollment?: boolean;
 }): EuiContainedStepProps => {
   const isComplete = !!agentCount;
   return {
@@ -71,6 +73,7 @@ export const AgentEnrollmentConfirmationStep = ({
           onClickViewAgents={onClickViewAgents}
           agentCount={agentCount}
           showLoading={!isComplete || showLoading}
+          isLongEnrollment={isLongEnrollment}
         />
       ) : (
         <AgentEnrollmentPrePollInstructions troubleshootLink={troubleshootLink} />
diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/compute_steps.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/compute_steps.tsx
index 5cc8c109131aef..16dbbb06def8e9 100644
--- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/compute_steps.tsx
+++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/steps/compute_steps.tsx
@@ -319,6 +319,7 @@ export const ManagedSteps: React.FunctionComponent<InstructionProps> = ({
           onClickViewAgents,
           troubleshootLink: link,
           agentCount: enrolledAgentIds.length,
+          isLongEnrollment: cloudSecurityIntegration !== undefined,
         })
       );
     }
diff --git a/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx b/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx
index d3448f852bf76e..4c28b4cb7d2ee9 100644
--- a/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx
+++ b/x-pack/plugins/fleet/public/components/custom_assets_accordion.tsx
@@ -19,7 +19,7 @@ import {
   EuiHorizontalRule,
 } from '@elastic/eui';
 
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 import { AssetTitleMap } from '../applications/integrations/sections/epm/constants';
 import { useStartServices } from '../hooks';
@@ -68,7 +68,11 @@ export const CustomAssetsAccordion: FunctionComponent<CustomAssetsAccordionProps
               <EuiSplitPanel.Inner grow={false} key={index}>
                 <EuiText size="m">
                   <p>
-                    <RedirectAppLinks application={application}>
+                    <RedirectAppLinks
+                      coreStart={{
+                        application,
+                      }}
+                    >
                       <EuiLink href={view.url}>{view.name}</EuiLink>
                     </RedirectAppLinks>
                   </p>
diff --git a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx b/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
index 772a0fa905873f..b92154626d738a 100644
--- a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
+++ b/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
@@ -10,7 +10,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiButtonEmpty } from '@elastic/eui';
 import type { TutorialDirectoryHeaderLinkComponent } from '@kbn/home-plugin/public';
 
-import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 
 import { useLink, useStartServices } from '../../hooks';
 
@@ -23,7 +23,11 @@ const TutorialDirectoryHeaderLink: TutorialDirectoryHeaderLinkComponent = memo((
   });
 
   return hasIntegrationsPermissions && noticeState.settingsDataLoaded ? (
-    <RedirectAppLinks application={application}>
+    <RedirectAppLinks
+      coreStart={{
+        application,
+      }}
+    >
       <EuiButtonEmpty size="s" iconType="link" flush="right" href={getHref('integrations')}>
         <FormattedMessage
           id="xpack.fleet.homeIntegration.tutorialDirectory.fleetAppButtonText"
diff --git a/x-pack/plugins/fleet/server/index.ts b/x-pack/plugins/fleet/server/index.ts
index c928696e6e60ad..829e017c67de04 100644
--- a/x-pack/plugins/fleet/server/index.ts
+++ b/x-pack/plugins/fleet/server/index.ts
@@ -7,8 +7,6 @@
 
 import type { PluginInitializerContext } from '@kbn/core/server';
 
-import { FleetPlugin } from './plugin';
-
 export { buildAgentStatusRuntimeField } from './services/agents/build_status_runtime_field';
 export type {
   AgentService,
@@ -50,6 +48,7 @@ export type {
   FleetFileUpdatableFields,
 } from './services/files/types';
 
-export const plugin = (initializerContext: PluginInitializerContext) => {
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { FleetPlugin } = await import('./plugin');
   return new FleetPlugin(initializerContext);
 };
diff --git a/x-pack/plugins/fleet/server/routes/agent/handlers.ts b/x-pack/plugins/fleet/server/routes/agent/handlers.ts
index 2f344b0f3fb15c..81a01de6b5fde9 100644
--- a/x-pack/plugins/fleet/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/agent/handlers.ts
@@ -354,8 +354,9 @@ function isStringArray(arr: unknown | string[]): arr is string[] {
 
 export const getAvailableVersionsHandler: RequestHandler = async (context, request, response) => {
   try {
-    const availableVersions = await AgentService.getAvailableVersions({});
+    const availableVersions = await AgentService.getAvailableVersions();
     const body: GetAvailableVersionsResponse = { items: availableVersions };
+
     return response.ok({ body });
   } catch (error) {
     return defaultFleetErrorHandler({ error, response });
diff --git a/x-pack/plugins/fleet/server/routes/agent/upgrade_handler.ts b/x-pack/plugins/fleet/server/routes/agent/upgrade_handler.ts
index 78ca30ea1c71f4..547fda566a95ff 100644
--- a/x-pack/plugins/fleet/server/routes/agent/upgrade_handler.ts
+++ b/x-pack/plugins/fleet/server/routes/agent/upgrade_handler.ts
@@ -24,6 +24,7 @@ import {
   getRecentUpgradeInfoForAgent,
   isAgentUpgradeable,
   AGENT_UPGRADE_COOLDOWN_IN_MIN,
+  isAgentUpgrading,
 } from '../../../common/services';
 import { getMaxVersion } from '../../../common/services/get_min_max_version';
 import { getAgentById } from '../../services/agents';
@@ -99,6 +100,16 @@ export const postAgentUpgradeHandler: RequestHandler<
         },
       });
     }
+
+    if (!force && isAgentUpgrading(agent)) {
+      return response.customError({
+        statusCode: 400,
+        body: {
+          message: `agent ${request.params.agentId} is already upgrading`,
+        },
+      });
+    }
+
     if (!force && !isAgentUpgradeable(agent, latestAgentVersion, version)) {
       return response.customError({
         statusCode: 400,
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
index ad37e03672b745..1f419d71e22d74 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
@@ -13,6 +13,12 @@ import type {
   SavedObjectsClientContract,
 } from '@kbn/core/server';
 
+import type { AggregationsAggregationContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type { SortResults } from '@elastic/elasticsearch/lib/api/types';
+
 import type { AgentStatus, ListWithKuery } from '../../types';
 import type { Agent, GetAgentStatusResponse } from '../../../common/types';
 
@@ -72,12 +78,17 @@ export interface AgentClient {
   listAgents(
     options: ListWithKuery & {
       showInactive: boolean;
+      aggregations?: Record<string, AggregationsAggregationContainer>;
+      searchAfter?: SortResults;
+      pitId?: string;
+      getStatusSummary?: boolean;
     }
   ): Promise<{
     agents: Agent[];
     total: number;
     page: number;
     perPage: number;
+    aggregations?: Record<string, estypes.AggregationsAggregate>;
   }>;
 
   /**
@@ -99,6 +110,7 @@ class AgentClientImpl implements AgentClient {
   public async listAgents(
     options: ListWithKuery & {
       showInactive: boolean;
+      aggregations?: Record<string, AggregationsAggregationContainer>;
     }
   ) {
     await this.#runPreflight();
diff --git a/x-pack/plugins/fleet/server/services/agents/crud.test.ts b/x-pack/plugins/fleet/server/services/agents/crud.test.ts
index 47bb8028fffcdd..e542881fe13f3b 100644
--- a/x-pack/plugins/fleet/server/services/agents/crud.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/crud.test.ts
@@ -9,7 +9,9 @@ import type { ElasticsearchClient } from '@kbn/core/server';
 import { elasticsearchServiceMock, savedObjectsClientMock } from '@kbn/core/server/mocks';
 
 import { AGENTS_INDEX } from '../../constants';
+import { createAppContextStartContractMock } from '../../mocks';
 import type { Agent } from '../../types';
+import { appContextService } from '../app_context';
 
 import { auditLoggingService } from '../audit_logging';
 
@@ -30,6 +32,7 @@ const mockedAuditLoggingService = auditLoggingService as jest.Mocked<typeof audi
 
 describe('Agents CRUD test', () => {
   const soClientMock = savedObjectsClientMock.create();
+  let mockContract: ReturnType<typeof createAppContextStartContractMock>;
   let esClientMock: ElasticsearchClient;
   let searchMock: jest.Mock;
 
@@ -41,6 +44,9 @@ describe('Agents CRUD test', () => {
       openPointInTime: jest.fn().mockResolvedValue({ id: '1' }),
       closePointInTime: jest.fn(),
     } as unknown as ElasticsearchClient;
+
+    mockContract = createAppContextStartContractMock();
+    appContextService.start(mockContract);
   });
 
   function getEsResponse(ids: string[], total: number) {
diff --git a/x-pack/plugins/fleet/server/services/agents/crud.ts b/x-pack/plugins/fleet/server/services/agents/crud.ts
index 1521a19f51af14..7ad50c8d962c1d 100644
--- a/x-pack/plugins/fleet/server/services/agents/crud.ts
+++ b/x-pack/plugins/fleet/server/services/agents/crud.ts
@@ -11,6 +11,8 @@ import type { SavedObjectsClientContract, ElasticsearchClient } from '@kbn/core/
 import type { KueryNode } from '@kbn/es-query';
 import { fromKueryExpression, toElasticsearchQuery } from '@kbn/es-query';
 
+import type { AggregationsAggregationContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
 import type { AgentSOAttributes, Agent, ListWithKuery } from '../../types';
 import { appContextService, agentPolicyService } from '..';
 import type { AgentStatus, FleetServerAgent } from '../../../common/types';
@@ -211,6 +213,7 @@ export async function getAgentsByKuery(
     sortOrder?: 'asc' | 'desc';
     pitId?: string;
     searchAfter?: SortResults;
+    aggregations?: Record<string, AggregationsAggregationContainer>;
   }
 ): Promise<{
   agents: Agent[];
@@ -218,6 +221,7 @@ export async function getAgentsByKuery(
   page: number;
   perPage: number;
   statusSummary?: Record<AgentStatus, number>;
+  aggregations?: Record<string, estypes.AggregationsAggregate>;
 }> {
   const {
     page = 1,
@@ -230,6 +234,7 @@ export async function getAgentsByKuery(
     showUpgradeable,
     searchAfter,
     pitId,
+    aggregations,
   } = options;
   const filters = [];
 
@@ -263,8 +268,27 @@ export async function getAgentsByKuery(
     unenrolling: 0,
   };
 
-  const queryAgents = async (from: number, size: number) =>
-    esClient.search<
+  const queryAgents = async (from: number, size: number) => {
+    const aggs = {
+      ...(aggregations || getStatusSummary
+        ? {
+            aggs: {
+              ...(aggregations ? aggregations : {}),
+              ...(getStatusSummary
+                ? {
+                    status: {
+                      terms: {
+                        field: 'status',
+                      },
+                    },
+                  }
+                : {}),
+            },
+          }
+        : {}),
+    };
+
+    return esClient.search<
       FleetServerAgent,
       { status: { buckets: Array<{ key: AgentStatus; doc_count: number }> } }
     >({
@@ -288,8 +312,9 @@ export async function getAgentsByKuery(
             ignore_unavailable: true,
           }),
       ...(pitId && searchAfter ? { search_after: searchAfter, from: 0 } : {}),
-      ...(getStatusSummary && { aggs: { status: { terms: { field: 'status' } } } }),
+      ...aggs,
     });
+  };
   let res;
   try {
     res = await queryAgents((page - 1) * perPage, perPage);
@@ -331,6 +356,7 @@ export async function getAgentsByKuery(
     total,
     page,
     perPage,
+    ...(aggregations ? { aggregations: res.aggregations } : {}),
     ...(getStatusSummary ? { statusSummary } : {}),
   };
 }
diff --git a/x-pack/plugins/fleet/server/services/agents/upgrade.test.ts b/x-pack/plugins/fleet/server/services/agents/upgrade.test.ts
index 2e90a27a3bf24d..8327e09842f8f4 100644
--- a/x-pack/plugins/fleet/server/services/agents/upgrade.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/upgrade.test.ts
@@ -153,10 +153,10 @@ describe('getRollingUpgradeOptions', () => {
     });
   });
 
-  it('should set min expiration for no duration', () => {
+  it('should set a very long expiration (1 month) for no duration', () => {
     const options = getRollingUpgradeOptions('2023-01-06T00:00:00Z');
     expect(options).toEqual({
-      expiration: '2023-01-06T02:00:00.000Z',
+      expiration: '2023-02-05T00:00:00.000Z',
       minimum_execution_duration: 7200,
       start_time: '2023-01-06T00:00:00Z',
     });
diff --git a/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
index b6ab67e5fb5e3e..157eaa688c746c 100644
--- a/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
@@ -76,7 +76,12 @@ export async function upgradeBatch(
   const latestAgentVersion = await getLatestAvailableVersion();
   const upgradeableResults = await Promise.allSettled(
     agentsToCheckUpgradeable.map(async (agent) => {
-      // Filter out agents currently unenrolling, unenrolled, recently upgraded or not upgradeable b/c of version check
+      // Filter out agents that are:
+      //  - currently unenrolling
+      //  - unenrolled
+      //  - recently upgraded
+      //  - currently upgrading
+      //  - upgradeable b/c of version check
       const isNotAllowed =
         getRecentUpgradeInfoForAgent(agent).hasBeenUpgradedRecently ||
         (!options.force && !isAgentUpgradeable(agent, latestAgentVersion, options.version));
@@ -173,6 +178,7 @@ export async function upgradeBatch(
 }
 
 export const MINIMUM_EXECUTION_DURATION_SECONDS = 60 * 60 * 2; // 2h
+export const EXPIRATION_DURATION_SECONDS = 60 * 60 * 24 * 30; // 1 month
 
 export const getRollingUpgradeOptions = (startTime?: string, upgradeDurationSeconds?: number) => {
   const now = new Date().toISOString();
@@ -199,13 +205,12 @@ export const getRollingUpgradeOptions = (startTime?: string, upgradeDurationSeco
     };
   }
   // Schedule without rolling upgrade (Immediately after start_time)
+  // Expiration time is set to a very long value (1 month) to allow upgrading agents staying offline for long time
   if (startTime && !upgradeDurationSeconds) {
     return {
       start_time: startTime ?? now,
       minimum_execution_duration: MINIMUM_EXECUTION_DURATION_SECONDS,
-      expiration: moment(startTime)
-        .add(MINIMUM_EXECUTION_DURATION_SECONDS, 'seconds')
-        .toISOString(),
+      expiration: moment(startTime).add(EXPIRATION_DURATION_SECONDS, 'seconds').toISOString(),
     };
   } else {
     // Regular bulk upgrade (non scheduled, non rolling)
diff --git a/x-pack/plugins/fleet/server/services/agents/versions.test.ts b/x-pack/plugins/fleet/server/services/agents/versions.test.ts
index 92e30141c006a8..513fba910705de 100644
--- a/x-pack/plugins/fleet/server/services/agents/versions.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/versions.test.ts
@@ -7,6 +7,8 @@
 
 import { readFile } from 'fs/promises';
 
+import fetch from 'node-fetch';
+
 let mockKibanaVersion = '300.0.0';
 let mockConfig = {};
 jest.mock('../app_context', () => {
@@ -21,16 +23,30 @@ jest.mock('../app_context', () => {
 });
 
 jest.mock('fs/promises');
+jest.mock('node-fetch');
 
 const mockedReadFile = readFile as jest.MockedFunction<typeof readFile>;
+const mockedFetch = fetch as jest.MockedFunction<typeof fetch>;
+
+const emptyResponse = {
+  status: 200,
+  text: jest.fn().mockResolvedValue(JSON.stringify({})),
+} as any;
+
 import { getAvailableVersions } from './versions';
 
 describe('getAvailableVersions', () => {
+  beforeEach(() => {
+    mockedReadFile.mockReset();
+    mockedFetch.mockReset();
+  });
+
   it('should return available version and filter version < 7.17', async () => {
     mockKibanaVersion = '300.0.0';
     mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce(emptyResponse);
 
-    const res = await getAvailableVersions({ cached: false, includeCurrentVersion: true });
+    const res = await getAvailableVersions({ includeCurrentVersion: true, ignoreCache: true });
 
     expect(res).toEqual(['300.0.0', '8.1.0', '8.0.0', '7.17.0']);
   });
@@ -38,8 +54,9 @@ describe('getAvailableVersions', () => {
   it('should not strip -SNAPSHOT from kibana version', async () => {
     mockKibanaVersion = '300.0.0-SNAPSHOT';
     mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce(emptyResponse);
 
-    const res = await getAvailableVersions({ cached: false, includeCurrentVersion: true });
+    const res = await getAvailableVersions({ includeCurrentVersion: true, ignoreCache: true });
     expect(res).toEqual(['300.0.0-SNAPSHOT', '8.1.0', '8.0.0', '7.17.0']);
   });
 
@@ -51,8 +68,9 @@ describe('getAvailableVersions', () => {
       },
     };
     mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce(emptyResponse);
 
-    const res = await getAvailableVersions({ cached: false });
+    const res = await getAvailableVersions({ ignoreCache: true });
 
     expect(res).toEqual(['8.1.0', '8.0.0', '7.17.0']);
   });
@@ -60,8 +78,9 @@ describe('getAvailableVersions', () => {
   it('should not include the current version if includeCurrentVersion = false', async () => {
     mockKibanaVersion = '300.0.0-SNAPSHOT';
     mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce(emptyResponse);
 
-    const res = await getAvailableVersions({ cached: false, includeCurrentVersion: false });
+    const res = await getAvailableVersions({ includeCurrentVersion: false, ignoreCache: true });
 
     expect(res).toEqual(['8.1.0', '8.0.0', '7.17.0']);
   });
@@ -74,9 +93,90 @@ describe('getAvailableVersions', () => {
       },
     };
     mockedReadFile.mockRejectedValue({ code: 'ENOENT' });
+    mockedFetch.mockResolvedValueOnce(emptyResponse);
 
-    const res = await getAvailableVersions({ cached: false });
+    const res = await getAvailableVersions({ ignoreCache: true });
 
     expect(res).toEqual(['300.0.0']);
   });
+
+  it('should include versions returned from product_versions API', async () => {
+    mockKibanaVersion = '300.0.0';
+    mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce({
+      status: 200,
+      text: jest.fn().mockResolvedValue(
+        JSON.stringify([
+          [
+            {
+              title: 'Elastic Agent 8.1.0',
+              version_number: '8.1.0',
+            },
+            {
+              title: 'Elastic Agent 8.10.0',
+              version_number: '8.10.0',
+            },
+            {
+              title: 'Elastic Agent 8.9.2',
+              version_number: '8.9.2',
+            },
+            ,
+          ],
+        ])
+      ),
+    } as any);
+
+    const res = await getAvailableVersions({ ignoreCache: true });
+
+    // Should sort, uniquify and filter out versions < 7.17
+    expect(res).toEqual(['8.10.0', '8.9.2', '8.1.0', '8.0.0', '7.17.0']);
+  });
+
+  it('should cache results', async () => {
+    mockKibanaVersion = '300.0.0';
+    mockedReadFile.mockResolvedValue(`["8.1.0", "8.0.0", "7.17.0", "7.16.0"]`);
+    mockedFetch.mockResolvedValueOnce({
+      status: 200,
+      text: jest.fn().mockResolvedValue(
+        JSON.stringify([
+          [
+            {
+              title: 'Elastic Agent 8.1.0',
+              version_number: '8.1.0',
+            },
+            {
+              title: 'Elastic Agent 8.10.0',
+              version_number: '8.10.0',
+            },
+            {
+              title: 'Elastic Agent 8.9.2',
+              version_number: '8.9.2',
+            },
+            ,
+          ],
+        ])
+      ),
+    } as any);
+
+    await getAvailableVersions();
+
+    mockedFetch.mockResolvedValueOnce({
+      status: 200,
+      text: jest.fn().mockResolvedValue(
+        JSON.stringify([
+          [
+            {
+              title: 'Elastic Agent 300.0.0',
+              version_number: '300.0.0',
+            },
+          ],
+        ])
+      ),
+    } as any);
+
+    const res2 = await getAvailableVersions();
+
+    expect(mockedFetch).toBeCalledTimes(1);
+    expect(res2).not.toContain('300.0.0');
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/agents/versions.ts b/x-pack/plugins/fleet/server/services/agents/versions.ts
index 7a1b82bb723594..8f31d3f12b3443 100644
--- a/x-pack/plugins/fleet/server/services/agents/versions.ts
+++ b/x-pack/plugins/fleet/server/services/agents/versions.ts
@@ -8,18 +8,27 @@
 import { readFile } from 'fs/promises';
 import Path from 'path';
 
-import { REPO_ROOT } from '@kbn/repo-info';
+import fetch from 'node-fetch';
+import pRetry from 'p-retry';
 import { uniq } from 'lodash';
 import semverGte from 'semver/functions/gte';
 import semverGt from 'semver/functions/gt';
 import semverCoerce from 'semver/functions/coerce';
 
+import { REPO_ROOT } from '@kbn/repo-info';
+
 import { appContextService } from '..';
 
 const MINIMUM_SUPPORTED_VERSION = '7.17.0';
 const AGENT_VERSION_BUILD_FILE = 'x-pack/plugins/fleet/target/agent_versions_list.json';
 
-let availableVersions: string[] | undefined;
+// Endpoint maintained by the web-team and hosted on the elastic website
+const PRODUCT_VERSIONS_URL = 'https://www.elastic.co/api/product_versions';
+
+// Cache available versions in memory for 1 hour
+const CACHE_DURATION = 1000 * 60 * 60;
+let CACHED_AVAILABLE_VERSIONS: string[] | undefined;
+let LAST_FETCHED: number | undefined;
 
 export const getLatestAvailableVersion = async (
   includeCurrentVersion?: boolean
@@ -30,54 +39,100 @@ export const getLatestAvailableVersion = async (
 };
 
 export const getAvailableVersions = async ({
-  cached = true,
   includeCurrentVersion,
+  ignoreCache = false, // This is only here to allow us to ignore the cache in tests
 }: {
-  cached?: boolean;
   includeCurrentVersion?: boolean;
-}): Promise<string[]> => {
-  // Use cached value to avoid reading from disk each time
-  if (cached && availableVersions) {
-    return availableVersions;
+  ignoreCache?: boolean;
+} = {}): Promise<string[]> => {
+  const logger = appContextService.getLogger();
+
+  if (LAST_FETCHED && !ignoreCache) {
+    const msSinceLastFetched = Date.now() - (LAST_FETCHED || 0);
+
+    if (msSinceLastFetched < CACHE_DURATION && CACHED_AVAILABLE_VERSIONS !== undefined) {
+      logger.debug(`Cache is valid, returning cached available versions`);
+
+      return CACHED_AVAILABLE_VERSIONS;
+    }
+
+    logger.debug('Cache has expired, fetching available versions from disk + API');
   }
 
-  // Read a static file generated at build time
   const config = appContextService.getConfig();
-  let versionsToDisplay: string[] = [];
-
   const kibanaVersion = appContextService.getKibanaVersion();
 
+  let availableVersions: string[] = [];
+
+  // First, grab available versions from the static file that's placed on disk at build time
   try {
     const file = await readFile(Path.join(REPO_ROOT, AGENT_VERSION_BUILD_FILE), 'utf-8');
-
-    // Exclude versions older than MINIMUM_SUPPORTED_VERSION and pre-release versions (SNAPSHOT, rc..)
-    // De-dup and sort in descending order
     const data: string[] = JSON.parse(file);
 
-    const versions = data
-      .map((item: any) => semverCoerce(item)?.version || '')
-      .filter((v: any) => semverGte(v, MINIMUM_SUPPORTED_VERSION))
-      .sort((a: any, b: any) => (semverGt(a, b) ? -1 : 1));
-    versionsToDisplay = uniq(versions) as string[];
+    availableVersions = [...availableVersions, ...data];
+  } catch (error) {
+    // If we can't read from the file, the error is non-blocking. We'll try to source data from the
+    // product versions API later.
+    logger.debug(`Error reading file ${AGENT_VERSION_BUILD_FILE}: ${error.message}`);
+  }
+
+  // Next, fetch from the product versions API. This API call is aggressively cached, so we won't
+  // fetch from the live API more than `TIME_BETWEEN_FETCHES` milliseconds.
+  const apiVersions = await fetchAgentVersionsFromApi();
+
+  // Coerce each version to a semver object and compare to our `MINIMUM_SUPPORTED_VERSION` - we
+  // only want support versions in the final result. We'll also sort by newest version first.
+  availableVersions = uniq([...availableVersions, ...apiVersions])
+    .map((item: any) => semverCoerce(item)?.version || '')
+    .filter((v: any) => semverGte(v, MINIMUM_SUPPORTED_VERSION))
+    .sort((a: any, b: any) => (semverGt(a, b) ? -1 : 1));
+
+  // If the current stack version isn't included in the list of available versions, add it
+  // at the front of the array
+  const hasCurrentVersion = availableVersions.some((v) => v === kibanaVersion);
+  if (includeCurrentVersion && !hasCurrentVersion) {
+    availableVersions = [kibanaVersion, ...availableVersions];
+  }
 
-    const appendCurrentVersion = includeCurrentVersion;
+  // Allow upgrading to the current stack version if this override flag is provided via `kibana.yml`.
+  // This is useful for development purposes.
+  if (availableVersions.length === 0 && !config?.internal?.onlyAllowAgentUpgradeToKnownVersions) {
+    availableVersions = [kibanaVersion];
+  }
 
-    if (appendCurrentVersion) {
-      // Add current version if not already present
-      const hasCurrentVersion = versionsToDisplay.some((v) => v === kibanaVersion);
+  // Don't prime the cache in tests
+  if (!ignoreCache) {
+    CACHED_AVAILABLE_VERSIONS = availableVersions;
+    LAST_FETCHED = Date.now();
+  }
 
-      versionsToDisplay = !hasCurrentVersion
-        ? [kibanaVersion].concat(versionsToDisplay)
-        : versionsToDisplay;
-    }
+  return availableVersions;
+};
 
-    availableVersions = versionsToDisplay;
+async function fetchAgentVersionsFromApi() {
+  const logger = appContextService.getLogger();
 
-    return availableVersions;
-  } catch (e) {
-    if (e.code === 'ENOENT') {
-      return config?.internal?.onlyAllowAgentUpgradeToKnownVersions ? [] : [kibanaVersion];
-    }
-    throw e;
+  const options = {
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  };
+
+  const response = await pRetry(() => fetch(PRODUCT_VERSIONS_URL, options), { retries: 1 });
+  const rawBody = await response.text();
+
+  // We need to handle non-200 responses gracefully here to support airgapped environments where
+  // Kibana doesn't have internet access to query this API
+  if (response.status >= 400) {
+    logger.debug(`Status code ${response.status} received from versions API: ${rawBody}`);
+    return [];
   }
-};
+
+  const jsonBody = JSON.parse(rawBody);
+
+  const versions: string[] = (jsonBody.length ? jsonBody[0] : [])
+    .filter((item: any) => item?.title?.includes('Elastic Agent'))
+    .map((item: any) => item?.version_number);
+
+  return versions;
+}
diff --git a/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.test.ts b/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.test.ts
index 113866017f24b4..f3d59c9607a386 100644
--- a/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.test.ts
@@ -688,55 +688,108 @@ describe('tagKibanaAssets', () => {
     );
   });
 
-  it('should respect SecuritySolution tags', async () => {
-    savedObjectTagClient.get.mockRejectedValue(new Error('not found'));
-    savedObjectTagClient.create.mockImplementation(({ name }: { name: string }) =>
-      Promise.resolve({ id: name.toLowerCase(), name })
-    );
-    const kibanaAssets = {
-      dashboard: [
-        { id: 'dashboard1', type: 'dashboard' },
-        { id: 'dashboard2', type: 'dashboard' },
-        { id: 'search_id1', type: 'search' },
-        { id: 'search_id2', type: 'search' },
-      ],
-    } as any;
-    const assetTags = [
-      {
-        text: 'Security Solution',
-        asset_types: ['dashboard'],
-      },
-    ];
-    await tagKibanaAssets({
-      savedObjectTagAssignmentService,
-      savedObjectTagClient,
-      kibanaAssets,
-      pkgTitle: 'TestPackage',
-      pkgName: 'test-pkg',
-      spaceId: 'default',
-      importedAssets: [],
-      assetTags,
+  describe('Security Solution tag', () => {
+    it('creates tag in default space', async () => {
+      savedObjectTagClient.get.mockRejectedValue(new Error('not found'));
+      savedObjectTagClient.create.mockImplementation(({ name }: { name: string }) =>
+        Promise.resolve({ id: name.toLowerCase(), name })
+      );
+      const kibanaAssets = {
+        dashboard: [
+          { id: 'dashboard1', type: 'dashboard' },
+          { id: 'dashboard2', type: 'dashboard' },
+          { id: 'search_id1', type: 'search' },
+          { id: 'search_id2', type: 'search' },
+        ],
+      } as any;
+      const assetTags = [
+        {
+          text: 'Security Solution',
+          asset_types: ['dashboard'],
+        },
+      ];
+      await tagKibanaAssets({
+        savedObjectTagAssignmentService,
+        savedObjectTagClient,
+        kibanaAssets,
+        pkgTitle: 'TestPackage',
+        pkgName: 'test-pkg',
+        spaceId: 'default',
+        importedAssets: [],
+        assetTags,
+      });
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(
+        managedTagPayloadArg1,
+        managedTagPayloadArg2
+      );
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(
+        {
+          color: '#4DD2CA',
+          description: '',
+          name: 'TestPackage',
+        },
+        { id: 'fleet-pkg-test-pkg-default', overwrite: true, refresh: false }
+      );
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(
+        {
+          color: expect.any(String),
+          description: 'Tag defined in package-spec',
+          name: 'Security Solution',
+        },
+        { id: 'security-solution-default', overwrite: true, refresh: false }
+      );
+    });
+
+    it('creates tag in non-default space', async () => {
+      savedObjectTagClient.get.mockRejectedValue(new Error('not found'));
+      savedObjectTagClient.create.mockImplementation(({ name }: { name: string }) =>
+        Promise.resolve({ id: name.toLowerCase(), name })
+      );
+      const kibanaAssets = {
+        dashboard: [
+          { id: 'dashboard1', type: 'dashboard' },
+          { id: 'dashboard2', type: 'dashboard' },
+          { id: 'search_id1', type: 'search' },
+          { id: 'search_id2', type: 'search' },
+        ],
+      } as any;
+      const assetTags = [
+        {
+          text: 'Security Solution',
+          asset_types: ['dashboard'],
+        },
+      ];
+      await tagKibanaAssets({
+        savedObjectTagAssignmentService,
+        savedObjectTagClient,
+        kibanaAssets,
+        pkgTitle: 'TestPackage',
+        pkgName: 'test-pkg',
+        spaceId: 'my-secondary-space',
+        importedAssets: [],
+        assetTags,
+      });
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(managedTagPayloadArg1, {
+        ...managedTagPayloadArg2,
+        id: 'fleet-managed-my-secondary-space',
+      });
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(
+        {
+          color: expect.any(String),
+          description: '',
+          name: 'TestPackage',
+        },
+        { id: 'fleet-pkg-test-pkg-my-secondary-space', overwrite: true, refresh: false }
+      );
+      expect(savedObjectTagClient.create).toHaveBeenCalledWith(
+        {
+          color: expect.anything(),
+          description: 'Tag defined in package-spec',
+          name: 'Security Solution',
+        },
+        { id: 'security-solution-my-secondary-space', overwrite: true, refresh: false }
+      );
     });
-    expect(savedObjectTagClient.create).toHaveBeenCalledWith(
-      managedTagPayloadArg1,
-      managedTagPayloadArg2
-    );
-    expect(savedObjectTagClient.create).toHaveBeenCalledWith(
-      {
-        color: '#4DD2CA',
-        description: '',
-        name: 'TestPackage',
-      },
-      { id: 'fleet-pkg-test-pkg-default', overwrite: true, refresh: false }
-    );
-    expect(savedObjectTagClient.create).toHaveBeenCalledWith(
-      {
-        color: expect.any(String),
-        description: 'Tag defined in package-spec',
-        name: 'Security Solution',
-      },
-      { id: 'security-solution-default', overwrite: true, refresh: false }
-    );
   });
 
   it('should only call savedObjectTagClient.create for basic tags if there are no assetTags to assign', async () => {
diff --git a/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.ts b/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.ts
index 86d39a5582607e..5e7d4477bbbd3c 100644
--- a/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.ts
+++ b/x-pack/plugins/fleet/server/services/epm/kibana/assets/tag_assets.ts
@@ -37,7 +37,7 @@ const PACKAGE_TAG_COLOR = '#4DD2CA';
 const MANAGED_TAG_NAME = 'Managed';
 const LEGACY_MANAGED_TAG_ID = 'managed';
 const SECURITY_SOLUTION_TAG_NAME = 'Security Solution';
-const SECURITY_SOLUTION_TAG_ID = 'security-solution-default';
+const SECURITY_SOLUTION_TAG_ID_BASE = 'security-solution';
 
 // the tag service only accepts 6-digits hex colors
 const TAG_COLORS = [
@@ -65,8 +65,10 @@ const getLegacyPackageTagId = (pkgName: string) => pkgName;
   In that case return id `security-solution-default`
 */
 export const getPackageSpecTagId = (spaceId: string, pkgName: string, tagName: string) => {
-  if (tagName.toLowerCase() === SECURITY_SOLUTION_TAG_NAME.toLowerCase())
-    return SECURITY_SOLUTION_TAG_ID;
+  if (tagName.toLowerCase() === SECURITY_SOLUTION_TAG_NAME.toLowerCase()) {
+    return `${SECURITY_SOLUTION_TAG_ID_BASE}-${spaceId}`;
+  }
+
   // UUID v5 needs a namespace (uuid.DNS) to generate a predictable uuid
   const uniqueId = uuidv5(`${tagName.toLowerCase()}`, uuidv5.DNS);
   return `fleet-shared-tag-${pkgName}-${uniqueId}-${spaceId}`;
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts b/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
index decd5e977506ca..7078761a4a5837 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
@@ -8,7 +8,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 
-import type { BundledPackage } from '../../../types';
+import type { BundledPackage, Installation } from '../../../types';
 import { FleetError } from '../../../errors';
 import { appContextService } from '../../app_context';
 import { splitPkgKey, pkgToPkgKey } from '../registry';
@@ -57,24 +57,33 @@ export async function getBundledPackages(): Promise<BundledPackage[]> {
   }
 }
 
+export async function getBundledPackageForInstallation(
+  installation: Installation
+): Promise<BundledPackage | undefined> {
+  const bundledPackages = await getBundledPackages();
+
+  return bundledPackages.find(
+    (bundledPkg: BundledPackage) =>
+      bundledPkg.name === installation.name && bundledPkg.version === installation.version
+  );
+}
+
 export async function getBundledPackageByPkgKey(
   pkgKey: string
 ): Promise<BundledPackage | undefined> {
   const bundledPackages = await getBundledPackages();
-  const bundledPackage = bundledPackages.find((pkg) => {
+
+  return bundledPackages.find((pkg) => {
     if (pkgKey.includes('-')) {
       return pkgToPkgKey(pkg) === pkgKey;
     } else {
       return pkg.name === pkgKey;
     }
   });
-
-  return bundledPackage;
 }
 
 export async function getBundledPackageByName(name: string): Promise<BundledPackage | undefined> {
   const bundledPackages = await getBundledPackages();
-  const bundledPackage = bundledPackages.find((pkg) => pkg.name === name);
 
-  return bundledPackage;
+  return bundledPackages.find((pkg) => pkg.name === name);
 }
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
index d21e023ce7cdd2..f3e464d7a9f678 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
@@ -282,7 +282,7 @@ describe('install', () => {
       expect(response.error).toBeUndefined();
 
       expect(install._installPackage).toHaveBeenCalledWith(
-        expect.objectContaining({ installSource: 'upload' })
+        expect.objectContaining({ installSource: 'bundled' })
       );
     });
 
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
index ffd1dfe6379c27..3a7fc78096159a 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
@@ -328,6 +328,7 @@ interface InstallUploadedArchiveParams {
   authorizationHeader?: HTTPAuthorizationHeader | null;
   ignoreMappingUpdateErrors?: boolean;
   skipDataStreamRollover?: boolean;
+  isBundledPackage?: boolean;
 }
 
 function getTelemetryEvent(pkgName: string, pkgVersion: string): PackageUpdateEvent {
@@ -460,7 +461,7 @@ function getElasticSubscription(packageInfo: ArchivePackage) {
 async function installPackageCommon(options: {
   pkgName: string;
   pkgVersion: string;
-  installSource: 'registry' | 'upload' | 'custom';
+  installSource: InstallSource;
   installedPkg?: SavedObject<Installation>;
   installType: InstallType;
   savedObjectsClient: SavedObjectsClientContract;
@@ -638,10 +639,11 @@ async function installPackageByUpload({
   authorizationHeader,
   ignoreMappingUpdateErrors,
   skipDataStreamRollover,
+  isBundledPackage,
 }: InstallUploadedArchiveParams): Promise<InstallResult> {
   // if an error happens during getInstallType, report that we don't know
   let installType: InstallType = 'unknown';
-  const installSource = 'upload';
+  const installSource = isBundledPackage ? 'bundled' : 'upload';
   try {
     const { packageInfo } = await generatePackageInfoFromArchiveBuffer(archiveBuffer, contentType);
     const pkgName = packageInfo.name;
@@ -747,6 +749,7 @@ export async function installPackage(args: InstallPackageParams): Promise<Instal
         authorizationHeader,
         ignoreMappingUpdateErrors,
         skipDataStreamRollover,
+        isBundledPackage: true,
       });
 
       return { ...response, installSource: 'bundled' };
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/reinstall.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/reinstall.test.ts
index f58e91cdffe3ce..0ac71cc7c5a84b 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/reinstall.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/reinstall.test.ts
@@ -11,14 +11,22 @@ import type { Installation } from '../../../../common';
 
 import { reinstallPackageForInstallation } from './reinstall';
 import { installPackage } from './install';
+import { getBundledPackageForInstallation } from './bundled_packages';
 
 jest.mock('./install');
+jest.mock('./bundled_packages');
 
-const mockedInstallPackage = installPackage as jest.MockedFunction<typeof installPackage>;
+const mockedInstallPackage = jest.mocked(installPackage);
+const mockedGetBundledPackageForInstallation = jest.mocked(getBundledPackageForInstallation);
 
 describe('reinstallPackageForInstallation', () => {
   beforeEach(() => {
     mockedInstallPackage.mockReset();
+    mockedGetBundledPackageForInstallation.mockImplementation(async ({ name }) => {
+      if (name === 'test_bundled') {
+        return {} as any;
+      }
+    });
   });
   it('should throw an error for uploaded package', async () => {
     const soClient = savedObjectsClientMock.create();
@@ -67,7 +75,7 @@ describe('reinstallPackageForInstallation', () => {
         esClient,
         installation: {
           install_source: 'bundled',
-          name: 'test',
+          name: 'test_bundled',
           version: '1.0.0',
         } as Installation,
       })
@@ -76,7 +84,32 @@ describe('reinstallPackageForInstallation', () => {
     expect(mockedInstallPackage).toHaveBeenCalledWith(
       expect.objectContaining({
         installSource: 'registry',
-        pkgkey: 'test-1.0.0',
+        pkgkey: 'test_bundled-1.0.0',
+        force: true,
+      })
+    );
+  });
+
+  // Pre 8.12.0 bundled package install where saved with install_source_upload
+  it('should install bundled package saved with install_source:upload ', async () => {
+    const soClient = savedObjectsClientMock.create();
+    const esClient = elasticsearchServiceMock.createInternalClient();
+    await expect(
+      reinstallPackageForInstallation({
+        soClient,
+        esClient,
+        installation: {
+          install_source: 'upload',
+          name: 'test_bundled',
+          version: '1.0.0',
+        } as Installation,
+      })
+    );
+
+    expect(mockedInstallPackage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        installSource: 'registry',
+        pkgkey: 'test_bundled-1.0.0',
         force: true,
       })
     );
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/reinstall.ts b/x-pack/plugins/fleet/server/services/epm/packages/reinstall.ts
index 6f6ed35f4974b2..d2672b60898199 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/reinstall.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/reinstall.ts
@@ -11,6 +11,8 @@ import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common/constants';
 import type { Installation } from '../../../types';
 import { pkgToPkgKey } from '../registry';
 
+import { getBundledPackageForInstallation } from './bundled_packages';
+
 import { installPackage } from './install';
 
 export async function reinstallPackageForInstallation({
@@ -22,9 +24,18 @@ export async function reinstallPackageForInstallation({
   esClient: ElasticsearchClient;
   installation: Installation;
 }) {
-  if (installation.install_source === 'upload') {
-    throw new Error('Cannot reinstall an uploaded package');
+  if (installation.install_source === 'upload' || installation.install_source === 'bundled') {
+    // If there is a matching bundled package
+    const matchingBundledPackage = await getBundledPackageForInstallation(installation);
+    if (!matchingBundledPackage) {
+      if (installation.install_source === 'bundled') {
+        throw new Error(`Cannot reinstall: ${installation.name}, bundled package not found`);
+      } else {
+        throw new Error('Cannot reinstall an uploaded package');
+      }
+    }
   }
+
   return installPackage({
     // If the package is bundled reinstall from the registry will still use the bundled package.
     installSource: 'registry',
diff --git a/x-pack/plugins/fleet/server/services/setup.ts b/x-pack/plugins/fleet/server/services/setup.ts
index d83e1424c54c47..270cfefb56a829 100644
--- a/x-pack/plugins/fleet/server/services/setup.ts
+++ b/x-pack/plugins/fleet/server/services/setup.ts
@@ -14,11 +14,7 @@ import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common/constants';
 
 import { AUTO_UPDATE_PACKAGES } from '../../common/constants';
 import type { PreconfigurationError } from '../../common/constants';
-import type {
-  DefaultPackagesInstallationError,
-  BundledPackage,
-  Installation,
-} from '../../common/types';
+import type { DefaultPackagesInstallationError } from '../../common/types';
 
 import { SO_SEARCH_LIMIT } from '../constants';
 
@@ -45,7 +41,6 @@ import { getInstallations, reinstallPackageForInstallation } from './epm/package
 import { isPackageInstalled } from './epm/packages/install';
 import type { UpgradeManagedPackagePoliciesResult } from './managed_package_policies';
 import { upgradeManagedPackagePolicies } from './managed_package_policies';
-import { getBundledPackages } from './epm/packages';
 import { upgradePackageInstallVersion } from './setup/upgrade_package_install_version';
 import { upgradeAgentPolicySchemaVersion } from './setup/upgrade_agent_policy_schema_version';
 import { migrateSettingsToFleetServerHost } from './fleet_server_host';
@@ -219,24 +214,9 @@ export async function ensureFleetGlobalEsAssets(
   if (assetResults.some((asset) => asset.isCreated)) {
     // Update existing index template
     const installedPackages = await getInstallations(soClient);
-    const bundledPackages = await getBundledPackages();
-    const findMatchingBundledPkg = (pkg: Installation) =>
-      bundledPackages.find(
-        (bundledPkg: BundledPackage) =>
-          bundledPkg.name === pkg.name && bundledPkg.version === pkg.version
-      );
     await pMap(
       installedPackages.saved_objects,
       async ({ attributes: installation }) => {
-        if (installation.install_source !== 'registry') {
-          const matchingBundledPackage = findMatchingBundledPkg(installation);
-          if (!matchingBundledPackage) {
-            logger.error(
-              `Package needs to be manually reinstalled ${installation.name} after installing Fleet global assets`
-            );
-            return;
-          }
-        }
         await reinstallPackageForInstallation({
           soClient,
           esClient,
diff --git a/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.test.ts b/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.test.ts
new file mode 100644
index 00000000000000..102baa8f1d6a45
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.test.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  elasticsearchServiceMock,
+  loggingSystemMock,
+  savedObjectsClientMock,
+} from '@kbn/core/server/mocks';
+
+import { reinstallPackageForInstallation } from '../epm/packages';
+
+import { upgradePackageInstallVersion } from './upgrade_package_install_version';
+
+jest.mock('../epm/packages');
+
+const mockedReinstallPackageForInstallation = jest.mocked(reinstallPackageForInstallation);
+
+describe('upgradePackageInstallVersion', () => {
+  beforeEach(() => {
+    mockedReinstallPackageForInstallation.mockReset();
+    mockedReinstallPackageForInstallation.mockResolvedValue({} as any);
+  });
+  it('should upgrade outdated package version', async () => {
+    const logger = loggingSystemMock.createLogger();
+    const esClient = elasticsearchServiceMock.createInternalClient();
+    const soClient = savedObjectsClientMock.create();
+
+    soClient.find.mockResolvedValue({
+      total: 2,
+      saved_objects: [
+        {
+          attributes: { name: 'test1' },
+        },
+        {
+          attributes: { name: 'test2' },
+        },
+      ],
+    } as any);
+
+    await upgradePackageInstallVersion({
+      esClient,
+      soClient,
+      logger,
+    });
+
+    expect(mockedReinstallPackageForInstallation).toBeCalledTimes(2);
+    expect(mockedReinstallPackageForInstallation).toBeCalledWith(
+      expect.objectContaining({
+        installation: expect.objectContaining({ name: 'test1' }),
+      })
+    );
+    expect(mockedReinstallPackageForInstallation).toBeCalledWith(
+      expect.objectContaining({
+        installation: expect.objectContaining({ name: 'test2' }),
+      })
+    );
+
+    expect(logger.warn).not.toBeCalled();
+    expect(logger.error).not.toBeCalled();
+  });
+
+  it('should log at error level when an error happens while reinstalling package', async () => {
+    const logger = loggingSystemMock.createLogger();
+    const esClient = elasticsearchServiceMock.createInternalClient();
+    const soClient = savedObjectsClientMock.create();
+
+    mockedReinstallPackageForInstallation.mockRejectedValue(new Error('test error'));
+    soClient.find.mockResolvedValue({
+      total: 2,
+      saved_objects: [
+        {
+          attributes: { name: 'test1' },
+        },
+      ],
+    } as any);
+
+    await upgradePackageInstallVersion({
+      esClient,
+      soClient,
+      logger,
+    });
+
+    expect(logger.error).toBeCalled();
+  });
+
+  it('should log a warn level when an error happens while reinstalling an uploaded package', async () => {
+    const logger = loggingSystemMock.createLogger();
+    const esClient = elasticsearchServiceMock.createInternalClient();
+    const soClient = savedObjectsClientMock.create();
+
+    mockedReinstallPackageForInstallation.mockRejectedValue(new Error('test error'));
+    soClient.find.mockResolvedValue({
+      total: 2,
+      saved_objects: [
+        {
+          attributes: { name: 'test1', install_source: 'upload' },
+        },
+      ],
+    } as any);
+
+    await upgradePackageInstallVersion({
+      esClient,
+      soClient,
+      logger,
+    });
+
+    expect(logger.warn).toBeCalled();
+  });
+});
diff --git a/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.ts b/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.ts
index cceb293b165bdc..db85e269dc3455 100644
--- a/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.ts
+++ b/x-pack/plugins/fleet/server/services/setup/upgrade_package_install_version.ts
@@ -35,7 +35,6 @@ export async function upgradePackageInstallVersion({
   logger: Logger;
 }) {
   const res = await findOutdatedInstallations(soClient);
-
   if (res.total === 0) {
     return;
   }
@@ -44,18 +43,20 @@ export async function upgradePackageInstallVersion({
     res.saved_objects,
     ({ attributes: installation }) => {
       // Uploaded package cannot be reinstalled
-      if (installation.install_source === 'upload') {
-        logger.warn(`Uploaded package needs to be manually reinstalled ${installation.name}.`);
-        return;
-      }
       return reinstallPackageForInstallation({
         soClient,
         esClient,
         installation,
       }).catch((err: Error) => {
-        logger.error(
-          `Package needs to be manually reinstalled ${installation.name} updating install_version failed. ${err.message}`
-        );
+        if (installation.install_source === 'upload') {
+          logger.warn(
+            `Uploaded package needs to be manually reinstalled ${installation.name}. ${err.message}`
+          );
+        } else {
+          logger.error(
+            `Package needs to be manually reinstalled ${installation.name} updating install_version failed. ${err.message}`
+          );
+        }
       });
     },
     { concurrency: 10 }
diff --git a/x-pack/plugins/global_search/server/index.ts b/x-pack/plugins/global_search/server/index.ts
index 107486c857f944..fb658271a1706a 100644
--- a/x-pack/plugins/global_search/server/index.ts
+++ b/x-pack/plugins/global_search/server/index.ts
@@ -6,11 +6,7 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import {
-  GlobalSearchPlugin,
-  GlobalSearchPluginSetupDeps,
-  GlobalSearchPluginStartDeps,
-} from './plugin';
+import { GlobalSearchPluginSetupDeps, GlobalSearchPluginStartDeps } from './plugin';
 import { GlobalSearchPluginSetup, GlobalSearchPluginStart } from './types';
 
 export const plugin: PluginInitializer<
@@ -18,7 +14,10 @@ export const plugin: PluginInitializer<
   GlobalSearchPluginStart,
   GlobalSearchPluginSetupDeps,
   GlobalSearchPluginStartDeps
-> = (context) => new GlobalSearchPlugin(context);
+> = async (context) => {
+  const { GlobalSearchPlugin } = await import('./plugin');
+  return new GlobalSearchPlugin(context);
+};
 
 export { config } from './config';
 
diff --git a/x-pack/plugins/global_search_providers/server/index.ts b/x-pack/plugins/global_search_providers/server/index.ts
index 92b3a4347492e3..7205361566b867 100644
--- a/x-pack/plugins/global_search_providers/server/index.ts
+++ b/x-pack/plugins/global_search_providers/server/index.ts
@@ -6,7 +6,14 @@
  */
 
 import { PluginInitializer } from '@kbn/core/server';
-import { GlobalSearchProvidersPlugin, GlobalSearchProvidersPluginSetupDeps } from './plugin';
+import type { GlobalSearchProvidersPluginSetupDeps } from './plugin';
 
-export const plugin: PluginInitializer<{}, {}, GlobalSearchProvidersPluginSetupDeps, {}> = () =>
-  new GlobalSearchProvidersPlugin();
+export const plugin: PluginInitializer<
+  {},
+  {},
+  GlobalSearchProvidersPluginSetupDeps,
+  {}
+> = async () => {
+  const { GlobalSearchProvidersPlugin } = await import('./plugin');
+  return new GlobalSearchProvidersPlugin();
+};
diff --git a/x-pack/plugins/graph/server/index.ts b/x-pack/plugins/graph/server/index.ts
index 86dca6c1196042..46877645a85035 100644
--- a/x-pack/plugins/graph/server/index.ts
+++ b/x-pack/plugins/graph/server/index.ts
@@ -8,10 +8,11 @@
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { configSchema, ConfigSchema } from '../config';
-import { GraphPlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new GraphPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { GraphPlugin } = await import('./plugin');
+  return new GraphPlugin(initializerContext);
+};
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   exposeToBrowser: {
diff --git a/x-pack/plugins/grokdebugger/server/index.js b/x-pack/plugins/grokdebugger/server/index.js
index 418959762f9ab6..fcc537e64e34e3 100644
--- a/x-pack/plugins/grokdebugger/server/index.js
+++ b/x-pack/plugins/grokdebugger/server/index.js
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-import { Plugin, config } from './plugin';
+import { config } from './plugin';
 
-export function plugin() {
+export async function plugin() {
+  const { Plugin } = await import('./plugin');
   return new Plugin();
 }
 
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
index b67ddac26fd7ea..3a85403c5649a2 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
@@ -94,121 +94,284 @@ Array [
 ]
 `;
 
-exports[`extend index management ilm summary extension should return extension when index has lifecycle error 1`] = `
-Array [
-  <h3
-    class="euiTitle emotion-euiTitle-s"
-  >
-    Index lifecycle management
-  </h3>,
-  <div
-    class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
-  />,
-  <div
-    class="euiPanel euiPanel--danger euiPanel--paddingMedium euiCallOut euiCallOut--danger emotion-euiPanel-none-m-danger-euiCallOut"
-  >
-    <p
-      class="euiTitle euiCallOutHeader__title emotion-euiTitle-xs-euiCallOutHeader-danger"
-    >
-      <span
-        aria-hidden="true"
-        class="emotion-euiCallOut__icon"
-        color="inherit"
-        data-euiicon-type="cross"
-      />
-      Index lifecycle error
-    </p>
-    <div
-      class="euiSpacer euiSpacer--s emotion-euiSpacer-s"
-    />
-    <div
-      class="euiText emotion-euiText-s-euiTextColor-default"
-    >
-      illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined
-    </div>
-  </div>,
-  <div
-    class="euiSpacer euiSpacer--m emotion-euiSpacer-m"
-  />,
+exports[`extend index management ilm summary extension should render a phase definition panel when lifecycle has phase definition 1`] = `
+<div
+  class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
+>
   <div
-    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
+    class="euiFlexItem emotion-EuiFlexItem"
   >
     <div
-      class="euiFlexItem emotion-euiFlexItem-grow-1"
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="policyPropertiesPanel"
     >
+      <div
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-center-row"
+      >
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <div
+            class="euiText emotion-euiText-xs"
+          >
+            <h3>
+              Lifecycle policy
+            </h3>
+          </div>
+        </div>
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <a
+            class="euiLink emotion-euiLink-primary"
+            href="management/data/index_lifecycle_management//policies/edit/testy"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
+            Edit policy in ILM
+            <span
+              class="emotion-euiLink__externalIcon"
+              data-euiicon-type="popout"
+            >
+              External link
+            </span>
+            <span
+              class="emotion-euiScreenReaderOnly-euiLink__screenReaderText"
+            >
+              (opens in a new tab or window)
+            </span>
+          </a>
+        </div>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+      />
       <dl
-        class="euiDescriptionList emotion-euiDescriptionList-column-left-s-s"
-        data-type="column"
+        class="euiDescriptionList emotion-euiDescriptionList-column-left-m-s"
+        data-type="responsiveColumn"
+        style="grid-template-columns: 1fr 1fr;"
       >
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Lifecycle policy
-          </strong>
+          Policy name
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          <a
-            class="euiLink emotion-euiLink-primary"
-            href="management/data/index_lifecycle_management//policies/edit/testy"
-            rel="noreferrer"
+          testy
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current phase
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <span
+            class="euiBadge emotion-euiBadge"
+            style="background-color: rgb(231, 102, 76); color: rgb(0, 0, 0);"
+            title="Hot"
           >
-            testy
-          </a>
+            <span
+              class="euiBadge__content emotion-euiBadge__content"
+            >
+              <span
+                class="euiBadge__text emotion-euiBadge__text"
+              >
+                Hot
+              </span>
+            </span>
+          </span>
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current action
-          </strong>
+          Current action
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          rollover
+          <code>
+            rollover
+          </code>
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Failed step
-          </strong>
+          Current action time
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          check-rollover-ready
+          2018-12-07 13:02:55
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current step
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <code>
+            test
+          </code>
         </dd>
       </dl>
     </div>
+  </div>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  >
     <div
-      class="euiFlexItem emotion-euiFlexItem-grow-1"
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="phaseDefinitionPanel"
     >
+      <div
+        class="euiText emotion-euiText-xs"
+      >
+        <h3>
+          Current phase definition
+        </h3>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+      />
+      <div>
+        <pre>
+          <code
+            data-code-language="json"
+          >
+            {
+  "policy": "testy",
+  "phase_definition": {
+    "min_age": "0s",
+    "actions": {
+      "rollover": {
+        "max_size": "1gb"
+      }
+    }
+  },
+  "version": 1,
+  "modified_date_in_millis": 1544031699844
+}
+          </code>
+        </pre>
+      </div>
+    </div>
+  </div>
+</div>
+`;
+
+exports[`extend index management ilm summary extension should render a step info panel when lifecycle is waiting for a step completion 1`] = `
+<div
+  class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
+>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  >
+    <div
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="policyPropertiesPanel"
+    >
+      <div
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-center-row"
+      >
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <div
+            class="euiText emotion-euiText-xs"
+          >
+            <h3>
+              Lifecycle policy
+            </h3>
+          </div>
+        </div>
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <a
+            class="euiLink emotion-euiLink-primary"
+            href="management/data/index_lifecycle_management//policies/edit/testy"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
+            Edit policy in ILM
+            <span
+              class="emotion-euiLink__externalIcon"
+              data-euiicon-type="popout"
+            >
+              External link
+            </span>
+            <span
+              class="emotion-euiScreenReaderOnly-euiLink__screenReaderText"
+            >
+              (opens in a new tab or window)
+            </span>
+          </a>
+        </div>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+      />
       <dl
-        class="euiDescriptionList emotion-euiDescriptionList-column-left-s-s"
-        data-type="column"
+        class="euiDescriptionList emotion-euiDescriptionList-column-left-m-s"
+        data-type="responsiveColumn"
+        style="grid-template-columns: 1fr 1fr;"
       >
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current phase
-          </strong>
+          Policy name
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          testy
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current phase
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <span
+            class="euiBadge emotion-euiBadge"
+            style="background-color: rgb(231, 102, 76); color: rgb(0, 0, 0);"
+            title="Hot"
+          >
+            <span
+              class="euiBadge__content emotion-euiBadge__content"
+            >
+              <span
+                class="euiBadge__text emotion-euiBadge__text"
+              >
+                Hot
+              </span>
+            </span>
+          </span>
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current action
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          hot
+          <code>
+            rollover
+          </code>
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current action time
-          </strong>
+          Current action time
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
@@ -218,134 +381,356 @@ Array [
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Phase definition
-          </strong>
+          Current step
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          <div
-            class="euiPopover emotion-euiPopover"
-            id="phaseExecutionPopover"
-          >
-            <div
-              class="euiPopover__anchor css-16vtueo-render"
-            >
-              <button
-                class="euiLink emotion-euiLink-primary"
-                type="button"
-              >
-                Show definition
-              </button>
-            </div>
-          </div>
+          <code>
+            test
+          </code>
         </dd>
       </dl>
     </div>
-  </div>,
-]
+  </div>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  >
+    <div
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="policyStepPanel"
+    >
+      <div
+        class="euiText emotion-euiText-xs"
+      >
+        <h3>
+          Current step info
+        </h3>
+        <div
+          class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+        />
+        <div>
+          <pre>
+            <code
+              data-code-language="json"
+            >
+              {
+  "message": "Waiting for all shard copies to be active",
+  "shards_left_to_allocate": -1,
+  "all_shards_active": false,
+  "number_of_replicas": 2
+}
+            </code>
+          </pre>
+        </div>
+      </div>
+    </div>
+    <div
+      class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+    />
+  </div>
+</div>
 `;
 
-exports[`extend index management ilm summary extension should return extension when index has lifecycle policy 1`] = `
-Array [
-  <h3
-    class="euiTitle emotion-euiTitle-s"
-  >
-    Index lifecycle management
-  </h3>,
-  <div
-    class="euiSpacer euiSpacer--m emotion-euiSpacer-m"
-  />,
+exports[`extend index management ilm summary extension should render an error panel when index has lifecycle error 1`] = `
+<div
+  class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
+>
   <div
-    class="euiFlexGroup emotion-euiFlexGroup-responsive-l-flexStart-stretch-row"
+    class="euiFlexItem emotion-EuiFlexItem"
   >
     <div
-      class="euiFlexItem emotion-euiFlexItem-grow-1"
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="policyPropertiesPanel"
     >
+      <div
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-center-row"
+      >
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <div
+            class="euiText emotion-euiText-xs"
+          >
+            <h3>
+              Lifecycle policy
+            </h3>
+          </div>
+        </div>
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <a
+            class="euiLink emotion-euiLink-primary"
+            href="management/data/index_lifecycle_management//policies/edit/testy"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
+            Edit policy in ILM
+            <span
+              class="emotion-euiLink__externalIcon"
+              data-euiicon-type="popout"
+            >
+              External link
+            </span>
+            <span
+              class="emotion-euiScreenReaderOnly-euiLink__screenReaderText"
+            >
+              (opens in a new tab or window)
+            </span>
+          </a>
+        </div>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+      />
       <dl
-        class="euiDescriptionList emotion-euiDescriptionList-column-left-s-s"
-        data-type="column"
+        class="euiDescriptionList emotion-euiDescriptionList-column-left-m-s"
+        data-type="responsiveColumn"
+        style="grid-template-columns: 1fr 1fr;"
       >
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Lifecycle policy
-          </strong>
+          Policy name
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          <a
-            class="euiLink emotion-euiLink-primary"
-            href="management/data/index_lifecycle_management//policies/edit/testy"
-            rel="noreferrer"
+          testy
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current phase
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <span
+            class="euiBadge emotion-euiBadge"
+            style="background-color: rgb(231, 102, 76); color: rgb(0, 0, 0);"
+            title="Hot"
           >
-            testy
-          </a>
+            <span
+              class="euiBadge__content emotion-euiBadge__content"
+            >
+              <span
+                class="euiBadge__text emotion-euiBadge__text"
+              >
+                Hot
+              </span>
+            </span>
+          </span>
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current action
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <code>
+            rollover
+          </code>
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current action
-          </strong>
+          Current action time
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          complete
+          2018-12-07 13:02:55
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Failed step
-          </strong>
+          Current step
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          -
+          <code>
+            ERROR
+          </code>
         </dd>
       </dl>
     </div>
+  </div>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  >
     <div
-      class="euiFlexItem emotion-euiFlexItem-grow-1"
+      class="euiPanel euiPanel--danger euiPanel--paddingMedium emotion-euiPanel-m-m-danger"
+      data-test-subj="policyErrorPanel"
     >
+      <div
+        class="euiText emotion-euiText-xs"
+      >
+        <h3>
+          Lifecycle error
+        </h3>
+        <div
+          class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+        />
+        <div>
+          <pre>
+            <code
+              data-code-language="json"
+            >
+              {
+  "failed_step": "check-rollover-ready",
+  "step_info": {
+    "type": "illegal_argument_exception",
+    "reason": "setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined"
+  }
+}
+            </code>
+          </pre>
+        </div>
+      </div>
+    </div>
+    <div
+      class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+    />
+  </div>
+</div>
+`;
+
+exports[`extend index management ilm summary extension should render the tab when index has lifecycle policy 1`] = `
+<div
+  class="euiFlexGroup emotion-euiFlexGroup-responsive-wrap-l-flexStart-stretch-row"
+>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  >
+    <div
+      class="euiPanel euiPanel--plain euiPanel--paddingMedium emotion-euiPanel-m-m-plain-hasBorder"
+      data-test-subj="policyPropertiesPanel"
+    >
+      <div
+        class="euiFlexGroup emotion-euiFlexGroup-responsive-l-spaceBetween-center-row"
+      >
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <div
+            class="euiText emotion-euiText-xs"
+          >
+            <h3>
+              Lifecycle policy
+            </h3>
+          </div>
+        </div>
+        <div
+          class="euiFlexItem emotion-euiFlexItem-growZero"
+        >
+          <a
+            class="euiLink emotion-euiLink-primary"
+            href="management/data/index_lifecycle_management//policies/edit/testy"
+            rel="noopener noreferrer"
+            target="_blank"
+          >
+            Edit policy in ILM
+            <span
+              class="emotion-euiLink__externalIcon"
+              data-euiicon-type="popout"
+            >
+              External link
+            </span>
+            <span
+              class="emotion-euiScreenReaderOnly-euiLink__screenReaderText"
+            >
+              (opens in a new tab or window)
+            </span>
+          </a>
+        </div>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--l emotion-euiSpacer-l"
+      />
       <dl
-        class="euiDescriptionList emotion-euiDescriptionList-column-left-s-s"
-        data-type="column"
+        class="euiDescriptionList emotion-euiDescriptionList-column-left-m-s"
+        data-type="responsiveColumn"
+        style="grid-template-columns: 1fr 1fr;"
       >
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current phase
-          </strong>
+          Policy name
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          testy
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current phase
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <span
+            class="euiBadge emotion-euiBadge-default"
+            title="new"
+          >
+            <span
+              class="euiBadge__content emotion-euiBadge__content"
+            >
+              <span
+                class="euiBadge__text emotion-euiBadge__text"
+              >
+                new
+              </span>
+            </span>
+          </span>
+        </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current action
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
-          new
+          <code>
+            complete
+          </code>
         </dd>
         <dt
           class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
         >
-          <strong>
-            Current action time
-          </strong>
+          Current action time
         </dt>
         <dd
           class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
         >
           2018-12-07 13:02:55
         </dd>
+        <dt
+          class="euiDescriptionList__title emotion-euiDescriptionList__title-column-normal"
+        >
+          Current step
+        </dt>
+        <dd
+          class="euiDescriptionList__description emotion-euiDescriptionList__description-column-normal"
+        >
+          <code>
+            complete
+          </code>
+        </dd>
       </dl>
     </div>
-  </div>,
-]
+  </div>
+  <div
+    class="euiFlexItem emotion-EuiFlexItem"
+  />
+</div>
 `;
 
 exports[`extend index management remove lifecycle action extension should return extension when all indices have lifecycle policy 1`] = `
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx
index 244536ad4afef7..e26000bcacc7df 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/extend_index_management.test.tsx
@@ -22,6 +22,7 @@ import { init as initHttp } from '../public/application/services/http';
 import { init as initUiMetric } from '../public/application/services/ui_metric';
 import { indexLifecycleTab } from '../public/extend_index_management/components/index_lifecycle_summary';
 import { Index } from '@kbn/index-management-plugin/common';
+import { findTestSubject } from '@elastic/eui/lib/test';
 
 const { httpSetup } = init();
 
@@ -111,6 +112,33 @@ const indexWithLifecycleError: Index = {
       type: 'illegal_argument_exception',
       reason: 'setting [index.lifecycle.rollover_alias] for index [testy3] is empty or not defined',
     },
+  },
+};
+const indexWithLifecyclePhaseDefinition: Index = {
+  health: 'yellow',
+  status: 'open',
+  name: 'testy3',
+  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
+  primary: 1,
+  replica: 1,
+  documents: 2,
+  documents_deleted: 0,
+  size: '6.5kb',
+  primary_size: '6.5kb',
+  aliases: 'none',
+  isFrozen: false,
+  hidden: false,
+  ilm: {
+    index: 'testy3',
+    managed: true,
+    policy: 'testy',
+    lifecycle_date_millis: 1544020872361,
+    phase: 'hot',
+    phase_time_millis: 1544187775891,
+    action: 'rollover',
+    action_time_millis: 1544187775891,
+    step: 'test',
+    step_time_millis: 1544187776208,
     phase_execution: {
       policy: 'testy',
       // @ts-expect-error ILM type is incorrect https://github.com/elastic/elasticsearch-specification/issues/2326
@@ -120,6 +148,39 @@ const indexWithLifecycleError: Index = {
     },
   },
 };
+const indexWithLifecycleWaitingStep: Index = {
+  health: 'yellow',
+  status: 'open',
+  name: 'testy3',
+  uuid: 'XL11TLa3Tvq298_dMUzLHQ',
+  primary: 1,
+  replica: 1,
+  documents: 2,
+  documents_deleted: 0,
+  size: '6.5kb',
+  primary_size: '6.5kb',
+  aliases: 'none',
+  isFrozen: false,
+  hidden: false,
+  ilm: {
+    index: 'testy3',
+    managed: true,
+    policy: 'testy',
+    lifecycle_date_millis: 1544020872361,
+    phase: 'hot',
+    phase_time_millis: 1544187775891,
+    action: 'rollover',
+    action_time_millis: 1544187775891,
+    step: 'test',
+    step_time_millis: 1544187776208,
+    step_info: {
+      message: 'Waiting for all shard copies to be active',
+      shards_left_to_allocate: -1,
+      all_shards_active: false,
+      number_of_replicas: 2,
+    },
+  },
+};
 
 moment.tz.setDefault('utc');
 
@@ -245,6 +306,11 @@ describe('extend index management', () => {
 
   describe('ilm summary extension', () => {
     const IlmComponent = indexLifecycleTab.renderTabContent;
+    const policyPropertiesPanel = 'policyPropertiesPanel';
+    const policyStepPanel = 'policyStepPanel';
+    const policyErrorPanel = 'policyErrorPanel';
+    const phaseDefinitionPanel = 'phaseDefinitionPanel';
+
     test('should not render the tab when index has no index lifecycle policy', () => {
       const shouldRenderTab =
         indexLifecycleTab.shouldRenderTab &&
@@ -254,22 +320,58 @@ describe('extend index management', () => {
       expect(shouldRenderTab).toBeFalsy();
     });
 
-    test('should return extension when index has lifecycle policy', () => {
+    test('should render the tab when index has lifecycle policy', () => {
+      const shouldRenderTab =
+        indexLifecycleTab.shouldRenderTab &&
+        indexLifecycleTab.shouldRenderTab({
+          index: indexWithLifecyclePolicy,
+        });
+      expect(shouldRenderTab).toBeTruthy();
       const ilmContent = (
         <IlmComponent index={indexWithLifecyclePolicy} getUrlForApp={getUrlForApp} />
       );
-      expect(ilmContent).toBeDefined();
       const rendered = mountWithIntl(ilmContent);
       expect(rendered.render()).toMatchSnapshot();
+      expect(findTestSubject(rendered, policyPropertiesPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, phaseDefinitionPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyStepPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyErrorPanel).exists()).toBeFalsy();
     });
 
-    test('should return extension when index has lifecycle error', () => {
+    test('should render an error panel when index has lifecycle error', () => {
       const ilmContent = (
         <IlmComponent index={indexWithLifecycleError} getUrlForApp={getUrlForApp} />
       );
-      expect(ilmContent).toBeDefined();
       const rendered = mountWithIntl(ilmContent);
       expect(rendered.render()).toMatchSnapshot();
+      expect(findTestSubject(rendered, policyPropertiesPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, phaseDefinitionPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyStepPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyErrorPanel).exists()).toBeTruthy();
+    });
+
+    test('should render a phase definition panel when lifecycle has phase definition', () => {
+      const ilmContent = (
+        <IlmComponent index={indexWithLifecyclePhaseDefinition} getUrlForApp={getUrlForApp} />
+      );
+      const rendered = mountWithIntl(ilmContent);
+      expect(rendered.render()).toMatchSnapshot();
+      expect(findTestSubject(rendered, policyPropertiesPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, phaseDefinitionPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, policyStepPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyErrorPanel).exists()).toBeFalsy();
+    });
+
+    test('should render a step info panel when lifecycle is waiting for a step completion', () => {
+      const ilmContent = (
+        <IlmComponent index={indexWithLifecycleWaitingStep} getUrlForApp={getUrlForApp} />
+      );
+      const rendered = mountWithIntl(ilmContent);
+      expect(rendered.render()).toMatchSnapshot();
+      expect(findTestSubject(rendered, policyPropertiesPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, phaseDefinitionPanel).exists()).toBeFalsy();
+      expect(findTestSubject(rendered, policyStepPanel).exists()).toBeTruthy();
+      expect(findTestSubject(rendered, policyErrorPanel).exists()).toBeFalsy();
     });
   });
 
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/index.tsx b/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
index c604679c4c7d80..6f8ddf148fec95 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/index.tsx
@@ -42,24 +42,30 @@ export const renderApp = (
 ): UnmountCallback => {
   const { getUrlForApp } = application;
   render(
-    <RedirectAppLinks application={application} className={APP_WRAPPER_CLASS}>
-      <I18nContext>
-        <KibanaThemeProvider theme$={theme$}>
-          <KibanaContextProvider
-            services={{
-              cloud,
-              breadcrumbService,
-              license,
-              getUrlForApp,
-              docLinks,
-              executionContext,
-            }}
-          >
-            <App history={history} />
-          </KibanaContextProvider>
-        </KibanaThemeProvider>
-      </I18nContext>
-    </RedirectAppLinks>,
+    <div className={APP_WRAPPER_CLASS}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
+        <I18nContext>
+          <KibanaThemeProvider theme$={theme$}>
+            <KibanaContextProvider
+              services={{
+                cloud,
+                breadcrumbService,
+                license,
+                getUrlForApp,
+                docLinks,
+                executionContext,
+              }}
+            >
+              <App history={history} />
+            </KibanaContextProvider>
+          </KibanaThemeProvider>
+        </I18nContext>
+      </RedirectAppLinks>
+    </div>,
     element
   );
 
diff --git a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx
index 162457479788fc..0afe886bf1706c 100644
--- a/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx
@@ -5,240 +5,241 @@
  * 2.0.
  */
 
-import React, { FunctionComponent, Fragment, useState } from 'react';
+import React, { FunctionComponent } from 'react';
 import moment from 'moment-timezone';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
+import { css } from '@emotion/react';
 import {
-  EuiCallOut,
   EuiCodeBlock,
-  EuiFlexGroup,
+  EuiLink,
   EuiFlexItem,
-  EuiDescriptionList,
-  EuiDescriptionListTitle,
-  EuiDescriptionListDescription,
+  EuiFlexGroup,
+  EuiPanel,
+  EuiText,
   EuiSpacer,
-  EuiTitle,
-  EuiLink,
-  EuiPopover,
-  EuiPopoverTitle,
+  EuiDescriptionList,
+  EuiBadgeProps,
+  EuiBadge,
+  EuiCode,
 } from '@elastic/eui';
+import { euiThemeVars } from '@kbn/ui-theme';
 
 import { ApplicationStart } from '@kbn/core/public';
 import { Index } from '@kbn/index-management-plugin/common';
 import { IndexDetailsTab } from '@kbn/index-management-plugin/common/constants';
 import { IlmExplainLifecycleLifecycleExplainManaged } from '@elastic/elasticsearch/lib/api/types';
+import { Phase } from '../../../common/types';
 import { getPolicyEditPath } from '../../application/services/navigation';
 
-const getHeaders = (): Array<[keyof IlmExplainLifecycleLifecycleExplainManaged, string]> => {
-  return [
-    [
-      'policy',
-      i18n.translate(
-        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader',
+const phaseToBadgeMapping: Record<Phase, { color: EuiBadgeProps['color']; label: string }> = {
+  hot: {
+    color: euiThemeVars.euiColorVis9,
+    label: 'Hot',
+  },
+  warm: {
+    color: euiThemeVars.euiColorVis5,
+    label: 'Warm',
+  },
+  cold: {
+    color: euiThemeVars.euiColorVis1,
+    label: 'Cold',
+  },
+  frozen: {
+    color: euiThemeVars.euiColorVis4,
+    label: 'Frozen',
+  },
+  delete: {
+    color: 'default',
+    label: 'Delete',
+  },
+};
+
+interface Props {
+  index: Index;
+  getUrlForApp: ApplicationStart['getUrlForApp'];
+}
+
+export const IndexLifecycleSummary: FunctionComponent<Props> = ({ index, getUrlForApp }) => {
+  const { ilm: ilmData } = index;
+  // only ILM managed indices render the ILM tab
+  const ilm = ilmData as IlmExplainLifecycleLifecycleExplainManaged;
+
+  // if ilm.phase is an unexpected value, then display a default badge
+  const phaseBadgeConfig = phaseToBadgeMapping[ilm.phase as Phase] ?? {
+    color: 'default',
+    label: ilm.phase,
+  };
+  const lifecycleProperties = [
+    {
+      title: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.policyNameTitle',
         {
-          defaultMessage: 'Lifecycle policy',
+          defaultMessage: 'Policy name',
         }
       ),
-    ],
-    [
-      'phase',
-      i18n.translate(
-        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader',
+      description: ilm.policy,
+    },
+    {
+      title: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseTitle',
         {
           defaultMessage: 'Current phase',
         }
       ),
-    ],
-    [
-      'action',
-      i18n.translate(
-        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader',
+      description: <EuiBadge color={phaseBadgeConfig.color}>{phaseBadgeConfig.label}</EuiBadge>,
+    },
+  ];
+  if (ilm.action) {
+    lifecycleProperties.push({
+      title: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTitle',
         {
           defaultMessage: 'Current action',
         }
       ),
-    ],
-    [
-      'action_time_millis',
-      i18n.translate(
-        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader',
+      description: <EuiCode>{ilm.action}</EuiCode>,
+    });
+  }
+  if (ilm.action_time_millis) {
+    lifecycleProperties.push({
+      title: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeTitle',
         {
           defaultMessage: 'Current action time',
         }
       ),
-    ],
-    [
-      'failed_step',
-      i18n.translate(
-        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader',
+      description: moment(ilm.action_time_millis).format('YYYY-MM-DD HH:mm:ss'),
+    });
+  }
+  if (ilm.step) {
+    lifecycleProperties.push({
+      title: i18n.translate(
+        'xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentStepTitle',
         {
-          defaultMessage: 'Failed step',
+          defaultMessage: 'Current step',
         }
       ),
-    ],
-  ];
-};
-
-interface Props {
-  index: Index;
-  getUrlForApp: ApplicationStart['getUrlForApp'];
-}
-
-export const IndexLifecycleSummary: FunctionComponent<Props> = ({ index, getUrlForApp }) => {
-  const [showPhaseExecutionPopover, setShowPhaseExecutionPopover] = useState<boolean>(false);
-  const { ilm: ilmData } = index;
-  // only ILM managed indices render the ILM tab
-  const ilm = ilmData as IlmExplainLifecycleLifecycleExplainManaged;
-
-  const togglePhaseExecutionPopover = () => {
-    setShowPhaseExecutionPopover(!showPhaseExecutionPopover);
-  };
-  const closePhaseExecutionPopover = () => {
-    setShowPhaseExecutionPopover(false);
-  };
-  const renderPhaseExecutionPopoverButton = () => {
-    const button = (
-      <EuiLink onClick={togglePhaseExecutionPopover}>
-        <FormattedMessage
-          defaultMessage="Show definition"
-          id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton"
-        />
-      </EuiLink>
-    );
-    return (
-      <Fragment key="phaseDefinition">
-        <EuiDescriptionListTitle key="phaseDefinition_title">
-          <strong>
-            <FormattedMessage
-              defaultMessage="Phase definition"
-              id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle"
-            />
-          </strong>
-        </EuiDescriptionListTitle>
-        <EuiDescriptionListDescription key="phaseDefinition_desc">
-          <EuiPopover
-            key="phaseExecutionPopover"
-            id="phaseExecutionPopover"
-            button={button}
-            isOpen={showPhaseExecutionPopover}
-            closePopover={closePhaseExecutionPopover}
-          >
-            <EuiPopoverTitle>
-              <FormattedMessage
-                defaultMessage="Phase definition"
-                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle"
-              />
-            </EuiPopoverTitle>
-            <EuiCodeBlock language="json">
-              {JSON.stringify(ilm.phase_execution, null, 2)}
-            </EuiCodeBlock>
-          </EuiPopover>
-        </EuiDescriptionListDescription>
-      </Fragment>
-    );
-  };
-  const buildRows = () => {
-    const headers = getHeaders();
-    const rows: {
-      left: JSX.Element[];
-      right: JSX.Element[];
-    } = {
-      left: [],
-      right: [],
-    };
-    headers.forEach(([fieldName, label], arrayIndex) => {
-      const value = ilm[fieldName];
-      let content;
-      if (fieldName === 'action_time_millis') {
-        content = moment(value as string).format('YYYY-MM-DD HH:mm:ss');
-      } else if (fieldName === 'policy') {
-        content = (
-          <EuiLink
-            href={getUrlForApp('management', {
-              path: `data/index_lifecycle_management/${getPolicyEditPath(value as string)}`,
-            })}
-          >
-            {value}
-          </EuiLink>
-        );
-      } else {
-        content = value;
-      }
-      content = content || '-';
-      const cell = (
-        <Fragment key={String(arrayIndex)}>
-          <EuiDescriptionListTitle key={fieldName}>
-            <strong>{label}</strong>
-          </EuiDescriptionListTitle>
-          <EuiDescriptionListDescription key={fieldName + '_desc'}>
-            {content}
-          </EuiDescriptionListDescription>
-        </Fragment>
-      );
-      if (arrayIndex % 2 === 0) {
-        rows.left.push(cell);
-      } else {
-        rows.right.push(cell);
-      }
+      description: <EuiCode>{ilm.step}</EuiCode>,
     });
-    if (ilm.phase_execution) {
-      rows.right.push(renderPhaseExecutionPopoverButton());
-    }
-    return rows;
-  };
-
-  const { left, right } = buildRows();
+  }
   return (
     <>
-      <EuiTitle size="s">
-        <h3>
-          <FormattedMessage
-            defaultMessage="Index lifecycle management"
-            id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle"
-          />
-        </h3>
-      </EuiTitle>
-      {ilm.step_info && ilm.step_info.type ? (
-        <>
-          <EuiSpacer size="s" />
-          <EuiCallOut
-            color="danger"
-            title={
-              <FormattedMessage
-                defaultMessage="Index lifecycle error"
-                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage"
-              />
-            }
-            iconType="cross"
-          >
-            {ilm.step_info.type}: {ilm.step_info.reason}
-          </EuiCallOut>
-        </>
-      ) : null}
-      {ilm.step_info && ilm.step_info!.message ? (
-        <>
-          <EuiSpacer size="s" />
-          <EuiCallOut
-            color="primary"
-            title={
-              <FormattedMessage
-                defaultMessage="Action status"
-                id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle"
-              />
-            }
-          >
-            {ilm.step_info!.message}
-          </EuiCallOut>
-        </>
-      ) : null}
-      <EuiSpacer size="m" />
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiDescriptionList type="column">{left}</EuiDescriptionList>
+      <EuiFlexGroup wrap>
+        <EuiFlexItem
+          grow={1}
+          css={css`
+            min-width: 400px;
+          `}
+        >
+          <EuiPanel hasBorder={true} grow={false} data-test-subj="policyPropertiesPanel">
+            <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
+              <EuiFlexItem grow={false}>
+                <EuiText size="xs">
+                  <h3>
+                    <FormattedMessage
+                      defaultMessage="Lifecycle policy"
+                      id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.policyCardTitle"
+                    />
+                  </h3>
+                </EuiText>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiLink
+                  color="primary"
+                  href={getUrlForApp('management', {
+                    path: `data/index_lifecycle_management/${getPolicyEditPath(ilm.policy)}`,
+                  })}
+                  target="_blank"
+                >
+                  <FormattedMessage
+                    defaultMessage="Edit policy in ILM"
+                    id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.ilmLinkLabel"
+                  />
+                </EuiLink>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+
+            <EuiSpacer />
+            <EuiDescriptionList
+              rowGutterSize="m"
+              type="responsiveColumn"
+              columnWidths={[1, 1]}
+              listItems={lifecycleProperties}
+            />
+          </EuiPanel>
         </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiDescriptionList type="column">{right}</EuiDescriptionList>
+        <EuiFlexItem
+          grow={3}
+          css={css`
+            min-width: 600px;
+          `}
+        >
+          {ilm.step_info && ilm.step === 'ERROR' && (
+            // there is an error
+            <>
+              <EuiPanel
+                color="danger"
+                hasBorder={true}
+                grow={false}
+                data-test-subj="policyErrorPanel"
+              >
+                <EuiText size="xs">
+                  <h3>
+                    <FormattedMessage
+                      defaultMessage="Lifecycle error"
+                      id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.lifecycleErrorTitle"
+                    />
+                  </h3>
+                  <EuiSpacer />
+                  <EuiCodeBlock language="json" isCopyable>
+                    {JSON.stringify(
+                      { failed_step: ilm.failed_step, step_info: ilm.step_info },
+                      null,
+                      2
+                    )}
+                  </EuiCodeBlock>
+                </EuiText>
+              </EuiPanel>
+              <EuiSpacer />
+            </>
+          )}
+          {ilm.step_info && ilm.step !== 'ERROR' && (
+            // ILM is waiting for the step to complete
+            <>
+              <EuiPanel hasBorder={true} grow={false} data-test-subj="policyStepPanel">
+                <EuiText size="xs">
+                  <h3>
+                    <FormattedMessage
+                      defaultMessage="Current step info"
+                      id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.stepInfoTitle"
+                    />
+                  </h3>
+                  <EuiSpacer />
+                  <EuiCodeBlock language="json" isCopyable>
+                    {JSON.stringify(ilm.step_info, null, 2)}
+                  </EuiCodeBlock>
+                </EuiText>
+              </EuiPanel>
+              <EuiSpacer />
+            </>
+          )}
+          {ilm.phase_execution && (
+            <EuiPanel hasBorder={true} grow={false} data-test-subj="phaseDefinitionPanel">
+              <EuiText size="xs">
+                <h3>
+                  <FormattedMessage
+                    defaultMessage="Current phase definition"
+                    id="xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle"
+                  />
+                </h3>
+              </EuiText>
+              <EuiSpacer />
+              <EuiCodeBlock language="json" isCopyable>
+                {JSON.stringify(ilm.phase_execution, null, 2)}
+              </EuiCodeBlock>
+            </EuiPanel>
+          )}
         </EuiFlexItem>
       </EuiFlexGroup>
     </>
diff --git a/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts b/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
index 30481afc2c24c2..402736cbd13a51 100644
--- a/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
@@ -47,10 +47,11 @@ export { attemptToURIDecode } from '@kbn/es-ui-shared-plugin/public';
 export {
   KibanaContextProvider,
   KibanaThemeProvider,
-  RedirectAppLinks,
   useExecutionContext,
 } from '@kbn/kibana-react-plugin/public';
 
+export { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+
 export { APP_WRAPPER_CLASS } from '@kbn/core/public';
 
 export const useKibana = () => _useKibana<AppServicesContext>();
diff --git a/x-pack/plugins/index_lifecycle_management/server/index.ts b/x-pack/plugins/index_lifecycle_management/server/index.ts
index 2f4c3a47065348..b4789a4868eba2 100644
--- a/x-pack/plugins/index_lifecycle_management/server/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/index.ts
@@ -6,9 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { IndexLifecycleManagementServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) =>
-  new IndexLifecycleManagementServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { IndexLifecycleManagementServerPlugin } = await import('./plugin');
+  return new IndexLifecycleManagementServerPlugin(ctx);
+};
diff --git a/x-pack/plugins/index_lifecycle_management/tsconfig.json b/x-pack/plugins/index_lifecycle_management/tsconfig.json
index e437c207ef5f7d..6632d318e5d9fa 100644
--- a/x-pack/plugins/index_lifecycle_management/tsconfig.json
+++ b/x-pack/plugins/index_lifecycle_management/tsconfig.json
@@ -35,6 +35,8 @@
     "@kbn/core-http-browser",
     "@kbn/config-schema",
     "@kbn/shared-ux-router",
+    "@kbn/ui-theme",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/index_management/README.md b/x-pack/plugins/index_management/README.md
index 8673447fc577ca..867ccbd74335c9 100644
--- a/x-pack/plugins/index_management/README.md
+++ b/x-pack/plugins/index_management/README.md
@@ -34,14 +34,15 @@ interface IndexDetailsTab {
 
 An example of adding an ILM tab can be found in [this file](https://github.com/elastic/kibana/blob/main/x-pack/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.tsx#L250).
 
-- `setIndexOverviewContent(content: IndexOverviewContent)`: replaces the default content in the overview tab (code block describing adding documents to the index) with the custom content. The custom content has the following interface: 
+- `setIndexOverviewContent(content: IndexContent)`: replaces the default content in the overview tab (code block describing adding documents to the index) with the custom content. The custom content has the following interface: 
 ```ts
-interface IndexOverviewContent {
+interface IndexContent {
   renderContent: (args: {
     index: Index;
     getUrlForApp: ApplicationStart['getUrlForApp'];
   }) => ReturnType<FunctionComponent>;
 ```
+- `setIndexMappingsContent(content: IndexContent)`: adds content to the mappings tab of the index details page. The content is displayed in the right bottom corner, below the mappings docs link. 
 
 ## Indices tab
 
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/home/enrich_policies.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/home/enrich_policies.test.tsx
index 6d0cafe0c938bf..e3666d19f88b02 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/home/enrich_policies.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/home/enrich_policies.test.tsx
@@ -31,8 +31,7 @@ jest.mock('@kbn/kibana-react-plugin/public', () => {
   };
 });
 
-// Failing: See https://github.com/elastic/kibana/issues/170239
-describe.skip('Enrich policies tab', () => {
+describe('Enrich policies tab', () => {
   const { httpSetup, httpRequestsMockHelpers, setDelayResponse } = setupEnvironment();
   let testBed: EnrichPoliciesTestBed;
 
@@ -141,7 +140,7 @@ describe.skip('Enrich policies tab', () => {
 
       // Should have made a call to load the policies after the reload
       // button is clicked.
-      expect(httpSetup.get.mock.calls).toHaveLength(1);
+      expect(httpSetup.get.mock.calls.length).toBeGreaterThan(0);
     });
 
     describe('details flyout', () => {
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
index afdfa15c917aa1..24938682ac5199 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
@@ -501,6 +501,28 @@ describe('<IndexDetailsPage />', () => {
         expect(httpSetup.get).toHaveBeenCalledTimes(numberOfRequests + 1);
       });
     });
+
+    it('renders the content set via the extensions service', async () => {
+      const mappingsContent = 'test mappings extension';
+      await act(async () => {
+        testBed = await setup({
+          httpSetup,
+          dependencies: {
+            services: {
+              extensionsService: {
+                _indexMappingsContent: {
+                  renderContent: () => mappingsContent,
+                },
+              },
+            },
+          },
+        });
+      });
+      testBed.component.update();
+      await testBed.actions.clickIndexDetailsTab(IndexDetailsSection.Mappings);
+      const content = testBed.actions.getActiveTabContent();
+      expect(content).toContain(mappingsContent);
+    });
   });
 
   describe('Settings tab', () => {
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_clone.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_clone.test.tsx
index ecd3e617635f14..91afa2ff3947af 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_clone.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_clone.test.tsx
@@ -12,7 +12,7 @@ import { API_BASE_PATH } from '../../../common/constants';
 import { getComposableTemplate } from '../../../test/fixtures';
 import { setupEnvironment } from '../helpers';
 
-import { TEMPLATE_NAME, INDEX_PATTERNS as DEFAULT_INDEX_PATTERNS, MAPPINGS } from './constants';
+import { TEMPLATE_NAME, INDEX_PATTERNS as DEFAULT_INDEX_PATTERNS } from './constants';
 import { setup } from './template_clone.helpers';
 import { TemplateFormTestBed } from './template_form.helpers';
 
@@ -37,9 +37,7 @@ jest.mock('@elastic/eui', () => {
 const templateToClone = getComposableTemplate({
   name: TEMPLATE_NAME,
   indexPatterns: ['indexPattern1'],
-  template: {
-    mappings: MAPPINGS,
-  },
+  template: {},
   allowAutoCreate: true,
 });
 
@@ -98,7 +96,7 @@ describe('<TemplateClone />', () => {
         actions.clickNextButton();
       });
 
-      const { priority, version, _kbnMeta, allowAutoCreate } = templateToClone;
+      const { template, priority, version, _kbnMeta, allowAutoCreate } = templateToClone;
       expect(httpSetup.post).toHaveBeenLastCalledWith(
         `${API_BASE_PATH}/index_templates`,
         expect.objectContaining({
@@ -109,6 +107,7 @@ describe('<TemplateClone />', () => {
             version,
             allowAutoCreate,
             _kbnMeta,
+            template,
           }),
         })
       );
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_create.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_create.test.tsx
index 7558ae7ce272a3..fd373efb6d17da 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_create.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_create.test.tsx
@@ -532,6 +532,12 @@ describe('<TemplateCreate />', () => {
       await actions.completeStepOne({
         name: TEMPLATE_NAME,
         indexPatterns: DEFAULT_INDEX_PATTERNS,
+        dataStream: {},
+        lifecycle: {
+          enabled: true,
+          value: 1,
+          unit: 'd',
+        },
         allowAutoCreate: true,
       });
       // Component templates
@@ -560,6 +566,7 @@ describe('<TemplateCreate />', () => {
             name: TEMPLATE_NAME,
             indexPatterns: DEFAULT_INDEX_PATTERNS,
             allowAutoCreate: true,
+            dataStream: {},
             _kbnMeta: {
               type: 'default',
               hasDatastream: false,
@@ -582,6 +589,10 @@ describe('<TemplateCreate />', () => {
                 },
               },
               aliases: ALIASES,
+              lifecycle: {
+                enabled: true,
+                data_retention: '1d',
+              },
             },
           }),
         })
@@ -621,6 +632,11 @@ describe('<TemplateCreate />', () => {
       name: TEMPLATE_NAME,
       indexPatterns: DEFAULT_INDEX_PATTERNS,
       dataStream: {},
+      lifecycle: {
+        enabled: true,
+        value: 1,
+        unit: 'd',
+      },
     });
 
     await act(async () => {
@@ -631,6 +647,12 @@ describe('<TemplateCreate />', () => {
       `${API_BASE_PATH}/index_templates/simulate`,
       expect.objectContaining({
         body: JSON.stringify({
+          template: {
+            lifecycle: {
+              enabled: true,
+              data_retention: '1d',
+            },
+          },
           index_patterns: DEFAULT_INDEX_PATTERNS,
           data_stream: {},
           allow_auto_create: false,
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_edit.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_edit.test.tsx
index 157cec2f91cd4c..56cfbf7968ecc2 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_edit.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_edit.test.tsx
@@ -119,6 +119,11 @@ describe('<TemplateEdit />', () => {
         name: 'test',
         indexPatterns: ['myPattern*'],
         version: 1,
+        lifecycle: {
+          enabled: true,
+          value: 1,
+          unit: 'd',
+        },
       });
       // Component templates
       await actions.completeStepTwo();
@@ -150,6 +155,12 @@ describe('<TemplateEdit />', () => {
               hasDatastream: true,
               isLegacy: false,
             },
+            template: {
+              lifecycle: {
+                enabled: true,
+                data_retention: '1d',
+              },
+            },
           }),
         })
       );
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_form.helpers.ts b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_form.helpers.ts
index 0974ee79346ed5..8b98fb769959f6 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_form.helpers.ts
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_template_wizard/template_form.helpers.ts
@@ -146,6 +146,7 @@ export const formSetup = async (initTestBed: SetupFunc<TestSubjects>) => {
     priority,
     version,
     dataStream,
+    lifecycle,
     allowAutoCreate,
   }: Partial<TemplateDeserialized> = {}) => {
     const { component, form, find } = testBed;
@@ -184,12 +185,27 @@ export const formSetup = async (initTestBed: SetupFunc<TestSubjects>) => {
       if (version) {
         form.setInputValue('versionField.input', JSON.stringify(version));
       }
+    });
+    component.update();
 
+    if (lifecycle && lifecycle.enabled) {
+      act(() => {
+        form.toggleEuiSwitch('dataRetentionToggle.input');
+      });
+      component.update();
+
+      act(() => {
+        form.setInputValue('valueDataRetentionField', String(lifecycle.value));
+      });
+    }
+
+    await act(async () => {
       if (allowAutoCreate) {
         form.toggleEuiSwitch('allowAutoCreateField.input');
       }
 
       clickNextButton();
+      jest.advanceTimersByTime(0);
     });
 
     component.update();
@@ -215,7 +231,6 @@ export const formSetup = async (initTestBed: SetupFunc<TestSubjects>) => {
 
     await act(async () => {
       clickNextButton();
-      jest.advanceTimersByTime(0);
     });
 
     component.update();
@@ -337,6 +352,7 @@ export type TestSubjects =
   | 'orderField.input'
   | 'priorityField.input'
   | 'dataStreamField.input'
+  | 'dataRetentionToggle.input'
   | 'allowAutoCreateField.input'
   | 'pageTitle'
   | 'previewTab'
@@ -361,6 +377,7 @@ export type TestSubjects =
   | 'aliasesEditor'
   | 'settingsEditor'
   | 'versionField.input'
+  | 'valueDataRetentionField'
   | 'mappingsEditor.formTab'
   | 'mappingsEditor.advancedConfiguration.sizeEnabledToggle'
   | 'previewIndexTemplate';
diff --git a/x-pack/plugins/index_management/common/lib/data_stream_serialization.ts b/x-pack/plugins/index_management/common/lib/data_stream_serialization.ts
index d7bd1d9e92f957..ceedd072139aa7 100644
--- a/x-pack/plugins/index_management/common/lib/data_stream_serialization.ts
+++ b/x-pack/plugins/index_management/common/lib/data_stream_serialization.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { DataStream, EnhancedDataStreamFromEs, Health } from '../types';
+import { DataStream, EnhancedDataStreamFromEs, Health, DataRetention } from '../types';
 
 export function deserializeDataStream(dataStreamFromEs: EnhancedDataStreamFromEs): DataStream {
   const {
@@ -83,3 +83,43 @@ export const splitSizeAndUnits = (field: string): { size: string; unit: string }
     unit,
   };
 };
+
+export const serializeAsESLifecycle = (lifecycle?: DataRetention): DataStream['lifecycle'] => {
+  if (!lifecycle || !lifecycle?.enabled) {
+    return undefined;
+  }
+
+  const { infiniteDataRetention, value, unit } = lifecycle;
+
+  if (infiniteDataRetention) {
+    return {
+      enabled: true,
+    };
+  }
+
+  return {
+    enabled: true,
+    data_retention: `${value}${unit}`,
+  };
+};
+
+export const deserializeESLifecycle = (lifecycle?: DataStream['lifecycle']): DataRetention => {
+  if (!lifecycle || !lifecycle?.enabled) {
+    return { enabled: false };
+  }
+
+  if (!lifecycle.data_retention) {
+    return {
+      enabled: true,
+      infiniteDataRetention: true,
+    };
+  }
+
+  const { size, unit } = splitSizeAndUnits(lifecycle.data_retention as string);
+
+  return {
+    enabled: true,
+    value: Number(size),
+    unit,
+  };
+};
diff --git a/x-pack/plugins/index_management/common/lib/template_serialization.ts b/x-pack/plugins/index_management/common/lib/template_serialization.ts
index 7c75ec3c56f972..bb871b1556d300 100644
--- a/x-pack/plugins/index_management/common/lib/template_serialization.ts
+++ b/x-pack/plugins/index_management/common/lib/template_serialization.ts
@@ -12,6 +12,7 @@ import {
   TemplateListItem,
   TemplateType,
 } from '../types';
+import { deserializeESLifecycle } from './data_stream_serialization';
 
 const hasEntries = (data: object = {}) => Object.entries(data).length > 0;
 
@@ -69,6 +70,7 @@ export function deserializeTemplate(
     name,
     version,
     priority,
+    ...(template.lifecycle ? { lifecycle: deserializeESLifecycle(template.lifecycle) } : {}),
     indexPatterns: indexPatterns.sort(),
     template,
     ilmPolicy: settings?.index?.lifecycle,
diff --git a/x-pack/plugins/index_management/common/types/component_templates.ts b/x-pack/plugins/index_management/common/types/component_templates.ts
index d2842b04863039..68c58aefc9d069 100644
--- a/x-pack/plugins/index_management/common/types/component_templates.ts
+++ b/x-pack/plugins/index_management/common/types/component_templates.ts
@@ -8,15 +8,18 @@
 import { IndexSettings } from './indices';
 import { Aliases } from './aliases';
 import { Mappings } from './mappings';
+import { DataStream, DataRetention } from '.';
 
 export interface ComponentTemplateSerialized {
   template: {
     settings?: IndexSettings;
     aliases?: Aliases;
     mappings?: Mappings;
+    lifecycle?: DataStream['lifecycle'];
   };
   version?: number;
   _meta?: { [key: string]: any };
+  lifecycle?: DataRetention;
 }
 
 export interface ComponentTemplateDeserialized extends ComponentTemplateSerialized {
diff --git a/x-pack/plugins/index_management/common/types/data_streams.ts b/x-pack/plugins/index_management/common/types/data_streams.ts
index 80a4be29ee9240..f3890dd032a5ae 100644
--- a/x-pack/plugins/index_management/common/types/data_streams.ts
+++ b/x-pack/plugins/index_management/common/types/data_streams.ts
@@ -75,3 +75,10 @@ export interface DataStreamIndex {
   preferILM: boolean;
   managedBy: string;
 }
+
+export interface DataRetention {
+  enabled: boolean;
+  infiniteDataRetention?: boolean;
+  value?: number;
+  unit?: string;
+}
diff --git a/x-pack/plugins/index_management/common/types/index.ts b/x-pack/plugins/index_management/common/types/index.ts
index f3f2315cdd15be..ef2e8a389c079f 100644
--- a/x-pack/plugins/index_management/common/types/index.ts
+++ b/x-pack/plugins/index_management/common/types/index.ts
@@ -13,7 +13,13 @@ export * from './mappings';
 
 export * from './templates';
 
-export type { EnhancedDataStreamFromEs, Health, DataStream, DataStreamIndex } from './data_streams';
+export type {
+  EnhancedDataStreamFromEs,
+  Health,
+  DataStream,
+  DataStreamIndex,
+  DataRetention,
+} from './data_streams';
 
 export * from './component_templates';
 
diff --git a/x-pack/plugins/index_management/common/types/templates.ts b/x-pack/plugins/index_management/common/types/templates.ts
index 53e120c88c96ff..7d85bb4d20ae07 100644
--- a/x-pack/plugins/index_management/common/types/templates.ts
+++ b/x-pack/plugins/index_management/common/types/templates.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { DataRetention, DataStream } from './data_streams';
 import { IndexSettings } from './indices';
 import { Aliases } from './aliases';
 import { Mappings } from './mappings';
@@ -18,6 +19,7 @@ export interface TemplateSerialized {
     settings?: IndexSettings;
     aliases?: Aliases;
     mappings?: Mappings;
+    lifecycle?: DataStream['lifecycle'];
   };
   composed_of?: string[];
   version?: number;
@@ -40,6 +42,7 @@ export interface TemplateDeserialized {
     aliases?: Aliases;
     mappings?: Mappings;
   };
+  lifecycle?: DataRetention;
   composedOf?: string[]; // Composable template only
   version?: number;
   priority?: number; // Composable template only
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_create.test.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_create.test.tsx
index a8ef1278f4d730..eaf9c8389ae958 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_create.test.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_create.test.tsx
@@ -12,6 +12,7 @@ import { breadcrumbService, IndexManagementBreadcrumb } from '../../../../servic
 import { setupEnvironment } from './helpers';
 import { API_BASE_PATH } from './helpers/constants';
 import { setup, ComponentTemplateCreateTestBed } from './helpers/component_template_create.helpers';
+import { serializeAsESLifecycle } from '../../../../../../common/lib/data_stream_serialization';
 
 jest.mock('@kbn/kibana-react-plugin/public', () => {
   const original = jest.requireActual('@kbn/kibana-react-plugin/public');
@@ -98,6 +99,19 @@ describe('<ComponentTemplateCreate />', () => {
         expect(exists('metaEditor')).toBe(true);
       });
 
+      test('should toggle the data retention field', async () => {
+        const { exists, component, form } = testBed;
+
+        expect(exists('valueDataRetentionField')).toBe(false);
+
+        await act(async () => {
+          form.toggleEuiSwitch('dataRetentionToggle.input');
+        });
+        component.update();
+
+        expect(exists('valueDataRetentionField')).toBe(true);
+      });
+
       describe('Validation', () => {
         test('should require a name', async () => {
           const { form, actions, component, find } = testBed;
@@ -120,6 +134,11 @@ describe('<ComponentTemplateCreate />', () => {
       const COMPONENT_TEMPLATE_NAME = 'comp-1';
       const SETTINGS = { number_of_shards: 1 };
       const ALIASES = { my_alias: {} };
+      const LIFECYCLE = {
+        enabled: true,
+        value: 2,
+        unit: 'd',
+      };
 
       const BOOLEAN_MAPPING_FIELD = {
         name: 'boolean_datatype',
@@ -136,7 +155,10 @@ describe('<ComponentTemplateCreate />', () => {
         component.update();
 
         // Complete step 1 (logistics)
-        await actions.completeStepLogistics({ name: COMPONENT_TEMPLATE_NAME });
+        await actions.completeStepLogistics({
+          name: COMPONENT_TEMPLATE_NAME,
+          lifecycle: LIFECYCLE,
+        });
 
         // Complete step 2 (index settings)
         await actions.completeStepSettings(SETTINGS);
@@ -199,6 +221,7 @@ describe('<ComponentTemplateCreate />', () => {
                   },
                 },
                 aliases: ALIASES,
+                lifecycle: serializeAsESLifecycle(LIFECYCLE),
               },
               _kbnMeta: { usedBy: [], isManaged: false },
             }),
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
index 95495af1272c33..501d14042def37 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/component_template_details.test.ts
@@ -19,6 +19,7 @@ const COMPONENT_TEMPLATE: ComponentTemplateDeserialized = {
     mappings: { properties: { ip_address: { type: 'ip' } } },
     aliases: { mydata: {} },
     settings: { number_of_shards: 1 },
+    lifecycle: { enabled: true, data_retention: '4d' },
   },
   version: 1,
   _meta: { description: 'component template test' },
@@ -72,6 +73,7 @@ describe('<ComponentTemplateDetails />', () => {
       expect(exists('summaryTabContent.usedByTitle')).toBe(true);
       expect(exists('summaryTabContent.versionTitle')).toBe(true);
       expect(exists('summaryTabContent.metaTitle')).toBe(true);
+      expect(exists('summaryTabContent.dataRetentionTitle')).toBe(true);
 
       // [Settings tab] Navigate to tab and verify content
       act(() => {
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_details.helpers.ts b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_details.helpers.ts
index e2f41bbe246f2f..44a78e0d0666f6 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_details.helpers.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_details.helpers.ts
@@ -78,6 +78,7 @@ export type ComponentTemplateDetailsTestSubjects =
   | 'summaryTabContent.usedByTitle'
   | 'summaryTabContent.versionTitle'
   | 'summaryTabContent.metaTitle'
+  | 'summaryTabContent.dataRetentionTitle'
   | 'notInUseCallout'
   | 'aliasesTabContent'
   | 'noAliasesCallout'
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_form.helpers.ts b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_form.helpers.ts
index 0db29dffff5107..d809bb230ffaac 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_form.helpers.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/__jest__/client_integration/helpers/component_template_form.helpers.ts
@@ -8,6 +8,7 @@
 import { act } from 'react-dom/test-utils';
 
 import { TestBed } from '@kbn/test-jest-helpers';
+import { DataRetention } from '../../../../../../../common';
 
 interface MappingField {
   name: string;
@@ -52,11 +53,28 @@ export const getFormActions = (testBed: TestBed) => {
       .simulate('click');
   };
 
-  const completeStepLogistics = async ({ name }: { name: string }) => {
+  const completeStepLogistics = async ({
+    name,
+    lifecycle,
+  }: {
+    name: string;
+    lifecycle: DataRetention;
+  }) => {
     const { form, component } = testBed;
     // Add name field
     form.setInputValue('nameField.input', name);
 
+    if (lifecycle && lifecycle.enabled) {
+      act(() => {
+        form.toggleEuiSwitch('dataRetentionToggle.input');
+      });
+      component.update();
+
+      act(() => {
+        form.setInputValue('valueDataRetentionField', String(lifecycle.value));
+      });
+    }
+
     await act(async () => {
       clickNextButton();
     });
@@ -164,6 +182,8 @@ export type ComponentTemplateFormTestSubjects =
   | 'stepReview.content'
   | 'stepReview.summaryTab'
   | 'stepReview.requestTab'
+  | 'valueDataRetentionField'
+  | 'dataRetentionToggle.input'
   | 'versionField'
   | 'aliasesEditor'
   | 'mappingsEditor'
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/tab_summary.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/tab_summary.tsx
index 3e9f0c38f2a523..cebd88cf759652 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/tab_summary.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/tab_summary.tsx
@@ -19,6 +19,7 @@ import {
   EuiLink,
 } from '@elastic/eui';
 
+import { getLifecycleValue } from '../../../lib/data_streams';
 import { ComponentTemplateDeserialized } from '../shared_imports';
 import { useComponentTemplatesContext } from '../component_templates_context';
 
@@ -27,13 +28,15 @@ interface Props {
   showCallToAction?: boolean;
 }
 
+const INFINITE_AS_ICON = true;
+
 export const TabSummary: React.FunctionComponent<Props> = ({
   componentTemplateDetails,
   showCallToAction,
 }) => {
   const { getUrlForApp } = useComponentTemplatesContext();
 
-  const { version, _meta, _kbnMeta } = componentTemplateDetails;
+  const { version, _meta, _kbnMeta, template } = componentTemplateDetails;
 
   const { usedBy } = _kbnMeta;
   const templateIsInUse = usedBy.length > 0;
@@ -118,6 +121,20 @@ export const TabSummary: React.FunctionComponent<Props> = ({
           </>
         )}
 
+        {template.lifecycle && (
+          <>
+            <EuiDescriptionListTitle data-test-subj="dataRetentionTitle">
+              <FormattedMessage
+                id="xpack.idxMgmt.componentTemplateDetails.summaryTab.dataRetentionDescriptionListTitle"
+                defaultMessage="Data retention"
+              />
+            </EuiDescriptionListTitle>
+            <EuiDescriptionListDescription>
+              {getLifecycleValue(template.lifecycle, INFINITE_AS_ICON)}
+            </EuiDescriptionListDescription>
+          </>
+        )}
+
         {/* Version (optional) */}
         {typeof version !== 'undefined' && (
           <>
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/component_template_form.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/component_template_form.tsx
index 6ec857e9c2c30e..38814ece0c17cf 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/component_template_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/component_template_form.tsx
@@ -19,6 +19,10 @@ import {
   StepMappingsContainer,
   StepAliasesContainer,
 } from '../../shared_imports';
+import {
+  serializeAsESLifecycle,
+  deserializeESLifecycle,
+} from '../../../../../../common/lib/data_stream_serialization';
 import { useComponentTemplatesContext } from '../../component_templates_context';
 import { StepLogisticsContainer, StepReviewContainer } from './steps';
 
@@ -96,14 +100,17 @@ export const ComponentTemplateForm = ({
   onStepChange,
 }: Props) => {
   const {
-    template: { settings, mappings, aliases },
+    template: { settings, mappings, aliases, lifecycle },
     ...logistics
   } = defaultValue;
 
   const { documentation } = useComponentTemplatesContext();
 
   const wizardDefaultValue: WizardContent = {
-    logistics,
+    logistics: {
+      ...logistics,
+      ...(lifecycle ? { lifecycle: deserializeESLifecycle(lifecycle) } : {}),
+    },
     settings,
     mappings,
     aliases,
@@ -162,6 +169,10 @@ export const ComponentTemplateForm = ({
       delete outputTemplate.template.aliases;
     }
 
+    if (outputTemplate.lifecycle) {
+      delete outputTemplate.lifecycle;
+    }
+
     return outputTemplate;
   };
 
@@ -177,9 +188,14 @@ export const ComponentTemplateForm = ({
             settings: wizardData.settings,
             mappings: wizardData.mappings,
             aliases: wizardData.aliases,
+            lifecycle: wizardData.logistics.lifecycle
+              ? serializeAsESLifecycle(wizardData.logistics.lifecycle)
+              : undefined,
           },
         };
-        return cleanupComponentTemplateObject(outputComponentTemplate);
+        return cleanupComponentTemplateObject(
+          outputComponentTemplate as ComponentTemplateDeserialized
+        );
       },
     []
   );
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
index 745f2839c5f690..f892e650c1e1bb 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
@@ -24,8 +24,12 @@ import {
   getFormRow,
   Field,
   Forms,
+  NumericField,
   JsonEditorField,
+  useFormData,
 } from '../../../shared_imports';
+import { DataRetention } from '../../../../../../../common';
+import { UnitField, timeUnits } from '../../../../shared';
 import { useComponentTemplatesContext } from '../../../component_templates_context';
 import { logisticsFormSchema } from './step_logistics_schema';
 
@@ -48,6 +52,13 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
 
     const { isValid: isFormValid, submit, getFormData, subscribe } = form;
 
+    const [{ lifecycle }] = useFormData<{
+      lifecycle: DataRetention;
+    }>({
+      form,
+      watch: ['lifecycle.enabled', 'lifecycle.infiniteDataRetention'],
+    });
+
     const { documentation } = useComponentTemplatesContext();
 
     const [isMetaVisible, setIsMetaVisible] = useState<boolean>(
@@ -134,6 +145,64 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
           />
         </FormRow>
 
+        {/* Data retention field */}
+        <FormRow
+          title={
+            <FormattedMessage
+              id="xpack.idxMgmt.componentTemplateForm.stepLogistics.dataRetentionTitle"
+              defaultMessage="Data retention"
+            />
+          }
+          description={
+            <>
+              <FormattedMessage
+                id="xpack.idxMgmt.componentTemplateForm.stepLogistics.dataRetentionDescription"
+                defaultMessage="Data will be kept at least this long before being automatically deleted."
+              />
+              <EuiSpacer size="m" />
+              <UseField
+                path="lifecycle.enabled"
+                componentProps={{ 'data-test-subj': 'dataRetentionToggle' }}
+              />
+            </>
+          }
+        >
+          {lifecycle?.enabled && (
+            <UseField
+              path="lifecycle.value"
+              component={NumericField}
+              labelAppend={
+                <UseField
+                  path="lifecycle.infiniteDataRetention"
+                  data-test-subj="infiniteDataRetentionToggle"
+                  componentProps={{
+                    euiFieldProps: {
+                      compressed: true,
+                    },
+                  }}
+                />
+              }
+              componentProps={{
+                euiFieldProps: {
+                  disabled: lifecycle?.infiniteDataRetention,
+                  'data-test-subj': 'valueDataRetentionField',
+                  min: 1,
+                  append: (
+                    <UnitField
+                      path="lifecycle.unit"
+                      options={timeUnits}
+                      disabled={lifecycle?.infiniteDataRetention}
+                      euiFieldProps={{
+                        'data-test-subj': 'unitDataRetentionField',
+                      }}
+                    />
+                  ),
+                },
+              }}
+            />
+          )}
+        </FormRow>
+
         {/* version field */}
         <FormRow
           title={
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics_schema.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics_schema.tsx
index 1ce0af1b511d7d..9bf11bcc8d11a9 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics_schema.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics_schema.tsx
@@ -58,6 +58,89 @@ export const logisticsFormSchema: FormSchema = {
       },
     ],
   },
+  'lifecycle.enabled': {
+    type: FIELD_TYPES.TOGGLE,
+    label: i18n.translate(
+      'xpack.idxMgmt.componentTemplateForm.stepLogistics.enableDataRetentionLabel',
+      {
+        defaultMessage: 'Enable data retention',
+      }
+    ),
+    defaultValue: false,
+  },
+  'lifecycle.infiniteDataRetention': {
+    type: FIELD_TYPES.TOGGLE,
+    label: i18n.translate(
+      'xpack.idxMgmt.componentTemplateForm.stepLogistics.infiniteDataRetentionLabel',
+      {
+        defaultMessage: 'Keep data indefinitely',
+      }
+    ),
+    defaultValue: false,
+  },
+  'lifecycle.value': {
+    type: FIELD_TYPES.TEXT,
+    label: i18n.translate(
+      'xpack.idxMgmt.componentTemplateForm.stepLogistics.fieldDataRetentionValueLabel',
+      {
+        defaultMessage: 'Data Retention',
+      }
+    ),
+    formatters: [toInt],
+    validations: [
+      {
+        validator: ({ value, formData }) => {
+          // If infiniteRetentionPeriod is set, we dont need to validate the data retention field
+          if (formData['lifecycle.infiniteDataRetention']) {
+            return undefined;
+          }
+
+          if (!value) {
+            return {
+              message: i18n.translate(
+                'xpack.idxMgmt.dataStreamsDetailsPanel.stepLogistics.dataRetentionFieldRequiredError',
+                {
+                  defaultMessage: 'A data retention value is required.',
+                }
+              ),
+            };
+          }
+
+          if (value <= 0) {
+            return {
+              message: i18n.translate(
+                'xpack.idxMgmt.dataStreamsDetailsPanel.stepLogistics.dataRetentionFieldNonNegativeError',
+                {
+                  defaultMessage: `A positive value is required.`,
+                }
+              ),
+            };
+          }
+
+          if (value % 1 !== 0) {
+            return {
+              message: i18n.translate(
+                'xpack.idxMgmt.dataStreamsDetailsPanel.stepLogistics.dataRetentionFieldDecimalError',
+                {
+                  defaultMessage: `The value should be an integer number.`,
+                }
+              ),
+            };
+          }
+        },
+      },
+    ],
+  },
+  'lifecycle.unit': {
+    type: FIELD_TYPES.TEXT,
+    label: i18n.translate(
+      'xpack.idxMgmt.componentTemplateForm.stepLogistics.fieldDataRetentionUnitLabel',
+      {
+        defaultMessage: 'Time unit',
+      }
+    ),
+    defaultValue: 'd',
+  },
   version: {
     type: FIELD_TYPES.NUMBER,
     label: i18n.translate('xpack.idxMgmt.componentTemplateForm.stepLogistics.versionFieldLabel', {
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_review.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_review.tsx
index 159f25ab010b7d..72746d426d2e10 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_review.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_review.tsx
@@ -28,7 +28,9 @@ import {
   serializeComponentTemplate,
 } from '../../../shared_imports';
 import { MANAGED_BY_FLEET } from '../../../constants';
+import { getLifecycleValue } from '../../../../../lib/data_streams';
 
+const INFINITE_AS_ICON = true;
 const { stripEmptyFields } = serializers;
 
 const getDescriptionText = (data: any) => {
@@ -123,6 +125,17 @@ export const StepReview: React.FunctionComponent<Props> = React.memo(
               <EuiDescriptionListDescription>
                 {getDescriptionText(serializedTemplate?.aliases)}
               </EuiDescriptionListDescription>
+
+              {/* Data retention */}
+              <EuiDescriptionListTitle>
+                <FormattedMessage
+                  id="xpack.idxMgmt.componentTemplateForm.stepReview.summaryTab.dataRetentionLabel"
+                  defaultMessage="Data retention"
+                />
+              </EuiDescriptionListTitle>
+              <EuiDescriptionListDescription>
+                {getLifecycleValue(serializedTemplate?.lifecycle, INFINITE_AS_ICON)}
+              </EuiDescriptionListDescription>
             </EuiDescriptionList>
           </EuiFlexItem>
           {isFleetDatastreamsVisible && dataStreams && (
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts b/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
index 78dd0395b6e341..d70ed32e2cdf82 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
@@ -41,12 +41,14 @@ export {
   useForm,
   Form,
   getUseField,
+  useFormData,
 } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
 
 export {
   getFormRow,
   Field,
   JsonEditorField,
+  NumericField,
 } from '@kbn/es-ui-shared-plugin/static/forms/components';
 
 export { isJSON } from '@kbn/es-ui-shared-plugin/static/validators/string';
diff --git a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/unit_field.tsx b/x-pack/plugins/index_management/public/application/components/shared/fields/unit_field.tsx
similarity index 97%
rename from x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/unit_field.tsx
rename to x-pack/plugins/index_management/public/application/components/shared/fields/unit_field.tsx
index fc12b2ce9edafc..8a01118a5f0957 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/unit_field.tsx
+++ b/x-pack/plugins/index_management/public/application/components/shared/fields/unit_field.tsx
@@ -7,7 +7,7 @@
 
 import React, { FunctionComponent, useState } from 'react';
 import { EuiFilterSelectItem, EuiPopover, EuiButtonEmpty } from '@elastic/eui';
-import { UseField } from '../../../../../shared_imports';
+import { UseField } from '../../../../shared_imports';
 
 interface Props {
   path: string;
diff --git a/x-pack/plugins/index_management/public/application/components/shared/index.ts b/x-pack/plugins/index_management/public/application/components/shared/index.ts
index 06899e202ef82a..66681ab20c1778 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/shared/index.ts
@@ -6,6 +6,7 @@
  */
 
 export type { CommonWizardSteps } from './components';
+
 export {
   TabAliases,
   TabMappings,
@@ -15,3 +16,6 @@ export {
   StepSettingsContainer,
   TemplateContentIndicator,
 } from './components';
+
+export { UnitField } from './fields/unit_field';
+export { timeUnits } from '../../constants/time_units';
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
index 6dd062ba426745..5307852d3c9e32 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_logistics.tsx
@@ -26,7 +26,10 @@ import {
   Field,
   Forms,
   JsonEditorField,
+  NumericField,
 } from '../../../../shared_imports';
+import { UnitField, timeUnits } from '../../shared';
+import { DataRetention } from '../../../../../common';
 import { documentationService } from '../../../services/documentation';
 import { schemas, nameConfig, nameConfigWithoutValidations } from '../template_form_schemas';
 
@@ -112,6 +115,19 @@ function getFieldsMeta(esDocsBase: string) {
       }),
       testSubject: 'versionField',
     },
+    dataRetention: {
+      title: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.dataRetentionTitle', {
+        defaultMessage: 'Data retention',
+      }),
+      description: i18n.translate(
+        'xpack.idxMgmt.templateForm.stepLogistics.dataRetentionDescription',
+        {
+          defaultMessage:
+            'Data will be kept at least this long before being automatically deleted.',
+        }
+      ),
+      unitTestSubject: 'unitDataRetentionField',
+    },
     allowAutoCreate: {
       title: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.allowAutoCreateTitle', {
         defaultMessage: 'Allow auto create',
@@ -177,9 +193,18 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
       getFormData,
     } = form;
 
-    const [{ addMeta }] = useFormData<{ addMeta: boolean }>({
+    const [{ addMeta, doCreateDataStream, lifecycle }] = useFormData<{
+      addMeta: boolean;
+      lifecycle: DataRetention;
+      doCreateDataStream: boolean;
+    }>({
       form,
-      watch: 'addMeta',
+      watch: [
+        'addMeta',
+        'lifecycle.enabled',
+        'lifecycle.infiniteDataRetention',
+        'doCreateDataStream',
+      ],
     });
 
     /**
@@ -198,8 +223,16 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
       });
     }, [onChange, isFormValid, validate, getFormData]);
 
-    const { name, indexPatterns, createDataStream, order, priority, version, allowAutoCreate } =
-      getFieldsMeta(documentationService.getEsDocsBase());
+    const {
+      name,
+      indexPatterns,
+      createDataStream,
+      order,
+      priority,
+      version,
+      dataRetention,
+      allowAutoCreate,
+    } = getFieldsMeta(documentationService.getEsDocsBase());
 
     return (
       <>
@@ -272,6 +305,61 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
             </FormRow>
           )}
 
+          {/*
+            Since data stream and data retention are settings that are only allowed for non legacy,
+            we only need to check if data stream is set to true to show the data retention.
+          */}
+          {doCreateDataStream && (
+            <FormRow
+              title={dataRetention.title}
+              description={
+                <>
+                  {dataRetention.description}
+                  <EuiSpacer size="m" />
+                  <UseField
+                    path="lifecycle.enabled"
+                    componentProps={{ 'data-test-subj': 'dataRetentionToggle' }}
+                  />
+                </>
+              }
+            >
+              {lifecycle?.enabled && (
+                <UseField
+                  path="lifecycle.value"
+                  component={NumericField}
+                  labelAppend={
+                    <UseField
+                      path="lifecycle.infiniteDataRetention"
+                      data-test-subj="infiniteDataRetentionToggle"
+                      componentProps={{
+                        euiFieldProps: {
+                          compressed: true,
+                        },
+                      }}
+                    />
+                  }
+                  componentProps={{
+                    euiFieldProps: {
+                      disabled: lifecycle?.infiniteDataRetention,
+                      'data-test-subj': 'valueDataRetentionField',
+                      min: 1,
+                      append: (
+                        <UnitField
+                          path="lifecycle.unit"
+                          options={timeUnits}
+                          disabled={lifecycle?.infiniteDataRetention}
+                          euiFieldProps={{
+                            'data-test-subj': 'unitDataRetentionField',
+                          }}
+                        />
+                      ),
+                    },
+                  }}
+                />
+              )}
+            </FormRow>
+          )}
+
           {/* Order */}
           {isLegacy && (
             <FormRow title={order.title} description={order.description}>
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_review.tsx b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_review.tsx
index 3ecea64a73e4dc..7d01966d207e97 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/steps/step_review.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/steps/step_review.tsx
@@ -27,9 +27,11 @@ import { serializers } from '../../../../shared_imports';
 import { serializeLegacyTemplate, serializeTemplate } from '../../../../../common/lib';
 import { TemplateDeserialized, getTemplateParameter, Aliases } from '../../../../../common';
 import { SimulateTemplate } from '../../index_templates';
+import { getLifecycleValue } from '../../../lib/data_streams';
 import { WizardSection } from '../template_form';
 
 const { stripEmptyFields } = serializers;
+const INFINITE_AS_ICON = true;
 
 const NoneDescriptionText = () => (
   <FormattedMessage
@@ -87,6 +89,7 @@ export const StepReview: React.FunctionComponent<Props> = React.memo(
       indexPatterns,
       version,
       order,
+      template: indexTemplate,
       priority,
       allowAutoCreate,
       composedOf,
@@ -109,6 +112,7 @@ export const StepReview: React.FunctionComponent<Props> = React.memo(
     const serializedMappings = getTemplateParameter(serializedTemplate, 'mappings');
     const serializedSettings = getTemplateParameter(serializedTemplate, 'settings');
     const serializedAliases = getTemplateParameter(serializedTemplate, 'aliases');
+    const serializedLifecycle = (indexTemplate as TemplateDeserialized)?.lifecycle;
 
     const numIndexPatterns = indexPatterns!.length;
 
@@ -274,6 +278,20 @@ export const StepReview: React.FunctionComponent<Props> = React.memo(
                 {getDescriptionText(serializedAliases)}
               </EuiDescriptionListDescription>
 
+              {isLegacy !== true && serializedLifecycle?.enabled && (
+                <>
+                  <EuiDescriptionListTitle data-test-subj="lifecycleTitle">
+                    <FormattedMessage
+                      id="xpack.idxMgmt.templateForm.stepReview.summaryTab.lifecycleLabel"
+                      defaultMessage="Data retention"
+                    />
+                  </EuiDescriptionListTitle>
+                  <EuiDescriptionListDescription data-test-subj="lifecycleValue">
+                    {getLifecycleValue(serializedLifecycle, INFINITE_AS_ICON)}
+                  </EuiDescriptionListDescription>
+                </>
+              )}
+
               {/* Metadata (optional) */}
               {isLegacy !== true && _meta && (
                 <>
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx b/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
index 13797f1dfc05bb..9d494e0a558d92 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/template_form.tsx
@@ -21,6 +21,7 @@ import {
 } from '../shared';
 import { documentationService } from '../../services/documentation';
 import { SectionError } from '../section_error';
+import { serializeAsESLifecycle } from '../../../../common/lib/data_stream_serialization';
 import {
   SimulateTemplateFlyoutContent,
   SimulateTemplateProps,
@@ -190,6 +191,9 @@ export const TemplateForm = ({
       if (Object.keys(outputTemplate.template).length === 0) {
         delete outputTemplate.template;
       }
+      if (outputTemplate.lifecycle) {
+        delete outputTemplate.lifecycle;
+      }
     }
 
     return outputTemplate;
@@ -206,10 +210,13 @@ export const TemplateForm = ({
             settings: wizardData.settings,
             mappings: wizardData.mappings,
             aliases: wizardData.aliases,
+            lifecycle: wizardData.logistics.lifecycle
+              ? serializeAsESLifecycle(wizardData.logistics.lifecycle)
+              : undefined,
           },
         };
 
-        return cleanupTemplateObject(outputTemplate);
+        return cleanupTemplateObject(outputTemplate as TemplateDeserialized);
       },
     []
   );
diff --git a/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx b/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
index 454a0ca4b5b0ae..383b60c3650866 100644
--- a/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
+++ b/x-pack/plugins/index_management/public/application/components/template_form/template_form_schemas.tsx
@@ -158,6 +158,85 @@ export const schemas: Record<string, FormSchema> = {
       }),
       formatters: [toInt],
     },
+
+    'lifecycle.enabled': {
+      type: FIELD_TYPES.TOGGLE,
+      label: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.enableDataRetentionLabel', {
+        defaultMessage: 'Enable data retention',
+      }),
+      defaultValue: false,
+    },
+    'lifecycle.infiniteDataRetention': {
+      type: FIELD_TYPES.TOGGLE,
+      label: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.infiniteDataRetentionLabel', {
+        defaultMessage: 'Keep data indefinitely',
+      }),
+      defaultValue: false,
+    },
+    'lifecycle.value': {
+      type: FIELD_TYPES.TEXT,
+      label: i18n.translate(
+        'xpack.idxMgmt.templateForm.stepLogistics.fieldDataRetentionValueLabel',
+        {
+          defaultMessage: 'Data Retention',
+        }
+      ),
+      formatters: [toInt],
+      validations: [
+        {
+          validator: ({ value, formData }) => {
+            // If infiniteRetentionPeriod is set, we dont need to validate the data retention field
+            if (formData['lifecycle.infiniteDataRetention']) {
+              return undefined;
+            }
+
+            if (!value) {
+              return {
+                message: i18n.translate(
+                  'xpack.idxMgmt.templateForm.stepLogistics.dataRetentionFieldRequiredError',
+                  {
+                    defaultMessage: 'A data retention value is required.',
+                  }
+                ),
+              };
+            }
+
+            if (value <= 0) {
+              return {
+                message: i18n.translate(
+                  'xpack.idxMgmt.templateForm.stepLogistics.dataRetentionFieldNonNegativeError',
+                  {
+                    defaultMessage: `A positive value is required.`,
+                  }
+                ),
+              };
+            }
+
+            if (value % 1 !== 0) {
+              return {
+                message: i18n.translate(
+                  'xpack.idxMgmt.templateForm.stepLogistics.dataRetentionFieldDecimalError',
+                  {
+                    defaultMessage: `The value should be an integer number.`,
+                  }
+                ),
+              };
+            }
+          },
+        },
+      ],
+    },
+    'lifecycle.unit': {
+      type: FIELD_TYPES.TEXT,
+      label: i18n.translate(
+        'xpack.idxMgmt.templateForm.stepLogistics.fieldDataRetentionUnitLabel',
+        {
+          defaultMessage: 'Time unit',
+        }
+      ),
+      defaultValue: 'd',
+    },
+
     allowAutoCreate: {
       type: FIELD_TYPES.TOGGLE,
       label: i18n.translate('xpack.idxMgmt.templateForm.stepLogistics.fieldAllowAutoCreateLabel', {
diff --git a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/edit_data_retention_modal.tsx b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/edit_data_retention_modal.tsx
index a1ac650ba0cb7f..713fdc8a709d53 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/edit_data_retention_modal.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/edit_data_retention_modal/edit_data_retention_modal.tsx
@@ -42,7 +42,7 @@ import { splitSizeAndUnits, DataStream } from '../../../../../../common';
 import { timeUnits } from '../../../../constants/time_units';
 import { isDSLWithILMIndices } from '../../../../lib/data_streams';
 import { useAppContext } from '../../../../app_context';
-import { UnitField } from './unit_field';
+import { UnitField } from '../../../../components/shared';
 import { updateDataRetention } from '../../../../services/api';
 
 interface Props {
diff --git a/x-pack/plugins/index_management/public/application/sections/home/enrich_policies_list/policies_table/policies_table.tsx b/x-pack/plugins/index_management/public/application/sections/home/enrich_policies_list/policies_table/policies_table.tsx
index 87002e6042270d..9f5629696d55f5 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/enrich_policies_list/policies_table/policies_table.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/enrich_policies_list/policies_table/policies_table.tsx
@@ -58,6 +58,7 @@ export const PoliciesTable: FunctionComponent<Props> = ({
         fill
         iconType="plusInCircle"
         {...reactRouterNavigate(history, '/enrich_policies/create')}
+        data-test-subj="enrichPoliciesPoliciesTableCreateButton"
       >
         <FormattedMessage
           id="xpack.idxMgmt.enrichPolicies.table.createPolicyButton"
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_content.tsx b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_content.tsx
index 0360df733c945a..adeadee6132c03 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_content.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_content.tsx
@@ -50,7 +50,7 @@ const defaultTabs: IndexDetailsTab[] = [
     name: (
       <FormattedMessage id="xpack.idxMgmt.indexDetails.mappingsTitle" defaultMessage="Mappings" />
     ),
-    renderTabContent: ({ index }) => <DetailsPageMappings indexName={index.name} />,
+    renderTabContent: ({ index }) => <DetailsPageMappings index={index} />,
     order: 20,
   },
   {
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings.tsx b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings.tsx
index a83eebd395b1e3..c6f74207c92d72 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings.tsx
@@ -6,27 +6,18 @@
  */
 
 import React, { FunctionComponent, useEffect } from 'react';
-import {
-  EuiButton,
-  EuiCodeBlock,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiIcon,
-  EuiLink,
-  EuiPageTemplate,
-  EuiPanel,
-  EuiSpacer,
-  EuiText,
-  EuiTitle,
-} from '@elastic/eui';
-import { css } from '@emotion/react';
+import { EuiButton, EuiPageTemplate, EuiSpacer, EuiText } from '@elastic/eui';
+
 import { FormattedMessage } from '@kbn/i18n-react';
 import { SectionLoading } from '@kbn/es-ui-shared-plugin/public';
-import { useLoadIndexMappings, documentationService } from '../../../../services';
+
+import { DetailsPageMappingsContent } from './details_page_mappings_content';
+import { Index } from '../../../../../../common';
+import { useLoadIndexMappings } from '../../../../services';
 import { breadcrumbService, IndexManagementBreadcrumb } from '../../../../services/breadcrumbs';
 
-export const DetailsPageMappings: FunctionComponent<{ indexName: string }> = ({ indexName }) => {
-  const { isLoading, data, error, resendRequest } = useLoadIndexMappings(indexName);
+export const DetailsPageMappings: FunctionComponent<{ index: Index }> = ({ index }) => {
+  const { isLoading, data, error, resendRequest } = useLoadIndexMappings(index.name);
 
   useEffect(() => {
     breadcrumbService.setBreadcrumbs(IndexManagementBreadcrumb.indexDetailsMappings);
@@ -63,7 +54,7 @@ export const DetailsPageMappings: FunctionComponent<{ indexName: string }> = ({
                 id="xpack.idxMgmt.indexDetails.mappings.errorDescription"
                 defaultMessage="We encountered an error loading mappings for index {indexName}. Make sure that the index name in the URL is correct and try again."
                 values={{
-                  indexName,
+                  indexName: index.name,
                 }}
               />
             </EuiText>
@@ -86,82 +77,5 @@ export const DetailsPageMappings: FunctionComponent<{ indexName: string }> = ({
     );
   }
 
-  return (
-    // using "rowReverse" to keep docs links on the top of the mappings code block on smaller screen
-    <EuiFlexGroup
-      wrap
-      direction="rowReverse"
-      css={css`
-        height: 100%;
-      `}
-    >
-      <EuiFlexItem
-        grow={1}
-        css={css`
-          min-width: 400px;
-        `}
-      >
-        <EuiPanel grow={false} paddingSize="l">
-          <EuiFlexGroup alignItems="center" gutterSize="s">
-            <EuiFlexItem grow={false}>
-              <EuiIcon type="iInCircle" />
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <EuiTitle size="xs">
-                <h2>
-                  <FormattedMessage
-                    id="xpack.idxMgmt.indexDetails.mappings.docsCardTitle"
-                    defaultMessage="About index mappings"
-                  />
-                </h2>
-              </EuiTitle>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-          <EuiSpacer size="s" />
-          <EuiText>
-            <p>
-              <FormattedMessage
-                id="xpack.idxMgmt.indexDetails.mappings.docsCardDescription"
-                defaultMessage="Your documents are made up of a set of fields. Index mappings give each field a type
-              (such as keyword, number, or date) and additional subfields. These index mappings determine the functions
-              available in your relevance tuning and search experience."
-              />
-            </p>
-          </EuiText>
-          <EuiSpacer size="m" />
-          <EuiLink
-            data-test-subj="indexDetailsMappingsDocsLink"
-            href={documentationService.getMappingDocumentationLink()}
-            target="_blank"
-            external
-          >
-            <FormattedMessage
-              id="xpack.idxMgmt.indexDetails.mappings.docsCardLink"
-              defaultMessage="Learn more about mappings"
-            />
-          </EuiLink>
-        </EuiPanel>
-      </EuiFlexItem>
-
-      <EuiFlexItem
-        grow={3}
-        css={css`
-          min-width: 600px;
-        `}
-      >
-        <EuiPanel>
-          <EuiCodeBlock
-            language="json"
-            isCopyable
-            data-test-subj="indexDetailsMappingsCodeBlock"
-            css={css`
-              height: 100%;
-            `}
-          >
-            {JSON.stringify(data, null, 2)}
-          </EuiCodeBlock>
-        </EuiPanel>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
+  return <DetailsPageMappingsContent index={index} data={data} />;
 };
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings_content.tsx b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings_content.tsx
new file mode 100644
index 00000000000000..40544bb18e1ff7
--- /dev/null
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_mappings_content.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FunctionComponent } from 'react';
+import {
+  EuiCodeBlock,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiLink,
+  EuiPanel,
+  EuiSpacer,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { css } from '@emotion/react';
+
+import { Index } from '../../../../../../common';
+import { documentationService } from '../../../../services';
+import { useAppContext } from '../../../../app_context';
+
+export const DetailsPageMappingsContent: FunctionComponent<{ index: Index; data: any }> = ({
+  index,
+  data,
+}) => {
+  const {
+    services: { extensionsService },
+    core: { getUrlForApp },
+  } = useAppContext();
+  return (
+    // using "rowReverse" to keep docs links on the top of the mappings code block on smaller screen
+    <EuiFlexGroup
+      wrap
+      direction="rowReverse"
+      css={css`
+        height: 100%;
+      `}
+    >
+      <EuiFlexItem
+        grow={1}
+        css={css`
+          min-width: 400px;
+        `}
+      >
+        <EuiPanel grow={false} paddingSize="l">
+          <EuiFlexGroup alignItems="center" gutterSize="s">
+            <EuiFlexItem grow={false}>
+              <EuiIcon type="iInCircle" />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiTitle size="xs">
+                <h2>
+                  <FormattedMessage
+                    id="xpack.idxMgmt.indexDetails.mappings.docsCardTitle"
+                    defaultMessage="About index mappings"
+                  />
+                </h2>
+              </EuiTitle>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+          <EuiSpacer size="s" />
+          <EuiText>
+            <p>
+              <FormattedMessage
+                id="xpack.idxMgmt.indexDetails.mappings.docsCardDescription"
+                defaultMessage="Your documents are made up of a set of fields. Index mappings give each field a type
+              (such as keyword, number, or date) and additional subfields. These index mappings determine the functions
+              available in your relevance tuning and search experience."
+              />
+            </p>
+          </EuiText>
+          <EuiSpacer size="m" />
+          <EuiLink
+            data-test-subj="indexDetailsMappingsDocsLink"
+            href={documentationService.getMappingDocumentationLink()}
+            target="_blank"
+            external
+          >
+            <FormattedMessage
+              id="xpack.idxMgmt.indexDetails.mappings.docsCardLink"
+              defaultMessage="Learn more about mappings"
+            />
+          </EuiLink>
+        </EuiPanel>
+        {extensionsService.indexMappingsContent && (
+          <>
+            <EuiSpacer />
+            {extensionsService.indexMappingsContent.renderContent({ index, getUrlForApp })}
+          </>
+        )}
+      </EuiFlexItem>
+
+      <EuiFlexItem
+        grow={3}
+        css={css`
+          min-width: 600px;
+        `}
+      >
+        <EuiPanel>
+          <EuiCodeBlock
+            language="json"
+            isCopyable
+            data-test-subj="indexDetailsMappingsCodeBlock"
+            css={css`
+              height: 100%;
+            `}
+          >
+            {JSON.stringify(data, null, 2)}
+          </EuiCodeBlock>
+        </EuiPanel>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
index 035e647d19b112..d00b8c18617a6d 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
@@ -256,7 +256,6 @@ export const DetailsPageSettingsContent: FunctionComponent<Props> = ({
           </EuiLink>
         </EuiPanel>
       </EuiFlexItem>
-
       <EuiFlexItem
         grow={3}
         css={css`
diff --git a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/tabs/tab_summary.tsx b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/tabs/tab_summary.tsx
index 5e90a97fbcdb07..492c6f426acd53 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/tabs/tab_summary.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/tabs/tab_summary.tsx
@@ -20,6 +20,8 @@ import {
   EuiCodeBlock,
   EuiSpacer,
 } from '@elastic/eui';
+import { serializeAsESLifecycle } from '../../../../../../../common/lib/data_stream_serialization';
+import { getLifecycleValue } from '../../../../../lib/data_streams';
 import { TemplateDeserialized } from '../../../../../../../common';
 import { ILM_PAGES_POLICY_EDIT } from '../../../../../constants';
 import { useIlmLocator } from '../../../../../services/use_ilm_locator';
@@ -28,6 +30,7 @@ interface Props {
   templateDetails: TemplateDeserialized;
 }
 
+const INFINITE_AS_ICON = true;
 const i18nTexts = {
   yes: i18n.translate('xpack.idxMgmt.templateDetails.summaryTab.yesDescriptionText', {
     defaultMessage: 'Yes',
@@ -194,6 +197,24 @@ export const TabSummary: React.FunctionComponent<Props> = ({ templateDetails })
               {version || version === 0 ? version : i18nTexts.none}
             </EuiDescriptionListDescription>
 
+            {/* Data retention */}
+            {hasDatastream && templateDetails?.lifecycle && (
+              <>
+                <EuiDescriptionListTitle>
+                  <FormattedMessage
+                    id="xpack.idxMgmt.templateDetails.summaryTab.lifecycleDescriptionListTitle"
+                    defaultMessage="Data retention"
+                  />
+                </EuiDescriptionListTitle>
+                <EuiDescriptionListDescription>
+                  {getLifecycleValue(
+                    serializeAsESLifecycle(templateDetails.lifecycle),
+                    INFINITE_AS_ICON
+                  )}
+                </EuiDescriptionListDescription>
+              </>
+            )}
+
             {/* Allow auto create */}
             {isLegacy !== true && (
               <>
diff --git a/x-pack/plugins/index_management/public/application/services/routing.ts b/x-pack/plugins/index_management/public/application/services/routing.ts
index 3ec13eca06516e..02e1410e9551c4 100644
--- a/x-pack/plugins/index_management/public/application/services/routing.ts
+++ b/x-pack/plugins/index_management/public/application/services/routing.ts
@@ -34,10 +34,6 @@ export const getTemplateCloneLink = (name: string, isLegacy?: boolean) => {
   return encodeURI(url);
 };
 
-export const getILMPolicyPath = (policyName: string) => {
-  return `/data/index_lifecycle_management/policies/edit/${encodeURIComponent(policyName)}`;
-};
-
 export const getIndexListUri = (filter?: string, includeHiddenIndices?: boolean) => {
   const hiddenIndicesParam =
     typeof includeHiddenIndices !== 'undefined' ? includeHiddenIndices : false;
diff --git a/x-pack/plugins/index_management/public/index.ts b/x-pack/plugins/index_management/public/index.ts
index b8cde1fdf36e78..8fb836ba7ffd9d 100644
--- a/x-pack/plugins/index_management/public/index.ts
+++ b/x-pack/plugins/index_management/public/index.ts
@@ -14,7 +14,7 @@ export const plugin = (ctx: PluginInitializerContext) => {
   return new IndexMgmtUIPlugin(ctx);
 };
 
-export type { IndexManagementPluginSetup } from './types';
+export type { IndexManagementPluginSetup, IndexManagementPluginStart } from './types';
 
 export { getIndexListUri, getTemplateDetailsLink } from './application/services/routing';
 
diff --git a/x-pack/plugins/index_management/public/plugin.ts b/x-pack/plugins/index_management/public/plugin.ts
index 87b4ff5be220ca..f4038a4e2677f6 100644
--- a/x-pack/plugins/index_management/public/plugin.ts
+++ b/x-pack/plugins/index_management/public/plugin.ts
@@ -81,6 +81,10 @@ export class IndexMgmtUIPlugin {
     };
   }
 
-  public start() {}
+  public start() {
+    return {
+      extensionsService: this.extensionsService.setup(),
+    };
+  }
   public stop() {}
 }
diff --git a/x-pack/plugins/index_management/public/services/extensions_service.mock.ts b/x-pack/plugins/index_management/public/services/extensions_service.mock.ts
index 3c0886b0fe4a34..8f4968ad35e410 100644
--- a/x-pack/plugins/index_management/public/services/extensions_service.mock.ts
+++ b/x-pack/plugins/index_management/public/services/extensions_service.mock.ts
@@ -18,6 +18,7 @@ const createServiceMock = (): ExtensionsSetupMock => ({
   addToggle: jest.fn(),
   addIndexDetailsTab: jest.fn(),
   setIndexOverviewContent: jest.fn(),
+  setIndexMappingsContent: jest.fn(),
 });
 
 const createMock = () => {
diff --git a/x-pack/plugins/index_management/public/services/extensions_service.ts b/x-pack/plugins/index_management/public/services/extensions_service.ts
index 94211b32dbd703..1eb68e9a0b7465 100644
--- a/x-pack/plugins/index_management/public/services/extensions_service.ts
+++ b/x-pack/plugins/index_management/public/services/extensions_service.ts
@@ -12,7 +12,7 @@ import { EuiBadgeProps } from '@elastic/eui';
 import type { IndexDetailsTab } from '../../common/constants';
 import { Index } from '..';
 
-export interface IndexOverviewContent {
+export interface IndexContent {
   renderContent: (args: {
     index: Index;
     getUrlForApp: ApplicationStart['getUrlForApp'];
@@ -28,13 +28,22 @@ export interface IndexBadge {
 }
 
 export interface ExtensionsSetup {
+  // adds an option to the "manage index" menu
   addAction(action: any): void;
+  // adds a banner to the indices list
   addBanner(banner: any): void;
+  // adds a filter to the indices list
   addFilter(filter: any): void;
+  // adds a badge to the index name
   addBadge(badge: IndexBadge): void;
+  // adds a toggle to the indices list
   addToggle(toggle: any): void;
+  // adds a tab to the index details page
   addIndexDetailsTab(tab: IndexDetailsTab): void;
-  setIndexOverviewContent(content: IndexOverviewContent): void;
+  // sets content to render instead of the code block on the overview tab of the index page
+  setIndexOverviewContent(content: IndexContent): void;
+  // sets content to render below the docs link on the mappings tab of the index page
+  setIndexMappingsContent(content: IndexContent): void;
 }
 
 export class ExtensionsService {
@@ -55,7 +64,8 @@ export class ExtensionsService {
   ];
   private _toggles: any[] = [];
   private _indexDetailsTabs: IndexDetailsTab[] = [];
-  private _indexOverviewContent: IndexOverviewContent | null = null;
+  private _indexOverviewContent: IndexContent | null = null;
+  private _indexMappingsContent: IndexContent | null = null;
   private service?: ExtensionsSetup;
 
   public setup(): ExtensionsSetup {
@@ -66,7 +76,8 @@ export class ExtensionsService {
       addFilter: this.addFilter.bind(this),
       addToggle: this.addToggle.bind(this),
       addIndexDetailsTab: this.addIndexDetailsTab.bind(this),
-      setIndexOverviewContent: this.setIndexOverviewMainContent.bind(this),
+      setIndexOverviewContent: this.setIndexOverviewContent.bind(this),
+      setIndexMappingsContent: this.setIndexMappingsContent.bind(this),
     };
 
     return this.service;
@@ -96,7 +107,7 @@ export class ExtensionsService {
     this._indexDetailsTabs.push(tab);
   }
 
-  private setIndexOverviewMainContent(content: IndexOverviewContent) {
+  private setIndexOverviewContent(content: IndexContent) {
     if (this._indexOverviewContent) {
       throw new Error(`The content for index overview has already been set.`);
     } else {
@@ -104,6 +115,14 @@ export class ExtensionsService {
     }
   }
 
+  private setIndexMappingsContent(content: IndexContent) {
+    if (this._indexMappingsContent) {
+      throw new Error(`The content for index mappings has already been set.`);
+    } else {
+      this._indexMappingsContent = content;
+    }
+  }
+
   public get actions() {
     return this._actions;
   }
@@ -131,4 +150,8 @@ export class ExtensionsService {
   public get indexOverviewContent() {
     return this._indexOverviewContent;
   }
+
+  public get indexMappingsContent() {
+    return this._indexMappingsContent;
+  }
 }
diff --git a/x-pack/plugins/index_management/public/services/index.ts b/x-pack/plugins/index_management/public/services/index.ts
index 8f4ddbeffba352..bca35e09c9776b 100644
--- a/x-pack/plugins/index_management/public/services/index.ts
+++ b/x-pack/plugins/index_management/public/services/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export type { ExtensionsSetup } from './extensions_service';
+export type { ExtensionsSetup, IndexContent } from './extensions_service';
 export { ExtensionsService } from './extensions_service';
 
 export type { PublicApiServiceSetup } from './public_api_service';
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 57ddf10c767fdd..d00e6ba4d5ac7c 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -16,6 +16,10 @@ export interface IndexManagementPluginSetup {
   extensionsService: ExtensionsSetup;
 }
 
+export interface IndexManagementPluginStart {
+  extensionsService: ExtensionsSetup;
+}
+
 export interface SetupDependencies {
   fleet?: unknown;
   usageCollection: UsageCollectionSetup;
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index ab6b0741274ffc..127599066ab666 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -7,11 +7,12 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { IndexMgmtServerPlugin } from './plugin';
-
 export { config } from './config';
 
-export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { IndexMgmtServerPlugin } = await import('./plugin');
+  return new IndexMgmtServerPlugin(context);
+};
 
 /** @public */
 export type { Dependencies } from './types';
diff --git a/x-pack/plugins/index_management/server/lib/enrich_policies.ts b/x-pack/plugins/index_management/server/lib/enrich_policies.ts
index f31cda9e5f9633..db25603817e641 100644
--- a/x-pack/plugins/index_management/server/lib/enrich_policies.ts
+++ b/x-pack/plugins/index_management/server/lib/enrich_policies.ts
@@ -45,7 +45,12 @@ const create = (
 };
 
 const execute = (client: IScopedClusterClient, policyName: string) => {
-  return client.asCurrentUser.enrich.executePolicy({ name: policyName });
+  // Enrich policy executions can last as short as a few seconds to as long as half and hour or longer.
+  // In order to prevent the enrich policies UI from timing out, we are disabling `waitForCompletion`.
+  return client.asCurrentUser.enrich.executePolicy({
+    name: policyName,
+    wait_for_completion: false,
+  });
 };
 
 const remove = (client: IScopedClusterClient, policyName: string) => {
diff --git a/x-pack/plugins/index_management/server/routes/api/component_templates/register_get_route.ts b/x-pack/plugins/index_management/server/routes/api/component_templates/register_get_route.ts
index 73224c0356ad59..2ccc3919e377aa 100644
--- a/x-pack/plugins/index_management/server/routes/api/component_templates/register_get_route.ts
+++ b/x-pack/plugins/index_management/server/routes/api/component_templates/register_get_route.ts
@@ -33,9 +33,9 @@ export function registerGetAllRoute({ router, lib: { handleEsError } }: RouteDep
         const { index_templates: indexTemplates } =
           await client.asCurrentUser.indices.getIndexTemplate();
 
-        const body = componentTemplates.map((componentTemplate: ComponentTemplateFromEs) => {
+        const body = componentTemplates.map((componentTemplate) => {
           const deserializedComponentTemplateListItem = deserializeComponentTemplateList(
-            componentTemplate,
+            componentTemplate as ComponentTemplateFromEs,
             // @ts-expect-error TemplateSerialized.index_patterns not compatible with IndicesIndexTemplate.index_patterns
             indexTemplates
           );
diff --git a/x-pack/plugins/index_management/server/routes/api/component_templates/schema_validation.ts b/x-pack/plugins/index_management/server/routes/api/component_templates/schema_validation.ts
index c436c70ba7a46d..586e9db9110283 100644
--- a/x-pack/plugins/index_management/server/routes/api/component_templates/schema_validation.ts
+++ b/x-pack/plugins/index_management/server/routes/api/component_templates/schema_validation.ts
@@ -13,6 +13,12 @@ export const componentTemplateSchema = schema.object({
     settings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
     aliases: schema.maybe(schema.object({}, { unknowns: 'allow' })),
     mappings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+    lifecycle: schema.maybe(
+      schema.object({
+        enabled: schema.boolean(),
+        data_retention: schema.maybe(schema.string()),
+      })
+    ),
   }),
   version: schema.maybe(schema.number()),
   _meta: schema.maybe(schema.object({}, { unknowns: 'allow' })),
diff --git a/x-pack/plugins/index_management/server/routes/api/templates/validate_schemas.ts b/x-pack/plugins/index_management/server/routes/api/templates/validate_schemas.ts
index d4236fb9051c46..b9020585ed676e 100644
--- a/x-pack/plugins/index_management/server/routes/api/templates/validate_schemas.ts
+++ b/x-pack/plugins/index_management/server/routes/api/templates/validate_schemas.ts
@@ -19,6 +19,12 @@ export const templateSchema = schema.object({
       settings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
       aliases: schema.maybe(schema.object({}, { unknowns: 'allow' })),
       mappings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+      lifecycle: schema.maybe(
+        schema.object({
+          enabled: schema.boolean(),
+          data_retention: schema.maybe(schema.string()),
+        })
+      ),
     })
   ),
   composedOf: schema.maybe(schema.arrayOf(schema.string())),
diff --git a/x-pack/plugins/index_management/test/fixtures/template.ts b/x-pack/plugins/index_management/test/fixtures/template.ts
index 19a3b30c84c6bb..01f83e2d76ff51 100644
--- a/x-pack/plugins/index_management/test/fixtures/template.ts
+++ b/x-pack/plugins/index_management/test/fixtures/template.ts
@@ -7,6 +7,7 @@
 
 import { getRandomString, getRandomNumber } from '@kbn/test-jest-helpers';
 import { TemplateDeserialized, TemplateType, TemplateListItem } from '../../common';
+import { IndexSettings, Aliases, Mappings, DataStream } from '../../common/types';
 
 const objHasProperties = (obj?: Record<string, any>): boolean => {
   return obj === undefined || Object.keys(obj).length === 0 ? false : true;
@@ -17,7 +18,7 @@ export const getComposableTemplate = ({
   version = getRandomNumber(),
   priority = getRandomNumber(),
   indexPatterns = [],
-  template: { settings, aliases, mappings } = {},
+  template: { settings, aliases, mappings, lifecycle } = {},
   hasDatastream = false,
   isLegacy = false,
   type = 'default',
@@ -27,6 +28,12 @@ export const getComposableTemplate = ({
     isLegacy?: boolean;
     type?: TemplateType;
     hasDatastream: boolean;
+    template?: {
+      settings?: IndexSettings;
+      aliases?: Aliases;
+      mappings?: Mappings;
+      lifecycle?: DataStream['lifecycle'];
+    };
   }
 > = {}): TemplateDeserialized => {
   const indexTemplate = {
@@ -39,6 +46,7 @@ export const getComposableTemplate = ({
       aliases,
       mappings,
       settings,
+      lifecycle,
     },
     _kbnMeta: {
       type,
diff --git a/x-pack/plugins/infra/common/locators/locators.test.ts b/x-pack/plugins/infra/common/locators/locators.test.ts
index fb6f8283b63fd5..607fd41b1bab65 100644
--- a/x-pack/plugins/infra/common/locators/locators.test.ts
+++ b/x-pack/plugins/infra/common/locators/locators.test.ts
@@ -233,7 +233,7 @@ const constructLogView = (logView?: LogViewReference) => {
 };
 
 const constructLogPosition = (time: number = 1550671089404) => {
-  return `(position:(tiebreaker:0,time:${time}))`;
+  return `(position:(tiebreaker:0,time:'${moment(time).toISOString()}'))`;
 };
 
 const constructLogFilter = ({
diff --git a/x-pack/plugins/infra/common/time/time_key.ts b/x-pack/plugins/infra/common/time/time_key.ts
index efc5a8e7b85170..7acbef8b250252 100644
--- a/x-pack/plugins/infra/common/time/time_key.ts
+++ b/x-pack/plugins/infra/common/time/time_key.ts
@@ -5,12 +5,13 @@
  * 2.0.
  */
 
+import { DateFromStringOrNumber } from '@kbn/io-ts-utils';
 import { ascending, bisector } from 'd3-array';
 import * as rt from 'io-ts';
 import { pick } from 'lodash';
 
 export const minimalTimeKeyRT = rt.type({
-  time: rt.number,
+  time: DateFromStringOrNumber,
   tiebreaker: rt.number,
 });
 export type MinimalTimeKey = rt.TypeOf<typeof minimalTimeKeyRT>;
diff --git a/x-pack/plugins/infra/common/url_state_storage_service.ts b/x-pack/plugins/infra/common/url_state_storage_service.ts
index 5d701ad1876bb0..ece3d1ccb09bf9 100644
--- a/x-pack/plugins/infra/common/url_state_storage_service.ts
+++ b/x-pack/plugins/infra/common/url_state_storage_service.ts
@@ -24,18 +24,18 @@ export const defaultLogViewKey = 'logView';
 
 const encodeRisonUrlState = (state: any) => encode(state);
 
-// Used by linkTo components
+// Used by Locator components
 export const replaceLogPositionInQueryString = (time?: number) =>
   Number.isNaN(time) || time == null
     ? (value: string) => value
     : replaceStateKeyInQueryString<PositionStateInUrl>(defaultPositionStateKey, {
         position: {
-          time,
+          time: moment(time).toISOString(),
           tiebreaker: 0,
         },
       });
 
-// NOTE: Used by link-to components
+// NOTE: Used by Locator components
 export const replaceLogViewInQueryString = (logViewReference: LogViewReference) =>
   replaceStateKeyInQueryString(defaultLogViewKey, logViewReference);
 
diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_details_app_section/components/log_rate_analysis.tsx b/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_details_app_section/components/log_rate_analysis.tsx
index b9ff53140b02c5..a8ebb5c884b6bd 100644
--- a/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_details_app_section/components/log_rate_analysis.tsx
+++ b/x-pack/plugins/infra/public/alerting/log_threshold/components/alert_details_app_section/components/log_rate_analysis.tsx
@@ -162,7 +162,7 @@ export const LogRateAnalysis: FC<AlertDetailsLogRateAnalysisSectionProps> = ({ r
 
   const onAnalysisCompleted = (analysisResults: LogRateAnalysisResultsData | undefined) => {
     const significantFieldValues = orderBy(
-      analysisResults?.significantTerms?.map((item) => ({
+      analysisResults?.significantItems?.map((item) => ({
         field: item.fieldName,
         value: item.fieldValue,
         docCount: item.doc_count,
diff --git a/x-pack/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx b/x-pack/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx
index df1591a96afa94..00c6bcc4a623f8 100644
--- a/x-pack/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_minimap/log_minimap.tsx
@@ -12,6 +12,7 @@ import {
   LogEntryTime,
 } from '@kbn/logs-shared-plugin/common';
 import { scaleLinear } from 'd3-scale';
+import moment from 'moment';
 import * as React from 'react';
 import { DensityChart } from './density_chart';
 import { HighlightedInterval } from './highlighted_interval';
@@ -67,7 +68,7 @@ export class LogMinimap extends React.Component<LogMinimapProps, LogMinimapState
 
     this.props.jumpToTarget({
       tiebreaker: 0,
-      time: clickedTime,
+      time: moment(clickedTime).toISOString(),
     });
   };
 
@@ -142,9 +143,9 @@ export class LogMinimap extends React.Component<LogMinimapProps, LogMinimapState
 
         {highlightedInterval ? (
           <HighlightedInterval
-            end={highlightedInterval.end}
+            end={moment(highlightedInterval.end).valueOf()}
             getPositionOfTime={this.getPositionOfTime}
-            start={highlightedInterval.start}
+            start={moment(highlightedInterval.start).valueOf()}
             targetWidth={TIMERULER_WIDTH}
             width={width}
             target={target}
diff --git a/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_categories/module_descriptor.ts b/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_categories/module_descriptor.ts
index 38a1c5c907528c..07a183973178d5 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_categories/module_descriptor.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_categories/module_descriptor.ts
@@ -146,7 +146,7 @@ const validateSetupIndices = async (
       fields: [
         {
           name: timestampField,
-          validTypes: ['date'],
+          validTypes: ['date', 'date_nanos'],
         },
         {
           name: partitionField,
diff --git a/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_rate/module_descriptor.ts b/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_rate/module_descriptor.ts
index 8cb0bb8a217990..a2e0219da9915d 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_rate/module_descriptor.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_analysis/modules/log_entry_rate/module_descriptor.ts
@@ -138,7 +138,7 @@ const validateSetupIndices = async (
       fields: [
         {
           name: timestampField,
-          validTypes: ['date'],
+          validTypes: ['date', 'date_nanos'],
         },
         {
           name: partitionField,
diff --git a/x-pack/plugins/infra/public/observability_logs/log_stream_page/state/src/types.ts b/x-pack/plugins/infra/public/observability_logs/log_stream_page/state/src/types.ts
index 12c707ebb91fd4..31c808d307bbe0 100644
--- a/x-pack/plugins/infra/public/observability_logs/log_stream_page/state/src/types.ts
+++ b/x-pack/plugins/infra/public/observability_logs/log_stream_page/state/src/types.ts
@@ -109,7 +109,7 @@ export type LogStreamPageContext = LogStreamPageTypestate['context'];
 export interface LogStreamPageCallbacks {
   updateTimeRange: (timeRange: Partial<TimeRange>) => void;
   jumpToTargetPosition: (targetPosition: TimeKey | null) => void;
-  jumpToTargetPositionTime: (time: number) => void;
+  jumpToTargetPositionTime: (time: string) => void;
   reportVisiblePositions: (visiblePositions: VisiblePositions) => void;
   startLiveStreaming: () => void;
   stopLiveStreaming: () => void;
diff --git a/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/state_machine.ts b/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/state_machine.ts
index 96b7dbb6878516..868f29a5c07e96 100644
--- a/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/state_machine.ts
+++ b/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/state_machine.ts
@@ -7,6 +7,8 @@
 
 import { IToasts } from '@kbn/core-notifications-browser';
 import { IKbnUrlStateStorage } from '@kbn/kibana-utils-plugin/public';
+import { convertISODateToNanoPrecision } from '@kbn/logs-shared-plugin/common';
+import moment from 'moment';
 import { actions, ActorRefFrom, createMachine, EmittedFrom, SpecialTargets } from 'xstate';
 import { isSameTimeKey } from '../../../../common/time';
 import { OmitDeprecatedState, sendIfDefined } from '../../xstate_helpers';
@@ -159,11 +161,19 @@ export const createPureLogStreamPositionStateMachine = (initialContext: LogStrea
         updatePositionsFromTimeChange: actions.assign((_context, event) => {
           if (!('timeRange' in event)) return {};
 
+          const {
+            timestamps: { startTimestamp, endTimestamp },
+          } = event;
+
           // Reset the target position if it doesn't fall within the new range.
+          const targetPositionNanoTime =
+            _context.targetPosition && convertISODateToNanoPrecision(_context.targetPosition.time);
+          const startNanoDate = convertISODateToNanoPrecision(moment(startTimestamp).toISOString());
+          const endNanoDate = convertISODateToNanoPrecision(moment(endTimestamp).toISOString());
+
           const targetPositionShouldReset =
-            _context.targetPosition &&
-            (event.timestamps.startTimestamp > _context.targetPosition.time ||
-              event.timestamps.endTimestamp < _context.targetPosition.time);
+            targetPositionNanoTime &&
+            (startNanoDate > targetPositionNanoTime || endNanoDate < targetPositionNanoTime);
 
           return {
             targetPosition: targetPositionShouldReset ? null : _context.targetPosition,
diff --git a/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/url_state_storage_service.ts b/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/url_state_storage_service.ts
index c98ab9e1474441..5607bf92070547 100644
--- a/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/url_state_storage_service.ts
+++ b/x-pack/plugins/infra/public/observability_logs/log_stream_position_state/src/url_state_storage_service.ts
@@ -10,7 +10,6 @@ import { IKbnUrlStateStorage, withNotifyOnErrors } from '@kbn/kibana-utils-plugi
 import * as Either from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/function';
 import { InvokeCreator } from 'xstate';
-import { replaceStateKeyInQueryString } from '../../../../common/url_state_storage_service';
 import { minimalTimeKeyRT, pickTimeKey } from '../../../../common/time';
 import { createPlainError, formatErrors } from '../../../../common/runtime_types';
 import type { LogStreamPositionContext, LogStreamPositionEvent } from './types';
@@ -98,13 +97,3 @@ export type PositionStateInUrl = rt.TypeOf<typeof positionStateInUrlRT>;
 const decodePositionQueryValueFromUrl = (queryValueFromUrl: unknown) => {
   return positionStateInUrlRT.decode(queryValueFromUrl);
 };
-
-export const replaceLogPositionInQueryString = (time?: number) =>
-  Number.isNaN(time) || time == null
-    ? (value: string) => value
-    : replaceStateKeyInQueryString<PositionStateInUrl>(defaultPositionStateKey, {
-        position: {
-          time,
-          tiebreaker: 0,
-        },
-      });
diff --git a/x-pack/plugins/infra/public/observability_logs/log_stream_query_state/src/url_state_storage_service.ts b/x-pack/plugins/infra/public/observability_logs/log_stream_query_state/src/url_state_storage_service.ts
index fb65fcd987a112..1a4daad1832d9e 100644
--- a/x-pack/plugins/infra/public/observability_logs/log_stream_query_state/src/url_state_storage_service.ts
+++ b/x-pack/plugins/infra/public/observability_logs/log_stream_query_state/src/url_state_storage_service.ts
@@ -17,6 +17,7 @@ import {
   defaultPositionStateKey,
   DEFAULT_REFRESH_INTERVAL,
 } from '@kbn/logs-shared-plugin/common';
+import moment from 'moment';
 import {
   getTimeRangeEndFromTime,
   getTimeRangeStartFromTime,
@@ -159,8 +160,8 @@ export const initializeFromUrl =
               Either.chain(({ position }) =>
                 position && position.time
                   ? Either.right({
-                      from: getTimeRangeStartFromTime(position.time),
-                      to: getTimeRangeEndFromTime(position.time),
+                      from: getTimeRangeStartFromTime(moment(position.time).valueOf()),
+                      to: getTimeRangeEndFromTime(moment(position.time).valueOf()),
                     })
                   : Either.left(null)
               )
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
index 0811ec1708530b..babd0e9a1ae3b1 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/category_example_message.tsx
@@ -58,7 +58,7 @@ export const CategoryExampleMessage: React.FunctionComponent<{
     search: {
       logPosition: encode({
         end: moment(timeRange.endTime).format('YYYY-MM-DDTHH:mm:ss.SSSZ'),
-        position: { tiebreaker, time: timestamp },
+        position: { tiebreaker, time: moment(timestamp).toISOString() },
         start: moment(timeRange.startTime).format('YYYY-MM-DDTHH:mm:ss.SSSZ'),
         streamLive: false,
       }),
@@ -128,7 +128,10 @@ export const CategoryExampleMessage: React.FunctionComponent<{
                     id,
                     index: '', // TODO: use real index when loading via async search
                     context,
-                    cursor: { time: timestamp, tiebreaker },
+                    cursor: {
+                      time: moment(timestamp).toISOString(),
+                      tiebreaker,
+                    },
                     columns: [],
                   };
                   trackMetric({ metric: 'view_in_context__categories' });
diff --git a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
index 288fc3df39c8e2..174abbbe60bc42 100644
--- a/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/log_entry_example.tsx
@@ -102,7 +102,7 @@ export const LogEntryExampleMessage: React.FunctionComponent<Props> = ({
     search: {
       logPosition: encode({
         end: moment(timeRange.endTime).format('YYYY-MM-DDTHH:mm:ss.SSSZ'),
-        position: { tiebreaker, time: timestamp },
+        position: { tiebreaker, time: moment(timestamp).toISOString() },
         start: moment(timeRange.startTime).format('YYYY-MM-DDTHH:mm:ss.SSSZ'),
         streamLive: false,
       }),
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_content.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_content.tsx
index b011931adbd853..e14d52fe1693be 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_content.tsx
@@ -38,7 +38,7 @@ export const ConnectedStreamPageContent: React.FC = () => {
       jumpToTargetPosition: (targetPosition: TimeKey | null) => {
         logStreamPageSend({ type: 'JUMP_TO_TARGET_POSITION', targetPosition });
       },
-      jumpToTargetPositionTime: (time: number) => {
+      jumpToTargetPositionTime: (time: string) => {
         logStreamPageSend({ type: 'JUMP_TO_TARGET_POSITION', targetPosition: { time } });
       },
       reportVisiblePositions: (visiblePositions: VisiblePositions) => {
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_logs_content.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_logs_content.tsx
index 14ebe864d5d68e..9841553ce9860f 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_logs_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_logs_content.tsx
@@ -8,7 +8,7 @@
 import { EuiSpacer } from '@elastic/eui';
 import type { Query } from '@kbn/es-query';
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
-import { LogEntry } from '@kbn/logs-shared-plugin/common';
+import { LogEntry, convertISODateToNanoPrecision } from '@kbn/logs-shared-plugin/common';
 import {
   LogEntryFlyout,
   LogEntryStreamItem,
@@ -117,8 +117,12 @@ export const StreamPageLogsContent = React.memo<{
 
     const isCenterPointOutsideLoadedRange =
       targetPosition != null &&
-      ((topCursor != null && targetPosition.time < topCursor.time) ||
-        (bottomCursor != null && targetPosition.time > bottomCursor.time));
+      ((topCursor != null &&
+        convertISODateToNanoPrecision(targetPosition.time) <
+          convertISODateToNanoPrecision(topCursor.time)) ||
+        (bottomCursor != null &&
+          convertISODateToNanoPrecision(targetPosition.time) >
+            convertISODateToNanoPrecision(bottomCursor.time)));
 
     const hasQueryChanged = filterQuery !== prevFilterQuery;
 
diff --git a/x-pack/plugins/infra/public/test_utils/entries.ts b/x-pack/plugins/infra/public/test_utils/entries.ts
index 35dad808cdf4f1..0b04c90ee633dd 100644
--- a/x-pack/plugins/infra/public/test_utils/entries.ts
+++ b/x-pack/plugins/infra/public/test_utils/entries.ts
@@ -18,14 +18,16 @@ export function generateFakeEntries(
   const timestampStep = Math.floor((endTimestamp - startTimestamp) / count);
   for (let i = 0; i < count; i++) {
     const timestamp = i === count - 1 ? endTimestamp : startTimestamp + timestampStep * i;
+    const date = new Date(timestamp).toISOString();
+
     entries.push({
       id: `entry-${i}`,
       index: 'logs-fake',
       context: {},
-      cursor: { time: timestamp, tiebreaker: i },
+      cursor: { time: date, tiebreaker: i },
       columns: columns.map((column) => {
         if ('timestampColumn' in column) {
-          return { columnId: column.timestampColumn.id, timestamp };
+          return { columnId: column.timestampColumn.id, time: date };
         } else if ('messageColumn' in column) {
           return {
             columnId: column.messageColumn.id,
diff --git a/x-pack/plugins/infra/server/index.ts b/x-pack/plugins/infra/server/index.ts
index 2bfd868831ecc6..96ac6dc162c240 100644
--- a/x-pack/plugins/infra/server/index.ts
+++ b/x-pack/plugins/infra/server/index.ts
@@ -6,12 +6,13 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { config, InfraConfig, InfraServerPlugin } from './plugin';
+import { config, InfraConfig } from './plugin';
 
 export type { InfraPluginSetup, InfraPluginStart, InfraRequestHandlerContext } from './types';
 export type { InfraConfig };
 export { config };
 
-export function plugin(context: PluginInitializerContext) {
+export async function plugin(context: PluginInitializerContext) {
+  const { InfraServerPlugin } = await import('./plugin');
   return new InfraServerPlugin(context);
 }
diff --git a/x-pack/plugins/infra/server/plugin.ts b/x-pack/plugins/infra/server/plugin.ts
index 6a2734b3991993..afcbe69c01f5c5 100644
--- a/x-pack/plugins/infra/server/plugin.ts
+++ b/x-pack/plugins/infra/server/plugin.ts
@@ -98,7 +98,7 @@ export const config: PluginConfigDescriptor<InfraConfig> = {
       }),
       inventoryThresholdAlertRuleEnabled: offeringBasedSchema({
         traditional: schema.boolean({ defaultValue: true }),
-        serverless: schema.boolean({ defaultValue: false }),
+        serverless: schema.boolean({ defaultValue: true }),
       }),
       metricThresholdAlertRuleEnabled: offeringBasedSchema({
         traditional: schema.boolean({ defaultValue: true }),
@@ -110,7 +110,7 @@ export const config: PluginConfigDescriptor<InfraConfig> = {
       }),
       alertsAndRulesDropdownEnabled: offeringBasedSchema({
         traditional: schema.boolean({ defaultValue: true }),
-        serverless: schema.boolean({ defaultValue: false }),
+        serverless: schema.boolean({ defaultValue: true }),
       }),
     }),
   }),
diff --git a/x-pack/plugins/ingest_pipelines/server/index.ts b/x-pack/plugins/ingest_pipelines/server/index.ts
index d120f60ef8a2d1..aac84c37591db1 100644
--- a/x-pack/plugins/ingest_pipelines/server/index.ts
+++ b/x-pack/plugins/ingest_pipelines/server/index.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { IngestPipelinesPlugin } from './plugin';
-
-export function plugin() {
+export async function plugin() {
+  const { IngestPipelinesPlugin } = await import('./plugin');
   return new IngestPipelinesPlugin();
 }
diff --git a/x-pack/plugins/kubernetes_security/server/index.ts b/x-pack/plugins/kubernetes_security/server/index.ts
index 7ff5edf027a09e..b51098c136ad09 100644
--- a/x-pack/plugins/kubernetes_security/server/index.ts
+++ b/x-pack/plugins/kubernetes_security/server/index.ts
@@ -6,8 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { KubernetesSecurityPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { KubernetesSecurityPlugin } = await import('./plugin');
   return new KubernetesSecurityPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
index a88cd0619f0013..c40c81285dc15b 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
@@ -20,7 +20,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { ToolbarButton } from '@kbn/kibana-react-plugin/public';
+import { ToolbarButton } from '@kbn/shared-ux-button-toolbar';
 import {
   Visualization,
   FramePublicAPI,
@@ -429,12 +429,13 @@ export const ChartSwitch = memo(function ChartSwitch(props: Props) {
             onClick={() => setFlyoutOpen(!flyoutOpen)}
             data-test-subj="lnsChartSwitchPopover"
             fontWeight="bold"
-          >
-            <VisualizationSummary
-              visualization={visualization}
-              visualizationMap={props.visualizationMap}
-            />
-          </ToolbarButton>
+            label={
+              <VisualizationSummary
+                visualization={visualization}
+                visualizationMap={props.visualizationMap}
+              />
+            }
+          />
         }
         isOpen={flyoutOpen}
         closePopover={() => setFlyoutOpen(false)}
diff --git a/x-pack/plugins/lens/public/shared_components/dataview_picker/trigger.tsx b/x-pack/plugins/lens/public/shared_components/dataview_picker/trigger.tsx
index 0669b7b08f07e8..f0a4648a3606e6 100644
--- a/x-pack/plugins/lens/public/shared_components/dataview_picker/trigger.tsx
+++ b/x-pack/plugins/lens/public/shared_components/dataview_picker/trigger.tsx
@@ -101,7 +101,7 @@ export function TriggerButton({
       fullWidth
       {...colorProp}
       {...rest}
-      textProps={{ style: { width: '100%', lineHeight: '100%' } }}
+      textProps={{ style: { width: '100%', lineHeight: '1.2em' } }}
     >
       <TriggerLabel label={label} extraIcons={extraIcons} />
     </ToolbarButton>
diff --git a/x-pack/plugins/lens/public/shared_components/legend/legend_settings_popover.tsx b/x-pack/plugins/lens/public/shared_components/legend/legend_settings_popover.tsx
index 34cdcfe2e18b1f..64a374bae70520 100644
--- a/x-pack/plugins/lens/public/shared_components/legend/legend_settings_popover.tsx
+++ b/x-pack/plugins/lens/public/shared_components/legend/legend_settings_popover.tsx
@@ -15,10 +15,9 @@ import {
   EuiFieldNumber,
 } from '@elastic/eui';
 import { Position, VerticalAlignment, HorizontalAlignment } from '@elastic/charts';
-import { ToolbarButtonProps } from '@kbn/kibana-react-plugin/public';
 import { LegendSize } from '@kbn/visualizations-plugin/public';
 import { useDebouncedValue } from '@kbn/visualization-ui-components';
-import { ToolbarPopover } from '../toolbar_popover';
+import { ToolbarPopover, type ToolbarPopoverProps } from '../toolbar_popover';
 import { LegendLocationSettings } from './location/legend_location_settings';
 import { ColumnsNumberSetting } from './layout/columns_number_setting';
 import { LegendSizeSettings } from './size/legend_size_settings';
@@ -119,7 +118,7 @@ export interface LegendSettingsPopoverProps {
   /**
    * Button group position
    */
-  groupPosition?: ToolbarButtonProps['groupPosition'];
+  groupPosition?: ToolbarPopoverProps['groupPosition'];
   /**
    * Legend size in pixels
    */
diff --git a/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx b/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
index dbb3d695886240..c8e096cbbb8a77 100644
--- a/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
+++ b/x-pack/plugins/lens/public/shared_components/toolbar_popover.tsx
@@ -7,8 +7,8 @@
 
 import './toolbar_popover.scss';
 import React, { useState } from 'react';
-import { EuiFlexItem, EuiPopover, EuiIcon, EuiPopoverTitle, IconType } from '@elastic/eui';
-import { ToolbarButton, ToolbarButtonProps } from '@kbn/kibana-react-plugin/public';
+import { EuiFlexItem, EuiPopover, EuiPopoverTitle, IconType } from '@elastic/eui';
+import { ToolbarButton, ToolbarButtonProps } from '@kbn/shared-ux-button-toolbar';
 import { EuiIconLegend } from '@kbn/chart-icons';
 
 const typeToIconMap: { [type: string]: string | IconType } = {
@@ -35,7 +35,7 @@ export interface ToolbarPopoverProps {
   /**
    * Button group position
    */
-  groupPosition?: ToolbarButtonProps['groupPosition'];
+  groupPosition?: ToolbarButtonProps<'iconButton'>['groupPosition'];
   buttonDataTestSubj?: string;
   panelClassName?: string;
   handleClose?: () => void;
@@ -63,18 +63,16 @@ export const ToolbarPopover: React.FunctionComponent<ToolbarPopoverProps> = ({
         aria-label={title}
         button={
           <ToolbarButton
-            fontWeight="normal"
+            as={'iconButton'}
+            iconType={iconType}
             onClick={() => {
               setOpen(!open);
             }}
-            title={title}
-            hasArrow={false}
+            aria-label={title}
             isDisabled={isDisabled}
             groupPosition={groupPosition}
-            dataTestSubj={buttonDataTestSubj}
-          >
-            <EuiIcon type={iconType} />
-          </ToolbarButton>
+            data-test-subj={buttonDataTestSubj}
+          />
         }
         isOpen={open}
         closePopover={() => {
diff --git a/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/axis_settings_popover.tsx b/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/axis_settings_popover.tsx
index 11077414e25b87..6b56d4f82ca190 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/axis_settings_popover.tsx
+++ b/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/axis_settings_popover.tsx
@@ -10,7 +10,7 @@ import { EuiSwitch, IconType, EuiFormRow, EuiButtonGroup, EuiSelect } from '@ela
 import { i18n } from '@kbn/i18n';
 import { isEqual } from 'lodash';
 import { AxisExtentConfig, YScaleType } from '@kbn/expression-xy-plugin/common';
-import { ToolbarButtonProps } from '@kbn/kibana-react-plugin/public';
+import { ToolbarButtonProps } from '@kbn/shared-ux-button-toolbar';
 import {
   EuiIconAxisBottom,
   EuiIconAxisLeft,
@@ -131,7 +131,7 @@ const popoverConfig = (
   isHorizontal: boolean
 ): {
   icon: IconType;
-  groupPosition: ToolbarButtonProps['groupPosition'];
+  groupPosition: ToolbarButtonProps<'iconButton'>['groupPosition'];
   popoverTitle: string;
   buttonDataTestSubj: string;
 } => {
diff --git a/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/layer_header.tsx b/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/layer_header.tsx
index 941b6d01e6b40b..99c7b2bec30d43 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/layer_header.tsx
+++ b/x-pack/plugins/lens/public/visualizations/xy/xy_config_panel/layer_header.tsx
@@ -15,8 +15,10 @@ import {
   EuiPopoverTitle,
   useEuiTheme,
   EuiIconTip,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
-import { ToolbarButton } from '@kbn/kibana-react-plugin/public';
+import { ToolbarButton } from '@kbn/shared-ux-button-toolbar';
 import { IconChartBarReferenceLine, IconChartBarAnnotations } from '@kbn/chart-icons';
 import { euiThemeVars } from '@kbn/ui-theme';
 import { css } from '@emotion/react';
@@ -231,18 +233,22 @@ const DataLayerHeaderTrigger = function ({
   return (
     <ToolbarButton
       data-test-subj="lns_layer_settings"
-      title={currentVisType.fullLabel || currentVisType.label}
+      aria-label={currentVisType.fullLabel || currentVisType.label}
       onClick={onClick}
       fullWidth
       size="s"
-      textProps={{ style: { lineHeight: '100%' } }}
-    >
-      <>
-        <EuiIcon type={currentVisType.icon} />
-        <EuiText size="s" className="lnsLayerPanelChartSwitch_title">
-          {currentVisType.fullLabel || currentVisType.label}
-        </EuiText>
-      </>
-    </ToolbarButton>
+      label={
+        <EuiFlexGroup gutterSize="none" alignItems="center" responsive={false}>
+          <EuiFlexItem grow={false}>
+            <EuiIcon type={currentVisType.icon} />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiText size="s" className="lnsLayerPanelChartSwitch_title">
+              {currentVisType.fullLabel || currentVisType.label}
+            </EuiText>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      }
+    />
   );
 };
diff --git a/x-pack/plugins/lens/server/index.ts b/x-pack/plugins/lens/server/index.ts
index 6b9f823c3bbc6d..80a61445b9cdb0 100644
--- a/x-pack/plugins/lens/server/index.ts
+++ b/x-pack/plugins/lens/server/index.ts
@@ -6,9 +6,11 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core-plugins-server';
-import { LensServerPlugin } from './plugin';
 export type { LensServerPluginSetup } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) => new LensServerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { LensServerPlugin } = await import('./plugin');
+  return new LensServerPlugin(initContext);
+};
 
 export type { LensDocShape715 } from './migrations/types';
diff --git a/x-pack/plugins/lens/tsconfig.json b/x-pack/plugins/lens/tsconfig.json
index d342ddf99fc77d..12f737244bcb05 100644
--- a/x-pack/plugins/lens/tsconfig.json
+++ b/x-pack/plugins/lens/tsconfig.json
@@ -90,7 +90,8 @@
     "@kbn/search-response-warnings",
     "@kbn/logging",
     "@kbn/core-plugins-server",
-    "@kbn/field-utils"
+    "@kbn/field-utils",
+    "@kbn/shared-ux-button-toolbar"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/license_management/server/index.ts b/x-pack/plugins/license_management/server/index.ts
index 1a8eba1e2610ed..55bd9e0f67fcfb 100644
--- a/x-pack/plugins/license_management/server/index.ts
+++ b/x-pack/plugins/license_management/server/index.ts
@@ -7,8 +7,9 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { LicenseManagementServerPlugin } from './plugin';
-
 export { config } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { LicenseManagementServerPlugin } = await import('./plugin');
+  return new LicenseManagementServerPlugin();
+};
diff --git a/x-pack/plugins/licensing/server/index.ts b/x-pack/plugins/licensing/server/index.ts
index 4cfa04089d8c5b..af950868152219 100644
--- a/x-pack/plugins/licensing/server/index.ts
+++ b/x-pack/plugins/licensing/server/index.ts
@@ -6,9 +6,11 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { LicensingPlugin } from './plugin';
 
-export const plugin = (context: PluginInitializerContext) => new LicensingPlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { LicensingPlugin } = await import('./plugin');
+  return new LicensingPlugin(context);
+};
 
 export type {
   LicenseCheckState,
diff --git a/x-pack/plugins/lists/server/index.ts b/x-pack/plugins/lists/server/index.ts
index ef63343d8f5eae..f4d6805057c414 100644
--- a/x-pack/plugins/lists/server/index.ts
+++ b/x-pack/plugins/lists/server/index.ts
@@ -8,9 +8,9 @@
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { ConfigSchema } from './config';
-import { ListPlugin } from './plugin';
+import type { ListPlugin } from './plugin';
 
-// exporting these since its required at top level in siem plugin
+// exporting these since it's required at top level in siem plugin
 export { ListClient } from './services/lists/list_client';
 export type {
   CreateExceptionListItemOptions,
@@ -40,5 +40,7 @@ export const config: PluginConfigDescriptor = {
 
 export { ErrorWithStatusCode as ListsErrorWithStatusCode } from './error_with_status_code';
 
-export const plugin = (initializerContext: PluginInitializerContext): ListPlugin =>
-  new ListPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext): Promise<ListPlugin> => {
+  const { ListPlugin } = await import('./plugin');
+  return new ListPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/log_explorer/common/constants.ts b/x-pack/plugins/log_explorer/common/constants.ts
index 4a93192b13acb3..5aeb491b5a9d23 100644
--- a/x-pack/plugins/log_explorer/common/constants.ts
+++ b/x-pack/plugins/log_explorer/common/constants.ts
@@ -13,6 +13,19 @@ export const HOST_NAME_FIELD = 'host.name';
 export const LOG_LEVEL_FIELD = 'log.level';
 export const MESSAGE_FIELD = 'message';
 export const SERVICE_NAME_FIELD = 'service.name';
+export const TRACE_ID_FIELD = 'trace.id';
+
+export const AGENT_NAME_FIELD = 'agent.name';
+export const ORCHESTRATOR_CLUSTER_NAME_FIELD = 'orchestrator.cluster.name';
+export const ORCHESTRATOR_RESOURCE_ID_FIELD = 'orchestrator.resource.id';
+export const CLOUD_PROVIDER_FIELD = 'cloud.provider';
+export const CLOUD_REGION_FIELD = 'cloud.region';
+export const CLOUD_AVAILABILITY_ZONE_FIELD = 'cloud.availability_zone';
+export const CLOUD_PROJECT_ID_FIELD = 'cloud.project.id';
+export const CLOUD_INSTANCE_ID_FIELD = 'cloud.instance.id';
+export const LOG_FILE_PATH_FIELD = 'log.file.path';
+export const DATASTREAM_NAMESPACE_FIELD = 'data_stream.namespace';
+export const DATASTREAM_DATASET_FIELD = 'data_stream.dataset';
 
 // Sizing
 export const DATA_GRID_COLUMN_WIDTH_SMALL = 240;
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_detail.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_detail.tsx
index 012e5c914ed616..66c4788a32ae28 100644
--- a/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_detail.tsx
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_detail.tsx
@@ -6,42 +6,22 @@
  */
 
 import React from 'react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { LogLevel } from './sub_components/log_level';
-import { Timestamp } from './sub_components/timestamp';
 import { FlyoutProps, LogDocument } from './types';
-import { getDocDetailRenderFlags, useDocDetail } from './use_doc_detail';
-import { Message } from './sub_components/message';
+import { useDocDetail } from './use_doc_detail';
+import { FlyoutHeader } from './flyout_header';
+import { FlyoutHighlights } from './flyout_highlights';
 
-export function FlyoutDetail({ dataView, doc }: Pick<FlyoutProps, 'dataView' | 'doc' | 'actions'>) {
+export function FlyoutDetail({
+  dataView,
+  doc,
+  actions,
+}: Pick<FlyoutProps, 'dataView' | 'doc' | 'actions'>) {
   const parsedDoc = useDocDetail(doc as LogDocument, { dataView });
 
-  const { hasTimestamp, hasLogLevel, hasMessage, hasBadges, hasFlyoutHeader } =
-    getDocDetailRenderFlags(parsedDoc);
-
-  return hasFlyoutHeader ? (
-    <EuiFlexGroup direction="column" gutterSize="m" data-test-subj="logExplorerFlyoutDetail">
-      <EuiFlexItem grow={false}>
-        {hasBadges && (
-          <EuiFlexGroup responsive={false} gutterSize="m">
-            {hasLogLevel && (
-              <EuiFlexItem grow={false}>
-                <LogLevel level={parsedDoc['log.level']} />
-              </EuiFlexItem>
-            )}
-            {hasTimestamp && (
-              <EuiFlexItem grow={false}>
-                <Timestamp timestamp={parsedDoc['@timestamp']} />
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
-        )}
-      </EuiFlexItem>
-      {hasMessage && (
-        <EuiFlexItem grow={false}>
-          <Message message={parsedDoc.message} />
-        </EuiFlexItem>
-      )}
-    </EuiFlexGroup>
-  ) : null;
+  return (
+    <>
+      <FlyoutHeader doc={parsedDoc} />
+      <FlyoutHighlights formattedDoc={parsedDoc} flattenedDoc={doc.flattened} actions={actions} />
+    </>
+  );
 }
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_header.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_header.tsx
new file mode 100644
index 00000000000000..babca8f2738604
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_header.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { FlyoutDoc } from './types';
+import { getDocDetailHeaderRenderFlags } from './use_doc_detail';
+import { LogLevel } from './sub_components/log_level';
+import { Timestamp } from './sub_components/timestamp';
+import { Message } from './sub_components/message';
+import * as constants from '../../../common/constants';
+
+export function FlyoutHeader({ doc }: { doc: FlyoutDoc }) {
+  const { hasTimestamp, hasLogLevel, hasMessage, hasBadges, hasFlyoutHeader } =
+    getDocDetailHeaderRenderFlags(doc);
+
+  return hasFlyoutHeader ? (
+    <EuiFlexGroup direction="column" gutterSize="m" data-test-subj="logExplorerFlyoutDetail">
+      <EuiFlexItem grow={false}>
+        {hasBadges && (
+          <EuiFlexGroup responsive={false} gutterSize="m">
+            {hasLogLevel && (
+              <EuiFlexItem grow={false}>
+                <LogLevel level={doc[constants.LOG_LEVEL_FIELD]} />
+              </EuiFlexItem>
+            )}
+            {hasTimestamp && (
+              <EuiFlexItem grow={false}>
+                <Timestamp timestamp={doc[constants.TIMESTAMP_FIELD]} />
+              </EuiFlexItem>
+            )}
+          </EuiFlexGroup>
+        )}
+      </EuiFlexItem>
+      {hasMessage && (
+        <EuiFlexItem grow={false}>
+          <Message message={doc[constants.MESSAGE_FIELD]} />
+        </EuiFlexItem>
+      )}
+    </EuiFlexGroup>
+  ) : null;
+}
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_highlights.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_highlights.tsx
new file mode 100644
index 00000000000000..74d65d73f23b8d
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/flyout_highlights.tsx
@@ -0,0 +1,207 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { FlyoutContentActions } from '@kbn/discover-plugin/public';
+import { DataTableRecord } from '@kbn/discover-utils/src/types';
+import { useMeasure } from 'react-use/lib';
+import { FlyoutDoc } from './types';
+import * as constants from '../../../common/constants';
+import { HighlightField } from './sub_components/highlight_field';
+import {
+  cloudAccordionTitle,
+  flyoutCloudAvailabilityZoneLabel,
+  flyoutCloudInstanceIdLabel,
+  flyoutCloudProjectIdLabel,
+  flyoutCloudProviderLabel,
+  flyoutCloudRegionLabel,
+  flyoutDatasetLabel,
+  flyoutHostNameLabel,
+  flyoutLogPathFileLabel,
+  flyoutNamespaceLabel,
+  flyoutOrchestratorClusterNameLabel,
+  flyoutOrchestratorResourceIdLabel,
+  flyoutServiceLabel,
+  flyoutShipperLabel,
+  flyoutTraceLabel,
+  infraAccordionTitle,
+  otherAccordionTitle,
+  serviceAccordionTitle,
+} from './translations';
+import { HighlightSection } from './sub_components/highlight_section';
+import { DiscoverActionsProvider } from '../../hooks/use_discover_action';
+import { HighlightContainer } from './sub_components/highlight_container';
+import { useFlyoutColumnWidth } from '../../hooks/use_flyouot_column_width';
+
+export function FlyoutHighlights({
+  formattedDoc,
+  flattenedDoc,
+  actions,
+}: {
+  formattedDoc: FlyoutDoc;
+  flattenedDoc: DataTableRecord['flattened'];
+  actions: FlyoutContentActions;
+}) {
+  const [ref, dimensions] = useMeasure<HTMLDivElement>();
+  const { columns, fieldWidth } = useFlyoutColumnWidth(dimensions.width);
+  return (
+    <DiscoverActionsProvider value={actions}>
+      <HighlightContainer ref={ref}>
+        <HighlightSection title={serviceAccordionTitle} columns={columns}>
+          {formattedDoc[constants.SERVICE_NAME_FIELD] && (
+            <HighlightField
+              label={flyoutServiceLabel}
+              field={constants.SERVICE_NAME_FIELD}
+              value={flattenedDoc[constants.SERVICE_NAME_FIELD]}
+              formattedValue={formattedDoc[constants.SERVICE_NAME_FIELD]}
+              dataTestSubj="logExplorerFlyoutService"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.TRACE_ID_FIELD] && (
+            <HighlightField
+              label={flyoutTraceLabel}
+              field={constants.TRACE_ID_FIELD}
+              value={flattenedDoc[constants.TRACE_ID_FIELD]}
+              formattedValue={formattedDoc[constants.TRACE_ID_FIELD]}
+              dataTestSubj="logExplorerFlyoutTrace"
+              width={fieldWidth}
+            />
+          )}
+        </HighlightSection>
+
+        <HighlightSection title={infraAccordionTitle} columns={columns}>
+          {formattedDoc[constants.HOST_NAME_FIELD] && (
+            <HighlightField
+              label={flyoutHostNameLabel}
+              field={constants.HOST_NAME_FIELD}
+              value={flattenedDoc[constants.HOST_NAME_FIELD]}
+              formattedValue={formattedDoc[constants.HOST_NAME_FIELD]}
+              dataTestSubj="logExplorerFlyoutHostName"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.ORCHESTRATOR_CLUSTER_NAME_FIELD] && (
+            <HighlightField
+              label={flyoutOrchestratorClusterNameLabel}
+              field={constants.ORCHESTRATOR_CLUSTER_NAME_FIELD}
+              value={flattenedDoc[constants.ORCHESTRATOR_CLUSTER_NAME_FIELD]}
+              formattedValue={formattedDoc[constants.ORCHESTRATOR_CLUSTER_NAME_FIELD]}
+              dataTestSubj="logExplorerFlyoutClusterName"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.ORCHESTRATOR_RESOURCE_ID_FIELD] && (
+            <HighlightField
+              label={flyoutOrchestratorResourceIdLabel}
+              field={constants.ORCHESTRATOR_RESOURCE_ID_FIELD}
+              value={flattenedDoc[constants.ORCHESTRATOR_RESOURCE_ID_FIELD]}
+              formattedValue={formattedDoc[constants.ORCHESTRATOR_RESOURCE_ID_FIELD]}
+              dataTestSubj="logExplorerFlyoutResourceId"
+              width={fieldWidth}
+            />
+          )}
+        </HighlightSection>
+
+        <HighlightSection title={cloudAccordionTitle} columns={columns}>
+          {formattedDoc[constants.CLOUD_PROVIDER_FIELD] && (
+            <HighlightField
+              label={flyoutCloudProviderLabel}
+              field={constants.CLOUD_PROVIDER_FIELD}
+              value={flattenedDoc[constants.CLOUD_PROVIDER_FIELD]}
+              formattedValue={formattedDoc[constants.CLOUD_PROVIDER_FIELD]}
+              dataTestSubj="logExplorerFlyoutCloudProvider"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.CLOUD_REGION_FIELD] && (
+            <HighlightField
+              label={flyoutCloudRegionLabel}
+              field={constants.CLOUD_REGION_FIELD}
+              value={flattenedDoc[constants.CLOUD_REGION_FIELD]}
+              formattedValue={formattedDoc[constants.CLOUD_REGION_FIELD]}
+              dataTestSubj="logExplorerFlyoutCloudRegion"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.CLOUD_AVAILABILITY_ZONE_FIELD] && (
+            <HighlightField
+              label={flyoutCloudAvailabilityZoneLabel}
+              field={constants.CLOUD_AVAILABILITY_ZONE_FIELD}
+              value={flattenedDoc[constants.CLOUD_AVAILABILITY_ZONE_FIELD]}
+              formattedValue={formattedDoc[constants.CLOUD_AVAILABILITY_ZONE_FIELD]}
+              dataTestSubj="logExplorerFlyoutCloudAz"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.CLOUD_PROJECT_ID_FIELD] && (
+            <HighlightField
+              label={flyoutCloudProjectIdLabel}
+              field={constants.CLOUD_PROJECT_ID_FIELD}
+              value={flattenedDoc[constants.CLOUD_PROJECT_ID_FIELD]}
+              formattedValue={formattedDoc[constants.CLOUD_PROJECT_ID_FIELD]}
+              dataTestSubj="logExplorerFlyoutCloudProjectId"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.CLOUD_INSTANCE_ID_FIELD] && (
+            <HighlightField
+              label={flyoutCloudInstanceIdLabel}
+              field={constants.CLOUD_INSTANCE_ID_FIELD}
+              value={flattenedDoc[constants.CLOUD_INSTANCE_ID_FIELD]}
+              formattedValue={formattedDoc[constants.CLOUD_INSTANCE_ID_FIELD]}
+              dataTestSubj="logExplorerFlyoutCloudInstanceId"
+              width={fieldWidth}
+            />
+          )}
+        </HighlightSection>
+
+        <HighlightSection title={otherAccordionTitle} showBottomRule={false} columns={columns}>
+          {formattedDoc[constants.LOG_FILE_PATH_FIELD] && (
+            <HighlightField
+              label={flyoutLogPathFileLabel}
+              field={constants.LOG_FILE_PATH_FIELD}
+              value={flattenedDoc[constants.LOG_FILE_PATH_FIELD]}
+              formattedValue={formattedDoc[constants.LOG_FILE_PATH_FIELD]}
+              dataTestSubj="logExplorerFlyoutLogPathFile"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.DATASTREAM_NAMESPACE_FIELD] && (
+            <HighlightField
+              label={flyoutNamespaceLabel}
+              field={constants.DATASTREAM_NAMESPACE_FIELD}
+              value={flattenedDoc[constants.DATASTREAM_NAMESPACE_FIELD]}
+              formattedValue={formattedDoc[constants.DATASTREAM_NAMESPACE_FIELD]}
+              dataTestSubj="logExplorerFlyoutNamespace"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.DATASTREAM_DATASET_FIELD] && (
+            <HighlightField
+              label={flyoutDatasetLabel}
+              field={constants.DATASTREAM_DATASET_FIELD}
+              value={flattenedDoc[constants.DATASTREAM_DATASET_FIELD]}
+              formattedValue={formattedDoc[constants.DATASTREAM_DATASET_FIELD]}
+              dataTestSubj="logExplorerFlyoutDataset"
+              width={fieldWidth}
+            />
+          )}
+          {formattedDoc[constants.AGENT_NAME_FIELD] && (
+            <HighlightField
+              label={flyoutShipperLabel}
+              field={constants.AGENT_NAME_FIELD}
+              value={flattenedDoc[constants.AGENT_NAME_FIELD]}
+              formattedValue={formattedDoc[constants.AGENT_NAME_FIELD]}
+              dataTestSubj="logExplorerFlyoutLogShipper"
+              width={fieldWidth}
+            />
+          )}
+        </HighlightSection>
+      </HighlightContainer>
+    </DiscoverActionsProvider>
+  );
+}
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_container.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_container.tsx
new file mode 100644
index 00000000000000..9e00948699404e
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_container.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiHorizontalRule, EuiPanel } from '@elastic/eui';
+
+interface HighlightContainerProps {
+  children: React.ReactNode;
+}
+
+const hasNonUndefinedSubChild = (children: React.ReactNode[]): boolean => {
+  return children.some((child) => {
+    if (React.isValidElement(child)) {
+      const subChildren = React.Children.toArray(child.props.children);
+      return subChildren.some((subChild) => subChild !== undefined && subChild !== null);
+    }
+    return false;
+  });
+};
+
+export const HighlightContainer = React.forwardRef<HTMLDivElement, HighlightContainerProps>(
+  ({ children }, ref) => {
+    const validChildren = React.Children.toArray(children).filter(Boolean);
+    const hasChildren = validChildren.length > 0;
+    const shouldRender = hasChildren && hasNonUndefinedSubChild(validChildren);
+
+    const flexChildren = validChildren.map((child, idx) => <div key={idx}>{child}</div>);
+
+    return shouldRender ? (
+      <div ref={ref}>
+        <EuiHorizontalRule margin="xs" />
+        <EuiPanel paddingSize="m" hasShadow={false} hasBorder={true}>
+          {flexChildren}
+        </EuiPanel>
+      </div>
+    ) : null;
+  }
+);
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_field.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_field.tsx
new file mode 100644
index 00000000000000..ca47b10548236d
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_field.tsx
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiText, copyToClipboard } from '@elastic/eui';
+import React, { ReactNode, useMemo, useState } from 'react';
+import { HoverAction, HoverActionType } from './hover_action';
+import {
+  flyoutHoverActionFilterForText,
+  flyoutHoverActionFilterOutText,
+  flyoutHoverActionFilterForFieldPresentText,
+  flyoutHoverActionToggleColumnText,
+  flyoutHoverActionCopyToClipboardText,
+} from '../translations';
+import { useDiscoverActionsContext } from '../../../hooks/use_discover_action';
+
+interface HighlightFieldProps {
+  label: string | ReactNode;
+  field: string;
+  value: unknown;
+  formattedValue: string;
+  dataTestSubj: string;
+  width: number;
+}
+
+export function HighlightField({
+  label,
+  field,
+  value,
+  formattedValue,
+  dataTestSubj,
+  width,
+}: HighlightFieldProps) {
+  const filterForText = flyoutHoverActionFilterForText(value);
+  const filterOutText = flyoutHoverActionFilterOutText(value);
+  const actions = useDiscoverActionsContext();
+  const [columnAdded, setColumnAdded] = useState(false);
+
+  const hoverActions: HoverActionType[] = useMemo(
+    () => [
+      {
+        id: 'addToFilterAction',
+        tooltipContent: filterForText,
+        iconType: 'plusInCircle',
+        onClick: () => actions?.addFilter && actions.addFilter(field, value, '+'),
+        display: true,
+      },
+      {
+        id: 'removeFromFilterAction',
+        tooltipContent: filterOutText,
+        iconType: 'minusInCircle',
+        onClick: () => actions?.addFilter && actions.addFilter(field, value, '-'),
+        display: true,
+      },
+      {
+        id: 'filterForFieldPresentAction',
+        tooltipContent: flyoutHoverActionFilterForFieldPresentText,
+        iconType: 'filter',
+        onClick: () => actions?.addFilter && actions.addFilter('_exists_', field, '+'),
+        display: true,
+      },
+      {
+        id: 'toggleColumnAction',
+        tooltipContent: flyoutHoverActionToggleColumnText,
+        iconType: 'listAdd',
+        onClick: () => {
+          if (actions) {
+            if (columnAdded) {
+              actions?.removeColumn?.(field);
+            } else {
+              actions?.addColumn?.(field);
+            }
+            setColumnAdded(!columnAdded);
+          }
+        },
+        display: true,
+      },
+      {
+        id: 'copyToClipboardAction',
+        tooltipContent: flyoutHoverActionCopyToClipboardText,
+        iconType: 'copyClipboard',
+        onClick: () => copyToClipboard(value as string),
+        display: true,
+      },
+    ],
+    [filterForText, filterOutText, actions, field, value, columnAdded]
+  );
+  return formattedValue ? (
+    <EuiFlexGroup direction="column" gutterSize="none" data-test-subj={dataTestSubj}>
+      <EuiFlexItem>
+        <EuiText color="subdued" size="xs">
+          {label}
+        </EuiText>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <HoverAction displayText={formattedValue} actions={hoverActions} width={width} />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  ) : null;
+}
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_section.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_section.tsx
new file mode 100644
index 00000000000000..0b598339ed29b6
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/highlight_section.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import {
+  EuiAccordion,
+  EuiFlexGrid,
+  EuiHorizontalRule,
+  EuiTitle,
+  EuiFlexItem,
+  useGeneratedHtmlId,
+} from '@elastic/eui';
+
+interface HighlightSectionProps {
+  title: string;
+  children: React.ReactNode;
+  showBottomRule?: boolean;
+  columns: 1 | 2 | 3;
+}
+
+export function HighlightSection({
+  title,
+  children,
+  showBottomRule = true,
+  columns,
+}: HighlightSectionProps) {
+  const validChildren = React.Children.toArray(children).filter(Boolean);
+  const shouldRenderSection = validChildren.length > 0;
+  const accordionTitle = (
+    <EuiTitle size="xs">
+      <p>{title}</p>
+    </EuiTitle>
+  );
+
+  const flexChildren = validChildren.map((child, idx) => (
+    <EuiFlexItem key={idx}>{child}</EuiFlexItem>
+  ));
+
+  const accordionId = useGeneratedHtmlId({
+    prefix: title,
+  });
+
+  return shouldRenderSection ? (
+    <>
+      <EuiAccordion
+        id={accordionId}
+        buttonContent={accordionTitle}
+        paddingSize="s"
+        initialIsOpen={true}
+        data-test-subj={`logExplorerFlyoutHighlightSection${title}`}
+      >
+        <EuiFlexGrid columns={columns}>{flexChildren}</EuiFlexGrid>
+      </EuiAccordion>
+      {showBottomRule && <EuiHorizontalRule margin="xs" />}
+    </>
+  ) : null;
+}
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/hover_action.tsx b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/hover_action.tsx
new file mode 100644
index 00000000000000..5ed25be2b36d9e
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/sub_components/hover_action.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import {
+  EuiFlexGroup,
+  EuiToolTip,
+  EuiButtonIcon,
+  useEuiTheme,
+  EuiTextTruncate,
+  EuiText,
+} from '@elastic/eui';
+import type { IconType } from '@elastic/eui';
+
+export interface HoverActionType {
+  id: string;
+  tooltipContent: string;
+  iconType: IconType;
+  onClick: () => void;
+  display: boolean;
+}
+
+interface HoverActionProps {
+  displayText: string;
+  actions: HoverActionType[];
+  width: number;
+}
+
+export const HoverAction = ({ displayText, actions, width }: HoverActionProps) => {
+  const { euiTheme } = useEuiTheme();
+
+  return (
+    <EuiFlexGroup
+      responsive={false}
+      alignItems="center"
+      justifyContent="flexStart"
+      gutterSize="s"
+      css={{
+        ':hover, :focus-within': {
+          '.visibleOnHoverFocus': {
+            opacity: 1,
+            visibility: 'visible',
+          },
+        },
+      }}
+    >
+      <EuiTextTruncate text={displayText} truncation="end" width={width}>
+        {(truncatedText: string) => (
+          <EuiText
+            // Value returned from formatFieldValue is always sanitized
+            dangerouslySetInnerHTML={{ __html: truncatedText }}
+          />
+        )}
+      </EuiTextTruncate>
+      <EuiFlexGroup
+        className="visibleOnHoverFocus"
+        css={{
+          flexGrow: 0,
+          flexShrink: 0,
+          opacity: 0,
+          visibility: 'hidden',
+          transition: `opacity ${euiTheme.animation.normal} ${euiTheme.animation.resistance}, visibility ${euiTheme.animation.normal} ${euiTheme.animation.resistance}`,
+        }}
+        responsive={false}
+        alignItems="center"
+        gutterSize="none"
+      >
+        {actions.map((action) => (
+          <EuiToolTip content={action.tooltipContent} key={action.id}>
+            <EuiButtonIcon
+              size="xs"
+              iconType={action.iconType}
+              aria-label={action.tooltipContent as string}
+              onClick={() => action.onClick()}
+            />
+          </EuiToolTip>
+        ))}
+      </EuiFlexGroup>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/translations.ts b/x-pack/plugins/log_explorer/public/components/flyout_detail/translations.ts
index fcb42cf79a5dd2..9c27e333a4bdcb 100644
--- a/x-pack/plugins/log_explorer/public/components/flyout_detail/translations.ts
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/translations.ts
@@ -10,3 +10,151 @@ import { i18n } from '@kbn/i18n';
 export const flyoutMessageLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.message', {
   defaultMessage: 'Message',
 });
+
+export const flyoutServiceLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.service', {
+  defaultMessage: 'Service',
+});
+
+export const flyoutTraceLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.trace', {
+  defaultMessage: 'Trace',
+});
+
+export const flyoutHostNameLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.hostName', {
+  defaultMessage: 'Host name',
+});
+
+export const serviceAccordionTitle = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.accordion.title.service',
+  {
+    defaultMessage: 'Service',
+  }
+);
+
+export const infraAccordionTitle = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.accordion.title.infrastructure',
+  {
+    defaultMessage: 'Infrastructure',
+  }
+);
+
+export const cloudAccordionTitle = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.accordion.title.cloud',
+  {
+    defaultMessage: 'Cloud',
+  }
+);
+
+export const otherAccordionTitle = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.accordion.title.other',
+  {
+    defaultMessage: 'Other',
+  }
+);
+
+export const flyoutOrchestratorClusterNameLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.orchestratorClusterName',
+  {
+    defaultMessage: 'Orchestrator cluster Name',
+  }
+);
+
+export const flyoutOrchestratorResourceIdLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.orchestratorResourceId',
+  {
+    defaultMessage: 'Orchestrator resource ID',
+  }
+);
+
+export const flyoutCloudProviderLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.cloudProvider',
+  {
+    defaultMessage: 'Cloud provider',
+  }
+);
+
+export const flyoutCloudRegionLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.cloudRegion',
+  {
+    defaultMessage: 'Cloud region',
+  }
+);
+
+export const flyoutCloudAvailabilityZoneLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.cloudAvailabilityZone',
+  {
+    defaultMessage: 'Cloud availability zone',
+  }
+);
+
+export const flyoutCloudProjectIdLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.cloudProjectId',
+  {
+    defaultMessage: 'Cloud project ID',
+  }
+);
+
+export const flyoutCloudInstanceIdLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.cloudInstanceId',
+  {
+    defaultMessage: 'Cloud instance ID',
+  }
+);
+
+export const flyoutLogPathFileLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.logPathFile',
+  {
+    defaultMessage: 'Log path file',
+  }
+);
+
+export const flyoutNamespaceLabel = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.label.namespace',
+  {
+    defaultMessage: 'Namespace',
+  }
+);
+
+export const flyoutDatasetLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.dataset', {
+  defaultMessage: 'Dataset',
+});
+
+export const flyoutShipperLabel = i18n.translate('xpack.logExplorer.flyoutDetail.label.shipper', {
+  defaultMessage: 'Shipper',
+});
+
+export const flyoutHoverActionFilterForText = (text: unknown) =>
+  i18n.translate('xpack.logExplorer.flyoutDetail.value.hover.filterFor', {
+    defaultMessage: 'Filter for this {value}',
+    values: {
+      value: text as string,
+    },
+  });
+
+export const flyoutHoverActionFilterOutText = (text: unknown) =>
+  i18n.translate('xpack.logExplorer.flyoutDetail.value.hover.filterOut', {
+    defaultMessage: 'Filter out this {value}',
+    values: {
+      value: text as string,
+    },
+  });
+
+export const flyoutHoverActionFilterForFieldPresentText = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.value.hover.filterForFieldPresent',
+  {
+    defaultMessage: 'Filter for field present',
+  }
+);
+
+export const flyoutHoverActionToggleColumnText = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.value.hover.toggleColumn',
+  {
+    defaultMessage: 'Toggle column in table',
+  }
+);
+
+export const flyoutHoverActionCopyToClipboardText = i18n.translate(
+  'xpack.logExplorer.flyoutDetail.value.hover.copyToClipboard',
+  {
+    defaultMessage: 'Copy to clipboard',
+  }
+);
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/types.ts b/x-pack/plugins/log_explorer/public/components/flyout_detail/types.ts
index cf8cfb8170e218..28110024108dad 100644
--- a/x-pack/plugins/log_explorer/public/components/flyout_detail/types.ts
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/types.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import type { EuiIconType } from '@elastic/eui/src/components/icon/icon';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import type { FlyoutContentProps } from '@kbn/discover-plugin/public';
 import type { DataTableRecord } from '@kbn/discover-utils/types';
@@ -19,6 +18,21 @@ export interface LogDocument extends DataTableRecord {
     '@timestamp': string;
     'log.level'?: string;
     message?: string;
+
+    'host.name'?: string;
+    'service.name'?: string;
+    'trace.id'?: string;
+    'agent.name'?: string;
+    'orchestrator.cluster.name'?: string;
+    'orchestrator.resource.id'?: string;
+    'cloud.provider'?: string;
+    'cloud.region'?: string;
+    'cloud.availability_zone'?: string;
+    'cloud.project.id'?: string;
+    'cloud.instance.id'?: string;
+    'log.file.path'?: string;
+    'data_stream.namespace': string;
+    'data_stream.dataset': string;
   };
 }
 
@@ -26,10 +40,19 @@ export interface FlyoutDoc {
   '@timestamp': string;
   'log.level'?: string;
   message?: string;
-}
 
-export interface FlyoutHighlightField {
-  label: string;
-  value: string;
-  iconType?: EuiIconType;
+  'host.name'?: string;
+  'service.name'?: string;
+  'trace.id'?: string;
+  'agent.name'?: string;
+  'orchestrator.cluster.name'?: string;
+  'orchestrator.resource.id'?: string;
+  'cloud.provider'?: string;
+  'cloud.region'?: string;
+  'cloud.availability_zone'?: string;
+  'cloud.project.id'?: string;
+  'cloud.instance.id'?: string;
+  'log.file.path'?: string;
+  'data_stream.namespace': string;
+  'data_stream.dataset': string;
 }
diff --git a/x-pack/plugins/log_explorer/public/components/flyout_detail/use_doc_detail.ts b/x-pack/plugins/log_explorer/public/components/flyout_detail/use_doc_detail.ts
index 32e4bcd966745f..938855f00f5a30 100644
--- a/x-pack/plugins/log_explorer/public/components/flyout_detail/use_doc_detail.ts
+++ b/x-pack/plugins/log_explorer/public/components/flyout_detail/use_doc_detail.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 import { formatFieldValue } from '@kbn/discover-utils';
-import { LOG_LEVEL_FIELD, MESSAGE_FIELD, TIMESTAMP_FIELD } from '../../../common/constants';
+import he from 'he';
+import * as constants from '../../../common/constants';
 import { useKibanaContextForPlugin } from '../../utils/use_kibana';
 import { FlyoutDoc, FlyoutProps, LogDocument } from './types';
 
@@ -30,21 +31,59 @@ export function useDocDetail(
     );
   };
 
-  const level = formatField(LOG_LEVEL_FIELD)?.toLowerCase();
-  const timestamp = formatField(TIMESTAMP_FIELD);
-  const message = formatField(MESSAGE_FIELD);
+  // Flyout Headers
+  const level = formatField(constants.LOG_LEVEL_FIELD)?.toLowerCase();
+  const timestamp = formatField(constants.TIMESTAMP_FIELD);
+  const formattedMessage = formatField(constants.MESSAGE_FIELD);
+  const message = formattedMessage ? he.decode(formattedMessage) : undefined;
+
+  // Service Highlights
+  const serviceName = formatField(constants.SERVICE_NAME_FIELD);
+  const traceId = formatField(constants.TRACE_ID_FIELD);
+
+  // Infrastructure Highlights
+  const hostname = formatField(constants.HOST_NAME_FIELD);
+  const orchestratorClusterName = formatField(constants.ORCHESTRATOR_CLUSTER_NAME_FIELD);
+  const orchestratorResourceId = formatField(constants.ORCHESTRATOR_RESOURCE_ID_FIELD);
+
+  // Cloud Highlights
+  const cloudProvider = formatField(constants.CLOUD_PROVIDER_FIELD);
+  const cloudRegion = formatField(constants.CLOUD_REGION_FIELD);
+  const cloudAz = formatField(constants.CLOUD_AVAILABILITY_ZONE_FIELD);
+  const cloudProjectId = formatField(constants.CLOUD_PROJECT_ID_FIELD);
+  const cloudInstanceId = formatField(constants.CLOUD_INSTANCE_ID_FIELD);
+
+  // Other Highlights
+  const logFilePath = formatField(constants.LOG_FILE_PATH_FIELD);
+  const namespace = formatField(constants.DATASTREAM_NAMESPACE_FIELD);
+  const dataset = formatField(constants.DATASTREAM_DATASET_FIELD);
+  const agentName = formatField(constants.AGENT_NAME_FIELD);
 
   return {
-    [LOG_LEVEL_FIELD]: level,
-    [TIMESTAMP_FIELD]: timestamp,
-    [MESSAGE_FIELD]: message,
+    [constants.LOG_LEVEL_FIELD]: level,
+    [constants.TIMESTAMP_FIELD]: timestamp,
+    [constants.MESSAGE_FIELD]: message,
+    [constants.SERVICE_NAME_FIELD]: serviceName,
+    [constants.TRACE_ID_FIELD]: traceId,
+    [constants.HOST_NAME_FIELD]: hostname,
+    [constants.ORCHESTRATOR_CLUSTER_NAME_FIELD]: orchestratorClusterName,
+    [constants.ORCHESTRATOR_RESOURCE_ID_FIELD]: orchestratorResourceId,
+    [constants.CLOUD_PROVIDER_FIELD]: cloudProvider,
+    [constants.CLOUD_REGION_FIELD]: cloudRegion,
+    [constants.CLOUD_AVAILABILITY_ZONE_FIELD]: cloudAz,
+    [constants.CLOUD_PROJECT_ID_FIELD]: cloudProjectId,
+    [constants.CLOUD_INSTANCE_ID_FIELD]: cloudInstanceId,
+    [constants.LOG_FILE_PATH_FIELD]: logFilePath,
+    [constants.DATASTREAM_NAMESPACE_FIELD]: namespace,
+    [constants.DATASTREAM_DATASET_FIELD]: dataset,
+    [constants.AGENT_NAME_FIELD]: agentName,
   };
 }
 
-export const getDocDetailRenderFlags = (doc: FlyoutDoc) => {
-  const hasTimestamp = Boolean(doc['@timestamp']);
-  const hasLogLevel = Boolean(doc['log.level']);
-  const hasMessage = Boolean(doc.message);
+export const getDocDetailHeaderRenderFlags = (doc: FlyoutDoc) => {
+  const hasTimestamp = Boolean(doc[constants.TIMESTAMP_FIELD]);
+  const hasLogLevel = Boolean(doc[constants.LOG_LEVEL_FIELD]);
+  const hasMessage = Boolean(doc[constants.MESSAGE_FIELD]);
 
   const hasBadges = hasTimestamp || hasLogLevel;
 
diff --git a/x-pack/plugins/log_explorer/public/customizations/log_explorer_profile.tsx b/x-pack/plugins/log_explorer/public/customizations/log_explorer_profile.tsx
index 628ff40babc22e..bf3913dff5680d 100644
--- a/x-pack/plugins/log_explorer/public/customizations/log_explorer_profile.tsx
+++ b/x-pack/plugins/log_explorer/public/customizations/log_explorer_profile.tsx
@@ -4,18 +4,19 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import React from 'react';
 import type { CoreStart } from '@kbn/core/public';
 import { CustomizationCallback, DiscoverStateContainer } from '@kbn/discover-plugin/public';
-import React from 'react';
-import { type BehaviorSubject, combineLatest, from, map, Subscription } from 'rxjs';
+import { i18n } from '@kbn/i18n';
 import useObservable from 'react-use/lib/useObservable';
-import { dynamic } from '../utils/dynamic';
-import { LogExplorerProfileStateService } from '../state_machines/log_explorer_profile';
+import { combineLatest, from, map, Subscription, type BehaviorSubject } from 'rxjs';
 import { LogExplorerStateContainer } from '../components/log_explorer';
-import { LogExplorerStartDeps } from '../types';
-import { useKibanaContextForPluginProvider } from '../utils/use_kibana';
 import { LogExplorerCustomizations } from '../components/log_explorer/types';
 import { LogExplorerCustomizationsProvider } from '../hooks/use_log_explorer_customizations';
+import { LogExplorerProfileStateService } from '../state_machines/log_explorer_profile';
+import { LogExplorerStartDeps } from '../types';
+import { dynamic } from '../utils/dynamic';
+import { useKibanaContextForPluginProvider } from '../utils/use_kibana';
 
 const LazyCustomDatasetFilters = dynamic(() => import('./custom_dataset_filters'));
 const LazyCustomDatasetSelector = dynamic(() => import('./custom_dataset_selector'));
@@ -112,6 +113,9 @@ export const createLogExplorerProfileCustomizations =
         openItem: { disabled: true },
         saveItem: { disabled: true },
       },
+      defaultBadges: {
+        unsavedChangesBadge: { disabled: true },
+      },
     });
 
     /**
@@ -119,6 +123,9 @@ export const createLogExplorerProfileCustomizations =
      */
     customizations.set({
       id: 'flyout',
+      title: i18n.translate('xpack.logExplorer.flyoutDetail.title', {
+        defaultMessage: 'Log details',
+      }),
       actions: {
         defaultActions: {
           viewSingleDocument: { disabled: true },
diff --git a/x-pack/plugins/log_explorer/public/hooks/use_discover_action.ts b/x-pack/plugins/log_explorer/public/hooks/use_discover_action.ts
new file mode 100644
index 00000000000000..ef1a1ae715ca66
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/hooks/use_discover_action.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import createContainer from 'constate';
+import { FlyoutContentActions } from '@kbn/discover-plugin/public';
+
+interface UseFlyoutActionsDeps {
+  value: FlyoutContentActions;
+}
+
+const useDiscoverActions = ({ value }: UseFlyoutActionsDeps) => value;
+
+export const [DiscoverActionsProvider, useDiscoverActionsContext] =
+  createContainer(useDiscoverActions);
diff --git a/x-pack/plugins/log_explorer/public/hooks/use_flyouot_column_width.tsx b/x-pack/plugins/log_explorer/public/hooks/use_flyouot_column_width.tsx
new file mode 100644
index 00000000000000..53e626223b9105
--- /dev/null
+++ b/x-pack/plugins/log_explorer/public/hooks/use_flyouot_column_width.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useEuiTheme } from '@elastic/eui';
+
+interface FlyoutColumnWidth {
+  columns: 1 | 2 | 3;
+  fieldWidth: number;
+}
+
+export const useFlyoutColumnWidth = (width: number): FlyoutColumnWidth => {
+  const { euiTheme } = useEuiTheme();
+
+  const numberOfColumns = width > euiTheme.breakpoint.m ? 3 : width > euiTheme.breakpoint.s ? 2 : 1;
+  const widthFactor = numberOfColumns === 3 ? 2.5 : 2.2;
+  const fieldWidth = width / (numberOfColumns * widthFactor);
+
+  return {
+    columns: numberOfColumns,
+    fieldWidth,
+  };
+};
diff --git a/x-pack/plugins/log_explorer/server/index.ts b/x-pack/plugins/log_explorer/server/index.ts
index 634e4cfe02566e..38aab9b85065b5 100644
--- a/x-pack/plugins/log_explorer/server/index.ts
+++ b/x-pack/plugins/log_explorer/server/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
-import { LogExplorerServerPlugin } from './plugin';
-
-export const plugin = () => new LogExplorerServerPlugin();
+export const plugin = async () => {
+  const { LogExplorerServerPlugin } = await import('./plugin');
+  return new LogExplorerServerPlugin();
+};
diff --git a/x-pack/plugins/logs_shared/common/index.ts b/x-pack/plugins/logs_shared/common/index.ts
index 654e8e2e133351..99fd7c1166863d 100644
--- a/x-pack/plugins/logs_shared/common/index.ts
+++ b/x-pack/plugins/logs_shared/common/index.ts
@@ -44,6 +44,8 @@ export {
 // eslint-disable-next-line @kbn/eslint/no_export_all
 export * from './log_entry';
 
+export { convertISODateToNanoPrecision } from './utils';
+
 // Http types
 export type { LogEntriesSummaryBucket, LogEntriesSummaryHighlightsBucket } from './http_api';
 
diff --git a/x-pack/plugins/logs_shared/common/log_entry/log_entry.ts b/x-pack/plugins/logs_shared/common/log_entry/log_entry.ts
index b1fc80634a9221..24a04f4c2e38e7 100644
--- a/x-pack/plugins/logs_shared/common/log_entry/log_entry.ts
+++ b/x-pack/plugins/logs_shared/common/log_entry/log_entry.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { TimeKey } from '@kbn/io-ts-utils';
 import * as rt from 'io-ts';
-import { TimeKey } from '../time';
 import { jsonArrayRT } from '../typed_json';
 import { logEntryCursorRT } from './log_entry_cursor';
 
@@ -34,7 +34,7 @@ export type LogMessagePart = rt.TypeOf<typeof logMessagePartRT>;
  * columns
  */
 
-export const logTimestampColumnRT = rt.type({ columnId: rt.string, timestamp: rt.number });
+export const logTimestampColumnRT = rt.type({ columnId: rt.string, time: rt.string });
 export type LogTimestampColumn = rt.TypeOf<typeof logTimestampColumnRT>;
 
 export const logFieldColumnRT = rt.type({
diff --git a/x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts b/x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts
index 3cd69b4a6178c2..158d14152ad4aa 100644
--- a/x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts
+++ b/x-pack/plugins/logs_shared/common/log_entry/log_entry_cursor.ts
@@ -9,7 +9,7 @@ import * as rt from 'io-ts';
 import { decodeOrThrow } from '../runtime_types';
 
 export const logEntryCursorRT = rt.type({
-  time: rt.number,
+  time: rt.string,
   tiebreaker: rt.number,
 });
 export type LogEntryCursor = rt.TypeOf<typeof logEntryCursorRT>;
@@ -29,7 +29,7 @@ export const logEntryAroundCursorRT = rt.type({
 });
 export type LogEntryAroundCursor = rt.TypeOf<typeof logEntryAroundCursorRT>;
 
-export const getLogEntryCursorFromHit = (hit: { sort: [number, number] }) =>
+export const getLogEntryCursorFromHit = (hit: { sort: [string, number] }) =>
   decodeOrThrow(logEntryCursorRT)({
     time: hit.sort[0],
     tiebreaker: hit.sort[1],
diff --git a/x-pack/plugins/logs_shared/common/time/time_key.ts b/x-pack/plugins/logs_shared/common/time/time_key.ts
index 4c78158dd5bf64..1ff661af69d0af 100644
--- a/x-pack/plugins/logs_shared/common/time/time_key.ts
+++ b/x-pack/plugins/logs_shared/common/time/time_key.ts
@@ -5,26 +5,8 @@
  * 2.0.
  */
 
+import type { TimeKey } from '@kbn/io-ts-utils';
 import { ascending, bisector } from 'd3-array';
-import * as rt from 'io-ts';
-
-export const minimalTimeKeyRT = rt.type({
-  time: rt.number,
-  tiebreaker: rt.number,
-});
-
-export const timeKeyRT = rt.intersection([
-  minimalTimeKeyRT,
-  rt.partial({
-    gid: rt.string,
-    fromAutoReload: rt.boolean,
-  }),
-]);
-export type TimeKey = rt.TypeOf<typeof timeKeyRT>;
-
-export interface UniqueTimeKey extends TimeKey {
-  gid: string;
-}
 
 export type Comparator = (firstValue: any, secondValue: any) => number;
 
diff --git a/x-pack/plugins/logs_shared/common/utils/date_helpers.test.ts b/x-pack/plugins/logs_shared/common/utils/date_helpers.test.ts
new file mode 100644
index 00000000000000..fb04f644356112
--- /dev/null
+++ b/x-pack/plugins/logs_shared/common/utils/date_helpers.test.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { subtractMillisecondsFromDate } from './date_helpers';
+
+describe('Date Helpers', function () {
+  describe('subtractMillisecondsFromDate', function () {
+    it('should subtract milliseconds from the nano date correctly', () => {
+      const inputDate = '2023-10-30T12:00:00.001000000Z';
+      const millisecondsToSubtract = 1;
+
+      const result = subtractMillisecondsFromDate(inputDate, millisecondsToSubtract);
+
+      const expectedDate = '2023-10-30T12:00:00.000000000Z';
+
+      expect(result).toBe(expectedDate);
+    });
+
+    it('should subtract seconds from the date if no milliseconds available', () => {
+      const inputDate = '2023-10-30T12:00:00.000000000Z';
+      const millisecondsToSubtract = 1;
+
+      const result = subtractMillisecondsFromDate(inputDate, millisecondsToSubtract);
+
+      const expectedDate = '2023-10-30T11:59:59.999000000Z';
+
+      expect(result).toBe(expectedDate);
+    });
+
+    it('should convert date to nano and subtract milliseconds properly', () => {
+      const inputDate = '2023-10-30T12:00:00.000Z';
+      const millisecondsToSubtract = 1;
+
+      const result = subtractMillisecondsFromDate(inputDate, millisecondsToSubtract);
+
+      const expectedDate = '2023-10-30T11:59:59.999000000Z';
+
+      expect(result).toBe(expectedDate);
+    });
+  });
+});
diff --git a/x-pack/plugins/logs_shared/common/utils/date_helpers.ts b/x-pack/plugins/logs_shared/common/utils/date_helpers.ts
new file mode 100644
index 00000000000000..69af6c74110b56
--- /dev/null
+++ b/x-pack/plugins/logs_shared/common/utils/date_helpers.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import dateMath from '@kbn/datemath';
+
+export function convertISODateToNanoPrecision(date: string): string {
+  const dateParts = date.split('.');
+
+  const fractionSeconds = dateParts.length === 2 ? dateParts[1].replace('Z', '') : '';
+  const fractionSecondsInNanos =
+    fractionSeconds.length !== 9 ? fractionSeconds.padEnd(9, '0') : fractionSeconds;
+
+  return `${dateParts[0]}.${fractionSecondsInNanos}Z`;
+}
+
+export function subtractMillisecondsFromDate(date: string, milliseconds: number): string {
+  const dateInNano = convertISODateToNanoPrecision(date);
+
+  const dateParts = dateInNano.split('.');
+  const nanoPart = dateParts[1].substring(3, dateParts[1].length); // given 123456789Z => 456789Z
+
+  const isoDate = dateMath.parse(date)?.subtract(milliseconds, 'ms').toISOString();
+
+  return `${isoDate?.replace('Z', nanoPart)}`;
+}
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/index.ts b/x-pack/plugins/logs_shared/common/utils/index.ts
similarity index 85%
rename from x-pack/plugins/reporting/server/export_types/png_v2/index.ts
rename to x-pack/plugins/logs_shared/common/utils/index.ts
index 301395447f3c8a..ba1e5fcefd1a4c 100644
--- a/x-pack/plugins/reporting/server/export_types/png_v2/index.ts
+++ b/x-pack/plugins/logs_shared/common/utils/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { PngExportType } from './png_v2';
+export * from './date_helpers';
diff --git a/x-pack/plugins/logs_shared/public/components/formatted_time.tsx b/x-pack/plugins/logs_shared/public/components/formatted_time.tsx
index 6c7309d814af45..4b65436a670a6a 100644
--- a/x-pack/plugins/logs_shared/public/components/formatted_time.tsx
+++ b/x-pack/plugins/logs_shared/public/components/formatted_time.tsx
@@ -11,7 +11,7 @@ import { useMemo } from 'react';
 import { useKibanaUiSetting } from '../utils/use_kibana_ui_setting';
 
 const getFormattedTime = (
-  time: number,
+  time: string,
   userFormat: string | undefined,
   fallbackFormat: string = 'Y-MM-DD HH:mm:ss.SSS'
 ) => {
@@ -26,7 +26,7 @@ interface UseFormattedTimeOptions {
 }
 
 export const useFormattedTime = (
-  time: number,
+  time: string,
   { format = 'dateTime', fallbackFormat }: UseFormattedTimeOptions = {}
 ) => {
   // `dateFormat:scaled` is an array of `[key, format]` tuples.
diff --git a/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.stories.tsx b/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.stories.tsx
index 10561b24afb050..eeba1e0b448dd9 100644
--- a/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.stories.tsx
+++ b/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.stories.tsx
@@ -38,7 +38,7 @@ export const BasicDateRange = LogStreamStoryTemplate.bind({});
 
 export const CenteredOnLogEntry = LogStreamStoryTemplate.bind({});
 CenteredOnLogEntry.args = {
-  center: { time: 1595146275000, tiebreaker: 150 },
+  center: { time: '2020-07-19T08:11:15.000Z', tiebreaker: 150 },
 };
 
 export const HighlightedLogEntry = LogStreamStoryTemplate.bind({});
diff --git a/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.tsx b/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.tsx
index 50871650da2682..98be3f7567880c 100644
--- a/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.tsx
+++ b/x-pack/plugins/logs_shared/public/components/log_stream/log_stream.tsx
@@ -40,7 +40,7 @@ interface CommonColumnDefinition {
 interface TimestampColumnDefinition extends CommonColumnDefinition {
   type: 'timestamp';
   /** Timestamp renderer. Takes a epoch_millis and returns a valid `ReactNode` */
-  render?: (timestamp: number) => React.ReactNode;
+  render?: (timestamp: string) => React.ReactNode;
 }
 
 interface MessageColumnDefinition extends CommonColumnDefinition {
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_actions_menu.test.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_actions_menu.test.tsx
index 5a6639a1f22985..a6957524b2f97a 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_actions_menu.test.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_actions_menu.test.tsx
@@ -24,6 +24,7 @@ const ProviderWrapper: React.FC = ({ children }) => {
 };
 
 describe('LogEntryActionsMenu component', () => {
+  const time = new Date().toISOString();
   describe('uptime link', () => {
     it('renders with a host ip filter when present in log entry', () => {
       const elementWrapper = mount(
@@ -34,7 +35,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -64,7 +65,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -94,7 +95,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -128,7 +129,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -160,7 +161,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -194,7 +195,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -228,7 +229,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
@@ -258,7 +259,7 @@ describe('LogEntryActionsMenu component', () => {
               id: 'ITEM_ID',
               index: 'INDEX',
               cursor: {
-                time: 0,
+                time,
                 tiebreaker: 0,
               },
             }}
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_fields_table.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_fields_table.tsx
index 09b83818593547..dbde4085da289b 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_fields_table.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_fields_table.tsx
@@ -10,9 +10,9 @@ import { EuiBasicTableColumn, EuiInMemoryTable } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import * as rt from 'io-ts';
 import React, { useMemo } from 'react';
+import { TimeKey } from '@kbn/io-ts-utils';
 import { LogEntryField } from '../../../../common/log_entry';
 import { LogEntry } from '../../../../common/search_strategies/log_entries/log_entry';
-import { TimeKey } from '../../../../common/time';
 import { JsonScalar, jsonScalarRT } from '../../../../common/typed_json';
 import { FieldValue } from '../log_text_stream/field_value';
 
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_flyout.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_flyout.tsx
index b66e864c2a4990..99b89f0c1c432e 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_flyout.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_entry_flyout/log_entry_flyout.tsx
@@ -21,9 +21,9 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { createKibanaReactContext } from '@kbn/kibana-react-plugin/public';
 import React, { useCallback, useEffect, useRef } from 'react';
+import { TimeKey } from '@kbn/io-ts-utils';
 import { useKibanaContextForPlugin } from '../../../hooks/use_kibana';
 import { LogViewReference } from '../../../../common/log_views';
-import { TimeKey } from '../../../../common/time';
 import { useLogEntry } from '../../../containers/logs/log_entry';
 import { CenteredEuiFlyoutBody } from '../../centered_flyout_body';
 import { DataSearchErrorCallout } from '../../data_search_error_callout';
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/column_headers.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/column_headers.tsx
index 3fd275ea56dc23..a1b1cbf8fe7705 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/column_headers.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/column_headers.tsx
@@ -41,7 +41,7 @@ export const LogColumnHeaders: React.FunctionComponent<{
             columnHeader = columnConfiguration.timestampColumn.header;
           } else {
             columnHeader = firstVisiblePosition
-              ? localizedDate(firstVisiblePosition.time)
+              ? localizedDate(new Date(firstVisiblePosition.time))
               : i18n.translate('xpack.logsShared.logs.stream.timestampColumnTitle', {
                   defaultMessage: 'Timestamp',
                 });
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/item.ts b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/item.ts
index d6dc5fdbef4f6e..86e2baa9d6f93c 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/item.ts
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/item.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
+import type { TimeKey } from '@kbn/io-ts-utils';
 import { bisector } from 'd3-array';
-import { compareToTimeKey, TimeKey } from '../../../../common/time';
 import { LogEntry } from '../../../../common/log_entry';
+import { compareToTimeKey } from '../../../../common/time';
 
 export type StreamItem = LogEntryStreamItem;
 
@@ -27,17 +28,17 @@ export function getStreamItemTimeKey(item: StreamItem) {
 export function getStreamItemId(item: StreamItem) {
   switch (item.kind) {
     case 'logEntry':
-      return `${item.logEntry.cursor.time}:${item.logEntry.cursor.tiebreaker}:${item.logEntry.id}`;
+      return `${item.logEntry.cursor.time}/${item.logEntry.cursor.tiebreaker}/${item.logEntry.id}`;
   }
 }
 
 export function parseStreamItemId(id: string) {
-  const idFragments = id.split(':');
+  const idFragments = id.split('/');
 
   return {
     gid: idFragments.slice(2).join(':'),
     tiebreaker: parseInt(idFragments[1], 10),
-    time: parseInt(idFragments[0], 10),
+    time: idFragments[0],
   };
 }
 
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_date_row.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_date_row.tsx
index cd499b3ae3425c..9bc6e29429ce5f 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_date_row.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_date_row.tsx
@@ -10,14 +10,14 @@ import { EuiFlexGroup, EuiFlexItem, EuiHorizontalRule, EuiTitle } from '@elastic
 import { localizedDate } from '../../../../common/formatters/datetime';
 
 interface LogDateRowProps {
-  timestamp: number;
+  time: string;
 }
 
 /**
  * Show a row with the date in the log stream
  */
-export const LogDateRow: React.FC<LogDateRowProps> = ({ timestamp }) => {
-  const formattedDate = localizedDate(timestamp);
+export const LogDateRow: React.FC<LogDateRowProps> = ({ time }) => {
+  const formattedDate = localizedDate(new Date(time));
 
   return (
     <EuiFlexGroup alignItems="center" gutterSize="s">
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_column.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_column.tsx
index 81d6a43254ecb3..7df56fb79c3205 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_column.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_column.tsx
@@ -8,6 +8,7 @@
 import { useMemo } from 'react';
 
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
+import moment from 'moment';
 import { TextScale } from '../../../../common/log_text_scale';
 import {
   LogColumnRenderConfiguration,
@@ -142,7 +143,7 @@ export const useColumnWidths = ({
   timeFormat?: TimeFormat;
 }) => {
   const { CharacterDimensionsProbe, dimensions } = useMeasuredCharacterDimensions(scale);
-  const referenceTime = useMemo(() => Date.now(), []);
+  const referenceTime = useMemo(() => moment().toISOString(), []);
   const formattedCurrentDate = useFormattedTime(referenceTime, { format: timeFormat });
   const columnWidths = useMemo(
     () => getColumnWidths(columnConfigurations, dimensions.width, formattedCurrentDate.length),
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_row.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_row.tsx
index 5b100c4df4beba..b73da833032f48 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_row.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_row.tsx
@@ -189,7 +189,7 @@ export const LogEntryRow = memo(
               >
                 {isTimestampColumn(column) ? (
                   <LogEntryTimestampColumn
-                    time={column.timestamp}
+                    time={column.time}
                     render={columnConfiguration.timestampColumn.render}
                   />
                 ) : null}
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_timestamp_column.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_timestamp_column.tsx
index 22a94f05ea2658..0b145503ddf54c 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_timestamp_column.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/log_entry_timestamp_column.tsx
@@ -13,8 +13,8 @@ import { LogEntryColumnContent } from './log_entry_column';
 
 interface LogEntryTimestampColumnProps {
   format?: TimeFormat;
-  time: number;
-  render?: (timestamp: number) => React.ReactNode;
+  time: string;
+  render?: (time: string) => React.ReactNode;
 }
 
 export const LogEntryTimestampColumn = memo<LogEntryTimestampColumnProps>(
diff --git a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
index c92347ce8c0bdb..feae9b8b21d8a3 100644
--- a/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
+++ b/x-pack/plugins/logs_shared/public/components/logging/log_text_stream/scrollable_log_text_stream_view.tsx
@@ -9,10 +9,9 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import React, { Fragment, GetDerivedStateFromProps } from 'react';
 import moment from 'moment';
-
 import { euiStyled } from '@kbn/kibana-react-plugin/common';
+import { TimeKey, UniqueTimeKey } from '@kbn/io-ts-utils';
 import { TextScale } from '../../../../common/log_text_scale';
-import { TimeKey, UniqueTimeKey } from '../../../../common/time';
 import { callWithoutRepeats } from '../../../utils/handlers';
 import { AutoSizer } from '../../auto_sizer';
 import { NoData } from '../../empty_states';
@@ -216,7 +215,7 @@ export class ScrollableLogTextStreamView extends React.PureComponent<
                                 position="start"
                                 isLoading={isLoadingMore}
                                 hasMore={hasMoreBeforeStart}
-                                timestamp={items[0].logEntry.cursor.time}
+                                timestamp={moment(items[0].logEntry.cursor.time).valueOf()}
                                 isStreaming={false}
                                 startDateExpression={startDateExpression}
                                 endDateExpression={endDateExpression}
@@ -225,17 +224,17 @@ export class ScrollableLogTextStreamView extends React.PureComponent<
                                 }
                               />
                               {items.map((item, idx) => {
-                                const currentTimestamp = item.logEntry.cursor.time;
+                                const currentTime = item.logEntry.cursor.time;
                                 let showDate = false;
 
                                 if (idx > 0) {
-                                  const prevTimestamp = items[idx - 1].logEntry.cursor.time;
-                                  showDate = !moment(currentTimestamp).isSame(prevTimestamp, 'day');
+                                  const prevTime = items[idx - 1].logEntry.cursor.time;
+                                  showDate = !moment(currentTime).isSame(prevTime, 'day');
                                 }
 
                                 return (
                                   <Fragment key={getStreamItemId(item)}>
-                                    {showDate && <LogDateRow timestamp={currentTimestamp} />}
+                                    {showDate && <LogDateRow time={currentTime} />}
                                     <MeasurableItemView
                                       register={registerChild}
                                       registrationKey={getStreamItemId(item)}
@@ -279,8 +278,8 @@ export class ScrollableLogTextStreamView extends React.PureComponent<
                                 isStreaming={isStreaming}
                                 timestamp={
                                   isStreaming && lastLoadedTime
-                                    ? lastLoadedTime.valueOf()
-                                    : items[items.length - 1].logEntry.cursor.time
+                                    ? lastLoadedTime.getTime()
+                                    : moment(items[items.length - 1].logEntry.cursor.time).valueOf()
                                 }
                                 startDateExpression={startDateExpression}
                                 endDateExpression={endDateExpression}
diff --git a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_entry_highlights.tsx b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_entry_highlights.tsx
index 6e13ff542add6d..117a78d6195961 100644
--- a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_entry_highlights.tsx
+++ b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_entry_highlights.tsx
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
+import { TimeKey } from '@kbn/io-ts-utils';
 import { useEffect, useMemo, useState } from 'react';
 import { LogViewReference } from '../../../../common';
 import { LogEntriesHighlightsResponse } from '../../../../common/http_api';
 import { LogEntry } from '../../../../common/log_entry';
-import { TimeKey } from '../../../../common/time';
 import { useKibanaContextForPlugin } from '../../../hooks/use_kibana';
 import { useTrackedPromise } from '../../../utils/use_tracked_promise';
 import { fetchLogEntriesHighlights } from './api/fetch_log_entries_highlights';
diff --git a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_highlights.tsx b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_highlights.tsx
index aa963925d7ac92..3317f02d034d35 100644
--- a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_highlights.tsx
+++ b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/log_highlights.tsx
@@ -8,12 +8,11 @@
 import createContainer from 'constate';
 import { useState } from 'react';
 import useThrottle from 'react-use/lib/useThrottle';
-
+import { TimeKey } from '@kbn/io-ts-utils';
 import { LogViewReference } from '../../../../common';
 import { useLogEntryHighlights } from './log_entry_highlights';
 import { useLogSummaryHighlights } from './log_summary_highlights';
 import { useNextAndPrevious } from './next_and_previous';
-import { TimeKey } from '../../../../common/time';
 import { useLogPositionStateContext } from '../log_position';
 
 const FETCH_THROTTLE_INTERVAL = 3000;
diff --git a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/next_and_previous.tsx b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/next_and_previous.tsx
index 784eb972ed11d1..c76d66711b9282 100644
--- a/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/next_and_previous.tsx
+++ b/x-pack/plugins/logs_shared/public/containers/logs/log_highlights/next_and_previous.tsx
@@ -7,8 +7,7 @@
 
 import { isNumber } from 'lodash';
 import { useCallback, useEffect, useMemo, useState } from 'react';
-
-import { TimeKey, UniqueTimeKey } from '../../../../common/time';
+import { TimeKey, UniqueTimeKey } from '@kbn/io-ts-utils';
 import {
   getLogEntryIndexAtTime,
   getLogEntryIndexBeforeTime,
diff --git a/x-pack/plugins/logs_shared/public/containers/logs/log_position/use_log_position.ts b/x-pack/plugins/logs_shared/public/containers/logs/log_position/use_log_position.ts
index 236e59093d450f..cadc692ee93fe3 100644
--- a/x-pack/plugins/logs_shared/public/containers/logs/log_position/use_log_position.ts
+++ b/x-pack/plugins/logs_shared/public/containers/logs/log_position/use_log_position.ts
@@ -6,10 +6,10 @@
  */
 
 import { TimeRange } from '@kbn/es-query';
+import { TimeKey } from '@kbn/io-ts-utils';
 import createContainer from 'constate';
 import { useMemo } from 'react';
 import { ActorRefWithDeprecatedState } from 'xstate';
-import { TimeKey } from '../../../../common/time';
 import {
   MatchedStateFromActor,
   OmitDeprecatedState,
@@ -52,7 +52,7 @@ export type LogPositionStateParams = DateRange & {
 
 export interface LogPositionCallbacks {
   jumpToTargetPosition: (pos: TimeKeyOrNull) => void;
-  jumpToTargetPositionTime: (time: number) => void;
+  jumpToTargetPositionTime: (time: string) => void;
   reportVisiblePositions: (visPos: VisiblePositions) => void;
   startLiveStreaming: () => void;
   stopLiveStreaming: () => void;
@@ -62,7 +62,7 @@ export interface LogPositionCallbacks {
 export interface LogStreamPageCallbacks {
   updateTimeRange: (timeRange: Partial<TimeRange>) => void;
   jumpToTargetPosition: (targetPosition: TimeKey | null) => void;
-  jumpToTargetPositionTime: (time: number) => void;
+  jumpToTargetPositionTime: (time: string) => void;
   reportVisiblePositions: (visiblePositions: VisiblePositions) => void;
   startLiveStreaming: () => void;
   stopLiveStreaming: () => void;
diff --git a/x-pack/plugins/logs_shared/public/containers/logs/log_stream/use_fetch_log_entries_around.ts b/x-pack/plugins/logs_shared/public/containers/logs/log_stream/use_fetch_log_entries_around.ts
index a6bd8ba7942888..6dd2566392ee04 100644
--- a/x-pack/plugins/logs_shared/public/containers/logs/log_stream/use_fetch_log_entries_around.ts
+++ b/x-pack/plugins/logs_shared/public/containers/logs/log_stream/use_fetch_log_entries_around.ts
@@ -8,6 +8,7 @@
 import { useCallback } from 'react';
 import { combineLatest, Observable, ReplaySubject } from 'rxjs';
 import { last, map, startWith, switchMap } from 'rxjs/operators';
+import { subtractMillisecondsFromDate } from '../../../../common/utils';
 import { LogEntryCursor } from '../../../../common/log_entry';
 import { LogViewColumnConfiguration, LogViewReference } from '../../../../common/log_views';
 import { LogEntriesSearchRequestQuery } from '../../../../common/search_strategies/log_entries/log_entries';
@@ -73,7 +74,7 @@ export const useFetchLogEntriesAround = ({
         last(), // in the future we could start earlier if we receive partial results already
         map((lastBeforeSearchResponse) => {
           const cursorAfter = lastBeforeSearchResponse.response.data?.bottomCursor ?? {
-            time: cursor.time - 1,
+            time: subtractMillisecondsFromDate(cursor.time, 1),
             tiebreaker: 0,
           };
 
diff --git a/x-pack/plugins/logs_shared/public/test_utils/entries.ts b/x-pack/plugins/logs_shared/public/test_utils/entries.ts
index 4dc3732fd49d5d..5277f49b1175e4 100644
--- a/x-pack/plugins/logs_shared/public/test_utils/entries.ts
+++ b/x-pack/plugins/logs_shared/public/test_utils/entries.ts
@@ -27,14 +27,16 @@ export function generateFakeEntries(
   const timestampStep = Math.floor((endTimestamp - startTimestamp) / count);
   for (let i = 0; i < count; i++) {
     const timestamp = i === count - 1 ? endTimestamp : startTimestamp + timestampStep * i;
+    const date = new Date(timestamp).toISOString();
+
     entries.push({
       id: `entry-${i}`,
       index: 'logs-fake',
       context: {},
-      cursor: { time: timestamp, tiebreaker: i },
+      cursor: { time: date, tiebreaker: i },
       columns: columns.map((column) => {
         if ('timestampColumn' in column) {
-          return { columnId: column.timestampColumn.id, timestamp };
+          return { columnId: column.timestampColumn.id, time: date };
         } else if ('messageColumn' in column) {
           return {
             columnId: column.messageColumn.id,
diff --git a/x-pack/plugins/logs_shared/public/utils/log_column_render_configuration.tsx b/x-pack/plugins/logs_shared/public/utils/log_column_render_configuration.tsx
index ff4a24f1498a6a..a1b23c9a0e3dde 100644
--- a/x-pack/plugins/logs_shared/public/utils/log_column_render_configuration.tsx
+++ b/x-pack/plugins/logs_shared/public/utils/log_column_render_configuration.tsx
@@ -19,7 +19,7 @@ interface CommonRenderConfiguration {
 
 interface TimestampColumnRenderConfiguration {
   timestampColumn: CommonRenderConfiguration & {
-    render?: (timestamp: number) => ReactNode;
+    render?: (time: string) => ReactNode;
   };
 }
 
diff --git a/x-pack/plugins/logs_shared/public/utils/log_entry/log_entry.ts b/x-pack/plugins/logs_shared/public/utils/log_entry/log_entry.ts
index 18d118750fdebf..e1027aeeb57996 100644
--- a/x-pack/plugins/logs_shared/public/utils/log_entry/log_entry.ts
+++ b/x-pack/plugins/logs_shared/public/utils/log_entry/log_entry.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
+import type { TimeKey, UniqueTimeKey } from '@kbn/io-ts-utils';
 import { bisector } from 'd3-array';
-import { compareToTimeKey, getIndexAtTimeKey, TimeKey, UniqueTimeKey } from '../../../common/time';
+import { compareToTimeKey, getIndexAtTimeKey } from '../../../common/time';
 import {
   LogEntry,
   LogColumn,
@@ -38,7 +39,7 @@ export const getLogEntryAtTime = (entries: LogEntry[], time: TimeKey) => {
 };
 
 export const isTimestampColumn = (column: LogColumn): column is LogTimestampColumn =>
-  column != null && 'timestamp' in column;
+  column != null && 'time' in column;
 
 export const isMessageColumn = (column: LogColumn): column is LogMessageColumn =>
   column != null && 'message' in column;
diff --git a/x-pack/plugins/logs_shared/server/index.ts b/x-pack/plugins/logs_shared/server/index.ts
index 1a894ddb52abdb..efc7da6a9d326e 100644
--- a/x-pack/plugins/logs_shared/server/index.ts
+++ b/x-pack/plugins/logs_shared/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { LogsSharedPlugin } from './plugin';
 
 export type { LogsSharedPluginSetup, LogsSharedPluginStart } from './types';
 export type {
@@ -17,6 +16,7 @@ export type {
 export { config } from './config';
 export { logViewSavedObjectName } from './saved_objects';
 
-export function plugin(context: PluginInitializerContext) {
+export async function plugin(context: PluginInitializerContext) {
+  const { LogsSharedPlugin } = await import('./plugin');
   return new LogsSharedPlugin(context);
 }
diff --git a/x-pack/plugins/logs_shared/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts b/x-pack/plugins/logs_shared/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
index 66de5699cfb3e5..e4eed9b61d3499 100644
--- a/x-pack/plugins/logs_shared/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
+++ b/x-pack/plugins/logs_shared/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
@@ -62,7 +62,11 @@ export class LogsSharedKibanaLogEntriesAdapter implements LogEntriesAdapter {
       : {};
 
     const sort = {
-      [TIMESTAMP_FIELD]: sortDirection,
+      [TIMESTAMP_FIELD]: {
+        order: sortDirection,
+        format: 'strict_date_optional_time_nanos',
+        numeric_type: 'date_nanos',
+      },
       [TIEBREAKER_FIELD]: sortDirection,
     };
 
@@ -155,7 +159,16 @@ export class LogsSharedKibanaLogEntriesAdapter implements LogEntriesAdapter {
               top_hits_by_key: {
                 top_hits: {
                   size: 1,
-                  sort: [{ [TIMESTAMP_FIELD]: 'asc' }, { [TIEBREAKER_FIELD]: 'asc' }],
+                  sort: [
+                    {
+                      [TIMESTAMP_FIELD]: {
+                        order: 'asc',
+                        format: 'strict_date_optional_time_nanos',
+                        numeric_type: 'date_nanos',
+                      },
+                    },
+                    { [TIEBREAKER_FIELD]: 'asc' },
+                  ],
                   _source: false,
                 },
               },
@@ -265,7 +278,7 @@ const createQueryFilterClauses = (filterQuery: LogEntryQuery | undefined) =>
 
 function processCursor(cursor: LogEntriesParams['cursor']): {
   sortDirection: 'asc' | 'desc';
-  searchAfterClause: { search_after?: readonly [number, number] };
+  searchAfterClause: { search_after?: readonly [string, number] };
 } {
   if (cursor) {
     if ('before' in cursor) {
@@ -295,7 +308,7 @@ const LogSummaryDateRangeBucketRuntimeType = runtimeTypes.intersection([
       hits: runtimeTypes.type({
         hits: runtimeTypes.array(
           runtimeTypes.type({
-            sort: runtimeTypes.tuple([runtimeTypes.number, runtimeTypes.number]),
+            sort: runtimeTypes.tuple([runtimeTypes.string, runtimeTypes.number]),
           })
         ),
       }),
diff --git a/x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts b/x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts
index 92829c676b9358..2601167f2d988a 100644
--- a/x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts
+++ b/x-pack/plugins/logs_shared/server/lib/domains/log_entries_domain/log_entries_domain.ts
@@ -7,6 +7,7 @@
 
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { JsonObject } from '@kbn/utility-types';
+import { subtractMillisecondsFromDate } from '../../../../common/utils';
 import {
   LogEntriesSummaryBucket,
   LogEntriesSummaryHighlightsBucket,
@@ -147,7 +148,7 @@ export class LogsSharedLogEntriesDomain implements ILogsSharedLogEntriesDomain {
     const cursorAfter =
       entriesBefore.length > 0
         ? entriesBefore[entriesBefore.length - 1].cursor
-        : { time: center.time - 1, tiebreaker: 0 };
+        : { time: subtractMillisecondsFromDate(center.time, 1), tiebreaker: 0 };
 
     const { entries: entriesAfter, hasMoreAfter } = await this.getLogEntries(
       requestContext,
@@ -200,7 +201,7 @@ export class LogsSharedLogEntriesDomain implements ILogsSharedLogEntriesDomain {
           if ('timestampColumn' in column) {
             return {
               columnId: column.timestampColumn.id,
-              timestamp: doc.cursor.time,
+              time: doc.cursor.time,
             };
           } else if ('messageColumn' in column) {
             return {
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.test.ts b/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.test.ts
index 305f6292deb28f..177e6091dc06b7 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.test.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.test.ts
@@ -95,6 +95,7 @@ describe('LogEntries search strategy', () => {
   });
 
   it('handles subsequent polling requests', async () => {
+    const date = new Date(1605116827143).toISOString();
     const esSearchStrategyMock = createEsSearchStrategyMock({
       id: 'ASYNC_REQUEST_ID',
       isRunning: false,
@@ -112,12 +113,12 @@ describe('LogEntries search strategy', () => {
               _score: 0,
               _source: null,
               fields: {
-                '@timestamp': [1605116827143],
+                '@timestamp': [date],
                 'event.dataset': ['HIT_DATASET'],
                 message: ['HIT_MESSAGE'],
                 'container.id': ['HIT_CONTAINER_ID'],
               },
-              sort: [1605116827143 as any, 1 as any], // incorrectly typed as string upstream
+              sort: [date as any, 1 as any], // incorrectly typed as string upstream
             },
           ],
         },
@@ -164,13 +165,13 @@ describe('LogEntries search strategy', () => {
         id: 'HIT_ID',
         index: 'HIT_INDEX',
         cursor: {
-          time: 1605116827143,
+          time: date,
           tiebreaker: 1,
         },
         columns: [
           {
             columnId: 'TIMESTAMP_COLUMN_ID',
-            timestamp: 1605116827143,
+            time: date,
           },
           {
             columnId: 'DATASET_COLUMN_ID',
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.ts b/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.ts
index f0f5c6304d6150..fb305d9ae73e46 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/log_entries_search_strategy.ts
@@ -190,7 +190,7 @@ const getLogEntryFromHit =
         if ('timestampColumn' in column) {
           return {
             columnId: column.timestampColumn.id,
-            timestamp: cursor.time,
+            time: cursor.time,
           };
         } else if ('messageColumn' in column) {
           return {
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/log_entry_search_strategy.test.ts b/x-pack/plugins/logs_shared/server/services/log_entries/log_entry_search_strategy.test.ts
index 19d53451223742..a123536d5bb277 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/log_entry_search_strategy.test.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/log_entry_search_strategy.test.ts
@@ -99,6 +99,7 @@ describe('LogEntry search strategy', () => {
   });
 
   it('handles subsequent polling requests', async () => {
+    const date = new Date(1605116827143).toISOString();
     const esSearchStrategyMock = createEsSearchStrategyMock({
       id: 'ASYNC_REQUEST_ID',
       isRunning: false,
@@ -116,10 +117,10 @@ describe('LogEntry search strategy', () => {
               _score: 0,
               _source: null,
               fields: {
-                '@timestamp': [1605116827143],
+                '@timestamp': [date],
                 message: ['HIT_MESSAGE'],
               },
-              sort: [1605116827143 as any, 1 as any], // incorrectly typed as string upstream
+              sort: [date as any, 1 as any], // incorrectly typed as string upstream
             },
           ],
         },
@@ -163,11 +164,11 @@ describe('LogEntry search strategy', () => {
       id: 'HIT_ID',
       index: 'HIT_INDEX',
       cursor: {
-        time: 1605116827143,
+        time: date,
         tiebreaker: 1,
       },
       fields: [
-        { field: '@timestamp', value: [1605116827143] },
+        { field: '@timestamp', value: [date] },
         { field: 'message', value: ['HIT_MESSAGE'] },
       ],
     });
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/queries/common.ts b/x-pack/plugins/logs_shared/server/services/log_entries/queries/common.ts
index 296ac9e4d2f34a..c40e2fb9418f24 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/queries/common.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/queries/common.ts
@@ -11,7 +11,11 @@ export const createSortClause = (
   tiebreakerField: string
 ) => ({
   sort: {
-    [timestampField]: sortDirection,
+    [timestampField]: {
+      order: sortDirection,
+      format: 'strict_date_optional_time_nanos',
+      numeric_type: 'date_nanos',
+    },
     [tiebreakerField]: sortDirection,
   },
 });
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entries.ts b/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entries.ts
index 18ee4b01043664..18992448fdfcc7 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entries.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entries.ts
@@ -68,7 +68,7 @@ export const getSortDirection = (
 
 const createSearchAfterClause = (
   cursor: LogEntryBeforeCursor | LogEntryAfterCursor | null | undefined
-): { search_after?: [number, number] } => {
+): { search_after?: [string, number] } => {
   if (logEntryBeforeCursorRT.is(cursor) && cursor.before !== 'last') {
     return {
       search_after: [cursor.before.time, cursor.before.tiebreaker],
@@ -122,7 +122,7 @@ const createHighlightQuery = (
 export const logEntryHitRT = rt.intersection([
   commonHitFieldsRT,
   rt.type({
-    sort: rt.tuple([rt.number, rt.number]),
+    sort: rt.tuple([rt.string, rt.number]),
   }),
   rt.partial({
     fields: rt.record(rt.string, jsonArrayRT),
diff --git a/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entry.ts b/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entry.ts
index 57a644c79f01f9..575541f3f7931a 100644
--- a/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entry.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_entries/queries/log_entry.ts
@@ -33,7 +33,16 @@ export const createGetLogEntryQuery = (
     },
     fields: ['*'],
     runtime_mappings: runtimeMappings,
-    sort: [{ [timestampField]: 'desc' }, { [tiebreakerField]: 'desc' }],
+    sort: [
+      {
+        [timestampField]: {
+          order: 'desc',
+          format: 'strict_date_optional_time_nanos',
+          numeric_type: 'date_nanos',
+        },
+      },
+      { [tiebreakerField]: 'desc' },
+    ],
     _source: false,
   },
 });
@@ -41,7 +50,7 @@ export const createGetLogEntryQuery = (
 export const logEntryHitRT = rt.intersection([
   commonHitFieldsRT,
   rt.type({
-    sort: rt.tuple([rt.number, rt.number]),
+    sort: rt.tuple([rt.string, rt.number]),
   }),
   rt.partial({
     fields: rt.record(rt.string, jsonArrayRT),
diff --git a/x-pack/plugins/logs_shared/server/services/log_views/log_views_client.test.ts b/x-pack/plugins/logs_shared/server/services/log_views/log_views_client.test.ts
index 125167d6deea83..e50d08c630eb7f 100644
--- a/x-pack/plugins/logs_shared/server/services/log_views/log_views_client.test.ts
+++ b/x-pack/plugins/logs_shared/server/services/log_views/log_views_client.test.ts
@@ -249,6 +249,7 @@ describe('LogViewsClient class', () => {
           },
         ],
         "dataViewReference": DataView {
+          "allowHidden": false,
           "allowNoIndex": false,
           "deleteFieldFormat": [Function],
           "deleteScriptedFieldInternal": [Function],
@@ -274,6 +275,7 @@ describe('LogViewsClient class', () => {
           },
           "fields": FldList [],
           "flattenHit": [Function],
+          "getAllowHidden": [Function],
           "getFieldAttrs": [Function],
           "getIndexPattern": [Function],
           "getName": [Function],
@@ -298,6 +300,7 @@ describe('LogViewsClient class', () => {
             },
           },
           "scriptedFields": Array [],
+          "setAllowHidden": [Function],
           "setFieldFormat": [Function],
           "setIndexPattern": [Function],
           "shortDotsEnable": false,
diff --git a/x-pack/plugins/logstash/server/index.ts b/x-pack/plugins/logstash/server/index.ts
index 3e89eeb9b57955..530ff1b7d54527 100644
--- a/x-pack/plugins/logstash/server/index.ts
+++ b/x-pack/plugins/logstash/server/index.ts
@@ -6,6 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { LogstashPlugin } from './plugin';
 
-export const plugin = (context: PluginInitializerContext) => new LogstashPlugin(context);
+export const plugin = async (context: PluginInitializerContext) => {
+  const { LogstashPlugin } = await import('./plugin');
+  return new LogstashPlugin(context);
+};
diff --git a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
index 6dd28fd0e3683f..aa4c30fc1cb405 100644
--- a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
@@ -123,5 +123,5 @@ export type DataRequestDescriptor = {
   dataRequestToken?: symbol;
   data?: object;
   dataRequestMeta?: DataRequestMeta;
-  error?: string;
+  error?: Error;
 };
diff --git a/x-pack/plugins/maps/public/_main.scss b/x-pack/plugins/maps/public/_main.scss
index 61de65dd4bf6f0..02298872d4f7d4 100644
--- a/x-pack/plugins/maps/public/_main.scss
+++ b/x-pack/plugins/maps/public/_main.scss
@@ -10,6 +10,11 @@
   overflow: hidden;
 }
 
+.mapFullScreen {
+  // sass-lint:disable no-important
+  height: 100vh !important;
+}
+
 #react-maps-root {
   flex-grow: 1;
   display: flex;
diff --git a/x-pack/plugins/maps/public/actions/data_request_actions.ts b/x-pack/plugins/maps/public/actions/data_request_actions.ts
index 78803c34702277..c700859787cbe0 100644
--- a/x-pack/plugins/maps/public/actions/data_request_actions.ts
+++ b/x-pack/plugins/maps/public/actions/data_request_actions.ts
@@ -62,7 +62,7 @@ export type DataRequestContext = {
     data: object,
     resultsMeta?: DataRequestMeta
   ): void;
-  onLoadError(dataId: string, requestToken: symbol, errorMessage: string): void;
+  onLoadError(dataId: string, requestToken: symbol, error: Error): void;
   setJoinError(joinIndex: number, errorMessage?: string): void;
   updateSourceData(newData: object): void;
   isRequestStillActive(dataId: string, requestToken: symbol): boolean;
@@ -132,8 +132,8 @@ function getDataRequestContext(
       dispatch(startDataLoad(layerId, dataId, requestToken, meta)),
     stopLoading: (dataId: string, requestToken: symbol, data: object, meta: DataRequestMeta) =>
       dispatch(endDataLoad(layerId, dataId, requestToken, data, meta)),
-    onLoadError: (dataId: string, requestToken: symbol, errorMessage: string) =>
-      dispatch(onDataLoadError(layerId, dataId, requestToken, errorMessage)),
+    onLoadError: (dataId: string, requestToken: symbol, error: Error) =>
+      dispatch(onDataLoadError(layerId, dataId, requestToken, error)),
     setJoinError: (joinIndex: number, errorMessage?: string) => {
       dispatch(setJoinError(layerId, joinIndex, errorMessage));
     },
@@ -312,12 +312,7 @@ function endDataLoad(
   };
 }
 
-function onDataLoadError(
-  layerId: string,
-  dataId: string,
-  requestToken: symbol,
-  errorMessage: string
-) {
+function onDataLoadError(layerId: string, dataId: string, requestToken: symbol, error: Error) {
   return async (
     dispatch: ThunkDispatch<MapStoreState, void, AnyAction>,
     getState: () => MapStoreState
@@ -329,7 +324,7 @@ function onDataLoadError(
       eventHandlers.onDataLoadError({
         layerId,
         dataId,
-        errorMessage,
+        errorMessage: error.message,
       });
     }
 
@@ -337,7 +332,7 @@ function onDataLoadError(
       type: LAYER_DATA_LOAD_ERROR,
       layerId,
       dataId,
-      errorMessage,
+      error,
       requestToken,
     });
   };
diff --git a/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts b/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
index 9edbabe2905dad..96fda4a4ec54f1 100644
--- a/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
+++ b/x-pack/plugins/maps/public/classes/layers/__fixtures__/mock_sync_context.ts
@@ -13,7 +13,7 @@ import { DataRequestMeta, DataFilters } from '../../../../common/descriptor_type
 export class MockSyncContext implements DataRequestContext {
   dataFilters: DataFilters;
   isRequestStillActive: (dataId: string, requestToken: symbol) => boolean;
-  onLoadError: (dataId: string, requestToken: symbol, errorMessage: string) => void;
+  onLoadError: (dataId: string, requestToken: symbol, error: Error) => void;
   registerCancelCallback: (requestToken: symbol, callback: () => void) => void;
   startLoading: (dataId: string, requestToken: symbol, meta: DataRequestMeta) => void;
   stopLoading: (dataId: string, requestToken: symbol, data: object, meta: DataRequestMeta) => void;
diff --git a/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.test.ts b/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.test.ts
index 557fac4c25bf38..f5de54be723753 100644
--- a/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.test.ts
+++ b/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.test.ts
@@ -43,8 +43,8 @@ describe('EmsVectorTileLayer', () => {
       startLoading: (requestId: string, token: string, meta: unknown) => {
         actualMeta = meta;
       },
-      onLoadError: (requestId: string, token: string, message: string) => {
-        actualErrorMessage = message;
+      onLoadError: (requestId: string, token: string, error: Error) => {
+        actualErrorMessage = error.message;
       },
       dataFilters: { foo: 'bar' } as unknown as DataFilters,
     } as unknown as DataRequestContext;
diff --git a/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.tsx b/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.tsx
index dac4d628570f04..78f0297a0f38db 100644
--- a/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/ems_vector_tile_layer/ems_vector_tile_layer.tsx
@@ -137,7 +137,7 @@ export class EmsVectorTileLayer extends AbstractLayer {
       };
       stopLoading(SOURCE_DATA_REQUEST_ID, requestToken, data);
     } catch (error) {
-      onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error.message);
+      onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error);
     }
   }
 
diff --git a/x-pack/plugins/maps/public/classes/layers/layer.tsx b/x-pack/plugins/maps/public/classes/layers/layer.tsx
index 42fc01ad8475cb..d93348dd8ef858 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/layer.tsx
@@ -408,7 +408,7 @@ export class AbstractLayer implements ILayer {
   getErrors(): LayerError[] {
     const errors: LayerError[] = [];
 
-    const sourceError = this.getSourceDataRequest()?.getError();
+    const sourceError = this.getSourceDataRequest()?.renderError();
     if (sourceError) {
       errors.push({
         title: this._getSourceErrorTitle(),
diff --git a/x-pack/plugins/maps/public/classes/layers/layer_group/layer_group.tsx b/x-pack/plugins/maps/public/classes/layers/layer_group/layer_group.tsx
index 54ead3de1cbd6f..7b7ac229f154ed 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer_group/layer_group.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/layer_group/layer_group.tsx
@@ -284,6 +284,10 @@ export class LayerGroup implements ILayer {
   }
 
   isLayerLoading(zoom: number): boolean {
+    if (!this.isVisible()) {
+      return false;
+    }
+
     return this._children.some((child) => {
       return child.isLayerLoading(zoom);
     });
diff --git a/x-pack/plugins/maps/public/classes/layers/raster_tile_layer/raster_tile_layer.ts b/x-pack/plugins/maps/public/classes/layers/raster_tile_layer/raster_tile_layer.ts
index e0666b6b05960b..9decff440ee499 100644
--- a/x-pack/plugins/maps/public/classes/layers/raster_tile_layer/raster_tile_layer.ts
+++ b/x-pack/plugins/maps/public/classes/layers/raster_tile_layer/raster_tile_layer.ts
@@ -99,7 +99,7 @@ export class RasterTileLayer extends AbstractLayer {
       };
       stopLoading(SOURCE_DATA_REQUEST_ID, requestToken, data, {});
     } catch (error) {
-      onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error.message);
+      onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error);
     }
   }
 
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/blended_vector_layer/blended_vector_layer.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/blended_vector_layer/blended_vector_layer.ts
index 4efa00c6c8ad35..a1f2ed1792e05c 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/blended_vector_layer/blended_vector_layer.ts
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/blended_vector_layer/blended_vector_layer.ts
@@ -320,7 +320,7 @@ export class BlendedVectorLayer extends GeoJsonVectorLayer implements IVectorLay
         syncContext.stopLoading(dataRequestId, requestToken, { isSyncClustered }, requestMeta);
       } catch (error) {
         if (!(error instanceof DataRequestAbortError) || !isSearchSourceAbortError(error)) {
-          syncContext.onLoadError(dataRequestId, requestToken, error.message);
+          syncContext.onLoadError(dataRequestId, requestToken, error);
         }
         return;
       }
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_source_data.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_source_data.tsx
index 3550e93bb1595b..272950de567eb6 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_source_data.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_source_data.tsx
@@ -98,7 +98,7 @@ export async function syncGeojsonSourceData({
     };
   } catch (error) {
     if (!(error instanceof DataRequestAbortError)) {
-      onLoadError(dataRequestId, requestToken, error.message);
+      onLoadError(dataRequestId, requestToken, error);
     }
     throw error;
   }
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.test.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.test.ts
index 6717a04bc80d0d..cf558c33458ce7 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.test.ts
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.test.ts
@@ -75,6 +75,18 @@ describe('isLayerLoading', () => {
   });
 
   describe('joins', () => {
+    test('should return false when layer is not visible', () => {
+      const layer = new GeoJsonVectorLayer({
+        customIcons: [],
+        joins: [mockJoin],
+        layerDescriptor: {
+          visible: false,
+        } as unknown as VectorLayerDescriptor,
+        source: {} as unknown as IVectorSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(false);
+    });
+
     describe('source data loaded with no features', () => {
       test('should return false when join loading has not started', () => {
         const layer = new GeoJsonVectorLayer({
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.tsx
index 78d1ac7442a952..4faa32668f7de7 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/geojson_vector_layer/geojson_vector_layer.tsx
@@ -61,6 +61,10 @@ export class GeoJsonVectorLayer extends AbstractVectorLayer {
   }
 
   isLayerLoading(zoom: number) {
+    if (!this.isVisible() || !this.showAtZoomLevel(zoom)) {
+      return false;
+    }
+
     const isSourceLoading = super.isLayerLoading(zoom);
     if (isSourceLoading) {
       return true;
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_source_data.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_source_data.ts
index 17a92fff97ff7d..7b3f800fabc3f9 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_source_data.ts
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_source_data.ts
@@ -97,6 +97,6 @@ export async function syncMvtSourceData({
     };
     syncContext.stopLoading(SOURCE_DATA_REQUEST_ID, requestToken, sourceData, {});
   } catch (error) {
-    syncContext.onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error.message);
+    syncContext.onLoadError(SOURCE_DATA_REQUEST_ID, requestToken, error);
   }
 }
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.test.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.test.tsx
index 4347452c8d22ef..69ac1a00068f21 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.test.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.test.tsx
@@ -110,139 +110,118 @@ describe('isLayerLoading', () => {
     dataRequestMetaAtStart: undefined,
     dataRequestToken: undefined,
   };
-  test('should be true when tile loading has not started', () => {
-    const layer = new MvtVectorLayer({
-      customIcons: [],
-      layerDescriptor: {
-        __dataRequests: [sourceDataRequestDescriptor],
-      } as unknown as VectorLayerDescriptor,
-      source: {
-        getMaxZoom: () => {
-          return 24;
-        },
-        getMinZoom: () => {
-          return 0;
-        },
-      } as unknown as IVectorSource,
+  const mockSource = {
+    getMaxZoom: () => {
+      return 24;
+    },
+    getMinZoom: () => {
+      return 0;
+    },
+  } as unknown as IVectorSource;
+
+  describe('no joins', () => {
+    test('should be true when tile loading has not started', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        layerDescriptor: {
+          __dataRequests: [sourceDataRequestDescriptor],
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(true);
     });
-    expect(layer.isLayerLoading(1)).toBe(true);
-  });
 
-  test('should be true when tiles are loading', () => {
-    const layer = new MvtVectorLayer({
-      customIcons: [],
-      layerDescriptor: {
-        __areTilesLoaded: false,
-        __dataRequests: [sourceDataRequestDescriptor],
-      } as unknown as VectorLayerDescriptor,
-      source: {
-        getMaxZoom: () => {
-          return 24;
-        },
-        getMinZoom: () => {
-          return 0;
-        },
-      } as unknown as IVectorSource,
+    test('should be true when tiles are loading', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        layerDescriptor: {
+          __areTilesLoaded: false,
+          __dataRequests: [sourceDataRequestDescriptor],
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(true);
     });
-    expect(layer.isLayerLoading(1)).toBe(true);
-  });
 
-  test('should be false when tiles are loaded', () => {
-    const layer = new MvtVectorLayer({
-      customIcons: [],
-      layerDescriptor: {
-        __areTilesLoaded: true,
-        __dataRequests: [sourceDataRequestDescriptor],
-      } as unknown as VectorLayerDescriptor,
-      source: {
-        getMaxZoom: () => {
-          return 24;
-        },
-        getMinZoom: () => {
-          return 0;
-        },
-      } as unknown as IVectorSource,
+    test('should be false when tiles are loaded', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        layerDescriptor: {
+          __areTilesLoaded: true,
+          __dataRequests: [sourceDataRequestDescriptor],
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(false);
     });
-    expect(layer.isLayerLoading(1)).toBe(false);
   });
 
-  test('should be true when tiles are loaded but join is loading', () => {
-    const layer = new MvtVectorLayer({
-      customIcons: [],
-      joins: [
-        {
-          hasCompleteConfig: () => {
-            return true;
-          },
-          getSourceDataRequestId: () => {
-            return 'join_source_a0b0da65-5e1a-4967-9dbe-74f24391afe2';
-          },
-          getRightJoinSource: () => {
-            return {} as unknown as IJoinSource;
-          },
-        } as unknown as InnerJoin,
-      ],
-      layerDescriptor: {
-        __areTilesLoaded: true,
-        __dataRequests: [
-          sourceDataRequestDescriptor,
-          {
-            dataId: 'join_source_a0b0da65-5e1a-4967-9dbe-74f24391afe2',
-            dataRequestMetaAtStart: {},
-            dataRequestToken: Symbol('join request'),
-          },
-        ],
-      } as unknown as VectorLayerDescriptor,
-      source: {
-        getMaxZoom: () => {
-          return 24;
-        },
-        getMinZoom: () => {
-          return 0;
-        },
-      } as unknown as IVectorSource,
+  describe('joins', () => {
+    const joinDataRequestId = 'join_source_a0b0da65-5e1a-4967-9dbe-74f24391afe2';
+    const mockJoin = {
+      hasCompleteConfig: () => {
+        return true;
+      },
+      getSourceDataRequestId: () => {
+        return joinDataRequestId;
+      },
+      getRightJoinSource: () => {
+        return {} as unknown as IJoinSource;
+      },
+    } as unknown as InnerJoin;
+
+    test('should be false when layer is not visible', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        joins: [mockJoin],
+        layerDescriptor: {
+          visible: false,
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(false);
+    });
+
+    test('should be true when tiles are loaded but join is loading', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        joins: [mockJoin],
+        layerDescriptor: {
+          __areTilesLoaded: true,
+          __dataRequests: [
+            sourceDataRequestDescriptor,
+            {
+              dataId: joinDataRequestId,
+              dataRequestMetaAtStart: {},
+              dataRequestToken: Symbol('join request'),
+            },
+          ],
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(true);
     });
-    expect(layer.isLayerLoading(1)).toBe(true);
-  });
 
-  test('should be false when tiles are loaded and joins are loaded', () => {
-    const layer = new MvtVectorLayer({
-      customIcons: [],
-      joins: [
-        {
-          hasCompleteConfig: () => {
-            return true;
-          },
-          getSourceDataRequestId: () => {
-            return 'join_source_a0b0da65-5e1a-4967-9dbe-74f24391afe2';
-          },
-          getRightJoinSource: () => {
-            return {} as unknown as IJoinSource;
-          },
-        } as unknown as InnerJoin,
-      ],
-      layerDescriptor: {
-        __areTilesLoaded: true,
-        __dataRequests: [
-          sourceDataRequestDescriptor,
-          {
-            data: {},
-            dataId: 'join_source_a0b0da65-5e1a-4967-9dbe-74f24391afe2',
-            dataRequestMeta: {},
-            dataRequestMetaAtStart: undefined,
-            dataRequestToken: undefined,
-          },
-        ],
-      } as unknown as VectorLayerDescriptor,
-      source: {
-        getMaxZoom: () => {
-          return 24;
-        },
-        getMinZoom: () => {
-          return 0;
-        },
-      } as unknown as IVectorSource,
+    test('should be false when tiles are loaded and joins are loaded', () => {
+      const layer = new MvtVectorLayer({
+        customIcons: [],
+        joins: [mockJoin],
+        layerDescriptor: {
+          __areTilesLoaded: true,
+          __dataRequests: [
+            sourceDataRequestDescriptor,
+            {
+              data: {},
+              dataId: joinDataRequestId,
+              dataRequestMeta: {},
+              dataRequestMetaAtStart: undefined,
+              dataRequestToken: undefined,
+            },
+          ],
+        } as unknown as VectorLayerDescriptor,
+        source: mockSource,
+      });
+      expect(layer.isLayerLoading(1)).toBe(false);
     });
-    expect(layer.isLayerLoading(1)).toBe(false);
   });
 });
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.tsx
index 099edd9b9e8a3c..fa0e91258f8d2f 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/mvt_vector_layer/mvt_vector_layer.tsx
@@ -75,6 +75,10 @@ export class MvtVectorLayer extends AbstractVectorLayer {
   }
 
   isLayerLoading(zoom: number) {
+    if (!this.isVisible() || !this.showAtZoomLevel(zoom)) {
+      return false;
+    }
+
     const isSourceLoading = super.isLayerLoading(zoom);
     return isSourceLoading ? true : this._isLoadingJoins();
   }
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
index 0d5a3afbd216fb..b3974bdc67f478 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
@@ -279,13 +279,13 @@ export class AbstractVectorLayer extends AbstractLayer implements IVectorLayer {
 
     this.getValidJoins().forEach((join) => {
       const joinDataRequest = this.getDataRequest(join.getSourceDataRequestId());
-      const error = joinDataRequest?.getError();
-      if (error) {
+      const joinError = joinDataRequest?.renderError();
+      if (joinError) {
         errors.push({
           title: i18n.translate('xpack.maps.vectorLayer.joinFetchErrorTitle', {
             defaultMessage: `An error occurred when loading join metrics`,
           }),
-          error,
+          error: joinError,
         });
       }
     });
@@ -484,7 +484,7 @@ export class AbstractVectorLayer extends AbstractLayer implements IVectorLayer {
       stopLoading(dataRequestId, requestToken, styleMeta, nextMeta);
     } catch (error) {
       if (!(error instanceof DataRequestAbortError)) {
-        onLoadError(dataRequestId, requestToken, error.message);
+        onLoadError(dataRequestId, requestToken, error);
       }
       throw error;
     }
@@ -554,7 +554,7 @@ export class AbstractVectorLayer extends AbstractLayer implements IVectorLayer {
 
       stopLoading(dataRequestId, requestToken, formatters, nextMeta);
     } catch (error) {
-      onLoadError(dataRequestId, requestToken, error.message);
+      onLoadError(dataRequestId, requestToken, error);
       throw error;
     }
   }
@@ -629,7 +629,7 @@ export class AbstractVectorLayer extends AbstractLayer implements IVectorLayer {
       };
     } catch (error) {
       if (!(error instanceof DataRequestAbortError)) {
-        onLoadError(sourceDataId, requestToken, `Join error: ${error.message}`);
+        onLoadError(sourceDataId, requestToken, error);
       }
       throw error;
     }
@@ -727,7 +727,7 @@ export class AbstractVectorLayer extends AbstractLayer implements IVectorLayer {
       const supportsFeatureEditing = await source.supportsFeatureEditing();
       stopLoading(dataRequestId, requestToken, { supportsFeatureEditing });
     } catch (error) {
-      onLoadError(dataRequestId, requestToken, error.message);
+      onLoadError(dataRequestId, requestToken, error);
       throw error;
     }
   }
diff --git a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
index 12941183aa5021..cfde9257ca3be7 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
@@ -198,12 +198,7 @@ export class AbstractESSource extends AbstractVectorSource implements IESSource
         throw new DataRequestAbortError();
       }
 
-      throw new Error(
-        i18n.translate('xpack.maps.source.esSource.requestFailedErrorMessage', {
-          defaultMessage: `Elasticsearch search request failed, error: {message}`,
-          values: { message: error.message },
-        })
-      );
+      throw error;
     }
   }
 
diff --git a/x-pack/plugins/maps/public/classes/util/data_request.ts b/x-pack/plugins/maps/public/classes/util/data_request.tsx
similarity index 63%
rename from x-pack/plugins/maps/public/classes/util/data_request.ts
rename to x-pack/plugins/maps/public/classes/util/data_request.tsx
index 10d83100e5eca4..3cb493f138441a 100644
--- a/x-pack/plugins/maps/public/classes/util/data_request.ts
+++ b/x-pack/plugins/maps/public/classes/util/data_request.tsx
@@ -7,7 +7,10 @@
 
 /* eslint-disable max-classes-per-file */
 
-import { DataRequestDescriptor, DataRequestMeta } from '../../../common/descriptor_types';
+import React, { ReactNode } from 'react';
+import { getSearchErrorOverrideDisplay } from '@kbn/data-plugin/public';
+import { getApplication } from '../../kibana_services';
+import type { DataRequestDescriptor, DataRequestMeta } from '../../../common/descriptor_types';
 
 export class DataRequest {
   private readonly _descriptor: DataRequestDescriptor;
@@ -52,8 +55,30 @@ export class DataRequest {
     return this._descriptor.dataRequestToken;
   }
 
-  getError(): string | undefined {
-    return this._descriptor.error;
+  renderError(): ReactNode {
+    if (!this._descriptor.error) {
+      return null;
+    }
+
+    const overrideDisplay = getSearchErrorOverrideDisplay({
+      error: this._descriptor.error,
+      application: getApplication(),
+    });
+
+    const body = overrideDisplay?.body ? (
+      overrideDisplay.body
+    ) : (
+      <p>{this._descriptor.error.message}</p>
+    );
+
+    return overrideDisplay?.actions ? (
+      <>
+        {body}
+        {overrideDisplay.actions}
+      </>
+    ) : (
+      body
+    );
   }
 }
 
diff --git a/x-pack/plugins/maps/public/reducers/map/data_request_utils.ts b/x-pack/plugins/maps/public/reducers/map/data_request_utils.ts
index 0fe5f2bce8d167..66384e112bcbcd 100644
--- a/x-pack/plugins/maps/public/reducers/map/data_request_utils.ts
+++ b/x-pack/plugins/maps/public/reducers/map/data_request_utils.ts
@@ -51,7 +51,7 @@ export function stopDataRequest(
   requestToken: symbol,
   responseMeta?: DataRequestMeta,
   data?: object,
-  errorMessage?: string
+  error?: Error
 ): MapState {
   const dataRequest = getDataRequest(state, layerId, dataRequestId, requestToken);
   return dataRequest
@@ -65,7 +65,7 @@ export function stopDataRequest(
         },
         dataRequestMetaAtStart: undefined,
         dataRequestToken: undefined, // active data request,
-        error: errorMessage,
+        error,
       })
     : state;
 }
diff --git a/x-pack/plugins/maps/public/reducers/map/map.ts b/x-pack/plugins/maps/public/reducers/map/map.ts
index 20590d8626481c..d79d01f2b1847b 100644
--- a/x-pack/plugins/maps/public/reducers/map/map.ts
+++ b/x-pack/plugins/maps/public/reducers/map/map.ts
@@ -193,7 +193,7 @@ export function map(state: MapState = DEFAULT_MAP_STATE, action: Record<string,
         action.requestToken,
         undefined, // responseMeta meta
         undefined, // response data
-        action.errorMessage
+        action.error
       );
     case LAYER_DATA_LOAD_ENDED:
       return stopDataRequest(
diff --git a/x-pack/plugins/maps/server/index.ts b/x-pack/plugins/maps/server/index.ts
index be2f235a51f4cf..eadb5ccd3eaf9b 100644
--- a/x-pack/plugins/maps/server/index.ts
+++ b/x-pack/plugins/maps/server/index.ts
@@ -7,7 +7,6 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 import { PluginConfigDescriptor } from '@kbn/core/server';
-import { MapsPlugin } from './plugin';
 import { configSchema, MapsXPackConfig } from '../config';
 
 export const config: PluginConfigDescriptor<MapsXPackConfig> = {
@@ -20,5 +19,7 @@ export const config: PluginConfigDescriptor<MapsXPackConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new MapsPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { MapsPlugin } = await import('./plugin');
+  return new MapsPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/metrics_data_access/server/index.ts b/x-pack/plugins/metrics_data_access/server/index.ts
index e76f2201b340a8..1c79d5c5d423c5 100644
--- a/x-pack/plugins/metrics_data_access/server/index.ts
+++ b/x-pack/plugins/metrics_data_access/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { MetricsDataPlugin } from './plugin';
 
 export type {
   MetricsDataPluginSetup,
@@ -20,6 +19,7 @@ export { metricsDataSourceSavedObjectName } from './saved_objects/metrics_data_s
 export { MetricsDataClient } from './client';
 export { MetricsDataClientMock } from './client_mock';
 
-export function plugin(context: PluginInitializerContext) {
+export async function plugin(context: PluginInitializerContext) {
+  const { MetricsDataPlugin } = await import('./plugin');
   return new MetricsDataPlugin(context);
 }
diff --git a/x-pack/plugins/ml/public/application/components/collapsible_panel/panel_header_items.tsx b/x-pack/plugins/ml/public/application/components/collapsible_panel/panel_header_items.tsx
index fa766abadfeb45..75d43e6ebe6f55 100644
--- a/x-pack/plugins/ml/public/application/components/collapsible_panel/panel_header_items.tsx
+++ b/x-pack/plugins/ml/public/application/components/collapsible_panel/panel_header_items.tsx
@@ -6,7 +6,7 @@
  */
 
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { css } from '@emotion/react/dist/emotion-react.cjs';
+import { css } from '@emotion/react';
 import React, { type FC } from 'react';
 import { useCurrentThemeVars } from '../../contexts/kibana';
 
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
index 8a0139f0d77825..0ea71f42208584 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
@@ -22,11 +22,8 @@ import {
 import type { UsageCollectionSetup } from '@kbn/usage-collection-plugin/public';
 import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { ManagementAppMountParams } from '@kbn/management-plugin/public';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  RedirectAppLinks,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
 import type { SpacesContextProps, SpacesPluginStart } from '@kbn/spaces-plugin/public';
 import type { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
@@ -124,7 +121,11 @@ export const JobsListPage: FC<Props> = ({
   }
 
   return (
-    <RedirectAppLinks application={coreStart.application}>
+    <RedirectAppLinks
+      coreStart={{
+        application: coreStart.application,
+      }}
+    >
       <I18nContext>
         <KibanaThemeProvider theme$={theme$}>
           <KibanaContextProvider
diff --git a/x-pack/plugins/ml/server/index.ts b/x-pack/plugins/ml/server/index.ts
index 232df4ae7f1dfc..ea5a6037418578 100644
--- a/x-pack/plugins/ml/server/index.ts
+++ b/x-pack/plugins/ml/server/index.ts
@@ -8,7 +8,6 @@
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { type ConfigSchema } from '../common/constants/app';
 import { configSchema } from './config_schema';
-import { MlServerPlugin } from './plugin';
 export type { MlPluginSetup, MlPluginStart } from './plugin';
 export type {
   DatafeedStats as MlDatafeedStats,
@@ -38,4 +37,7 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   },
 };
 
-export const plugin = (ctx: PluginInitializerContext<ConfigSchema>) => new MlServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext<ConfigSchema>) => {
+  const { MlServerPlugin } = await import('./plugin');
+  return new MlServerPlugin(ctx);
+};
diff --git a/x-pack/plugins/monitoring/server/index.ts b/x-pack/plugins/monitoring/server/index.ts
index ca55aa07704998..f39af9fffe7d6f 100644
--- a/x-pack/plugins/monitoring/server/index.ts
+++ b/x-pack/plugins/monitoring/server/index.ts
@@ -7,7 +7,6 @@
 
 import { TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { MonitoringPlugin } from './plugin';
 import { configSchema } from './config';
 import { deprecations } from './deprecations';
 
@@ -15,7 +14,10 @@ export type { KibanaSettingsCollector } from './kibana_monitoring/collectors';
 export type { MonitoringConfig } from './config';
 export type { MonitoringPluginSetup, IBulkUploader } from './types';
 
-export const plugin = (initContext: PluginInitializerContext) => new MonitoringPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { MonitoringPlugin } = await import('./plugin');
+  return new MonitoringPlugin(initContext);
+};
 export const config: PluginConfigDescriptor<TypeOf<typeof configSchema>> = {
   schema: configSchema,
   deprecations,
diff --git a/x-pack/plugins/monitoring_collection/server/index.ts b/x-pack/plugins/monitoring_collection/server/index.ts
index e6f15bd297dc8d..8a795dbf802b63 100644
--- a/x-pack/plugins/monitoring_collection/server/index.ts
+++ b/x-pack/plugins/monitoring_collection/server/index.ts
@@ -7,15 +7,16 @@
 
 import { TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { MonitoringCollectionPlugin } from './plugin';
 import { configSchema } from './config';
 
 export type { MonitoringCollectionConfig } from './config';
 
 export type { MonitoringCollectionSetup, MetricResult, Metric } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new MonitoringCollectionPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { MonitoringCollectionPlugin } = await import('./plugin');
+  return new MonitoringCollectionPlugin(initContext);
+};
 export const config: PluginConfigDescriptor<TypeOf<typeof configSchema>> = {
   schema: configSchema,
 };
diff --git a/x-pack/plugins/notifications/server/index.ts b/x-pack/plugins/notifications/server/index.ts
index 9e8785d680de52..4c3afb14f7a57f 100755
--- a/x-pack/plugins/notifications/server/index.ts
+++ b/x-pack/plugins/notifications/server/index.ts
@@ -6,13 +6,13 @@
  */
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { NotificationsPlugin } from './plugin';
 export { config } from './config';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 export type { NotificationsPluginStart } from './types';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { NotificationsPlugin } = await import('./plugin');
   return new NotificationsPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/observability/common/custom_threshold_rule/constants.ts b/x-pack/plugins/observability/common/custom_threshold_rule/constants.ts
index 15886482e4b31b..7f7c3a5bcbb3f3 100644
--- a/x-pack/plugins/observability/common/custom_threshold_rule/constants.ts
+++ b/x-pack/plugins/observability/common/custom_threshold_rule/constants.ts
@@ -5,16 +5,13 @@
  * 2.0.
  */
 
-export const SNAPSHOT_CUSTOM_AGGREGATIONS = ['avg', 'max', 'min', 'rate'] as const;
 export const METRIC_EXPLORER_AGGREGATIONS = [
   'avg',
   'max',
   'min',
   'cardinality',
-  'rate',
   'count',
   'sum',
-  'p95',
-  'p99',
-  'custom',
 ] as const;
+
+export const CUSTOM_AGGREGATOR = 'custom';
diff --git a/x-pack/plugins/observability/common/custom_threshold_rule/formatters/index.ts b/x-pack/plugins/observability/common/custom_threshold_rule/formatters/index.ts
index f7491ca139bfe4..00ecdef67d97f4 100644
--- a/x-pack/plugins/observability/common/custom_threshold_rule/formatters/index.ts
+++ b/x-pack/plugins/observability/common/custom_threshold_rule/formatters/index.ts
@@ -14,7 +14,7 @@ import { InfraWaffleMapDataFormat } from './types';
 
 export const FORMATTERS = {
   number: formatNumber,
-  // Because the implimentation for formatting large numbers is the same as formatting
+  // Because the implementation for formatting large numbers is the same as formatting
   // bytes we are re-using the same code, we just format the number using the abbreviated number format.
   abbreviatedNumber: createBytesFormatter(InfraWaffleMapDataFormat.abbreviatedNumber),
   // bytes in bytes formatted string out
diff --git a/x-pack/plugins/observability/common/custom_threshold_rule/metrics_explorer.ts b/x-pack/plugins/observability/common/custom_threshold_rule/metrics_explorer.ts
deleted file mode 100644
index 66913385123c43..00000000000000
--- a/x-pack/plugins/observability/common/custom_threshold_rule/metrics_explorer.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as rt from 'io-ts';
-import { xor } from 'lodash';
-import { METRIC_EXPLORER_AGGREGATIONS } from './constants';
-
-export const OMITTED_AGGREGATIONS_FOR_CUSTOM_METRICS = ['custom', 'rate', 'p95', 'p99'];
-
-type MetricExplorerAggregations = typeof METRIC_EXPLORER_AGGREGATIONS[number];
-
-const metricsExplorerAggregationKeys = METRIC_EXPLORER_AGGREGATIONS.reduce<
-  Record<MetricExplorerAggregations, null>
->((acc, agg) => ({ ...acc, [agg]: null }), {} as Record<MetricExplorerAggregations, null>);
-
-export const metricsExplorerAggregationRT = rt.keyof(metricsExplorerAggregationKeys);
-
-export type MetricExplorerCustomMetricAggregations = Exclude<
-  MetricsExplorerAggregation,
-  'custom' | 'rate' | 'p95' | 'p99'
->;
-const metricsExplorerCustomMetricAggregationKeys = xor(
-  METRIC_EXPLORER_AGGREGATIONS,
-  OMITTED_AGGREGATIONS_FOR_CUSTOM_METRICS
-).reduce<Record<MetricExplorerCustomMetricAggregations, null>>(
-  (acc, agg) => ({ ...acc, [agg]: null }),
-  {} as Record<MetricExplorerCustomMetricAggregations, null>
-);
-export const metricsExplorerCustomMetricAggregationRT = rt.keyof(
-  metricsExplorerCustomMetricAggregationKeys
-);
-
-export const metricsExplorerMetricRequiredFieldsRT = rt.type({
-  aggregation: metricsExplorerAggregationRT,
-});
-
-export const metricsExplorerCustomMetricRT = rt.intersection([
-  rt.type({
-    name: rt.string,
-    aggregation: metricsExplorerCustomMetricAggregationRT,
-  }),
-  rt.partial({
-    field: rt.string,
-    filter: rt.string,
-  }),
-]);
-
-export type MetricsExplorerCustomMetric = rt.TypeOf<typeof metricsExplorerCustomMetricRT>;
-
-export const metricsExplorerMetricOptionalFieldsRT = rt.partial({
-  field: rt.union([rt.string, rt.undefined]),
-  custom_metrics: rt.array(metricsExplorerCustomMetricRT),
-  equation: rt.string,
-});
-
-export const metricsExplorerMetricRT = rt.intersection([
-  metricsExplorerMetricRequiredFieldsRT,
-  metricsExplorerMetricOptionalFieldsRT,
-]);
-
-export const timeRangeRT = rt.type({
-  from: rt.number,
-  to: rt.number,
-  interval: rt.string,
-});
-
-export const metricsExplorerRequestBodyRequiredFieldsRT = rt.type({
-  timerange: timeRangeRT,
-  indexPattern: rt.string,
-  metrics: rt.array(metricsExplorerMetricRT),
-});
-
-const groupByRT = rt.union([rt.string, rt.null, rt.undefined]);
-export const afterKeyObjectRT = rt.record(rt.string, rt.union([rt.string, rt.null]));
-
-export const metricsExplorerRequestBodyOptionalFieldsRT = rt.partial({
-  groupBy: rt.union([groupByRT, rt.array(groupByRT)]),
-  afterKey: rt.union([rt.string, rt.null, rt.undefined, afterKeyObjectRT]),
-  limit: rt.union([rt.number, rt.null, rt.undefined]),
-  filterQuery: rt.union([rt.string, rt.null, rt.undefined]),
-  forceInterval: rt.boolean,
-  dropLastBucket: rt.boolean,
-});
-
-export const metricsExplorerRequestBodyRT = rt.intersection([
-  metricsExplorerRequestBodyRequiredFieldsRT,
-  metricsExplorerRequestBodyOptionalFieldsRT,
-]);
-
-export const metricsExplorerPageInfoRT = rt.type({
-  total: rt.number,
-  afterKey: rt.union([rt.string, rt.null, afterKeyObjectRT]),
-});
-
-export const metricsExplorerColumnTypeRT = rt.keyof({
-  date: null,
-  number: null,
-  string: null,
-});
-
-export const metricsExplorerColumnRT = rt.type({
-  name: rt.string,
-  type: metricsExplorerColumnTypeRT,
-});
-
-export const metricsExplorerRowRT = rt.intersection([
-  rt.type({
-    timestamp: rt.number,
-  }),
-  rt.record(
-    rt.string,
-    rt.union([rt.string, rt.number, rt.null, rt.undefined, rt.array(rt.object)])
-  ),
-]);
-
-export const metricsExplorerSeriesRT = rt.intersection([
-  rt.type({
-    id: rt.string,
-    columns: rt.array(metricsExplorerColumnRT),
-    rows: rt.array(metricsExplorerRowRT),
-  }),
-  rt.partial({
-    keys: rt.array(rt.string),
-  }),
-]);
-
-export const metricsExplorerResponseRT = rt.type({
-  series: rt.array(metricsExplorerSeriesRT),
-  pageInfo: metricsExplorerPageInfoRT,
-});
-
-export type AfterKey = rt.TypeOf<typeof afterKeyObjectRT>;
-
-export type MetricsExplorerAggregation = rt.TypeOf<typeof metricsExplorerAggregationRT>;
-
-export type MetricsExplorerColumnType = rt.TypeOf<typeof metricsExplorerColumnTypeRT>;
-
-export type MetricsExplorerMetric = rt.TypeOf<typeof metricsExplorerMetricRT>;
-
-export type MetricsExplorerPageInfo = rt.TypeOf<typeof metricsExplorerPageInfoRT>;
-
-export type MetricsExplorerColumn = rt.TypeOf<typeof metricsExplorerColumnRT>;
-
-export type MetricsExplorerRow = rt.TypeOf<typeof metricsExplorerRowRT>;
-
-export type MetricsExplorerSeries = rt.TypeOf<typeof metricsExplorerSeriesRT>;
-
-export type MetricsExplorerRequestBody = rt.TypeOf<typeof metricsExplorerRequestBodyRT>;
-
-export type MetricsExplorerResponse = rt.TypeOf<typeof metricsExplorerResponseRT>;
diff --git a/x-pack/plugins/observability/common/custom_threshold_rule/types.ts b/x-pack/plugins/observability/common/custom_threshold_rule/types.ts
index dc5b434e0a7e9d..40d569152d1a3d 100644
--- a/x-pack/plugins/observability/common/custom_threshold_rule/types.ts
+++ b/x-pack/plugins/observability/common/custom_threshold_rule/types.ts
@@ -6,22 +6,9 @@
  */
 
 import * as rt from 'io-ts';
-import { ML_ANOMALY_THRESHOLD } from '@kbn/ml-anomaly-utils/anomaly_threshold';
-import { values } from 'lodash';
 import { SerializedSearchSourceFields } from '@kbn/data-plugin/common';
-import { Color } from './color_palette';
-import { metricsExplorerMetricRT } from './metrics_explorer';
 import { TimeUnitChar } from '../utils/formatters/duration';
-import { SNAPSHOT_CUSTOM_AGGREGATIONS } from './constants';
-
-type DeepPartialArray<T> = Array<DeepPartial<T>>;
-
-type DeepPartialObject<T> = { [P in keyof T]+?: DeepPartial<T[P]> };
-export type DeepPartial<T> = T extends any[]
-  ? DeepPartialArray<T[number]>
-  : T extends object
-  ? DeepPartialObject<T>
-  : T;
+import { CUSTOM_AGGREGATOR } from './constants';
 
 export const ThresholdFormatterTypeRT = rt.keyof({
   abbreviatedNumber: null,
@@ -33,97 +20,6 @@ export const ThresholdFormatterTypeRT = rt.keyof({
 });
 export type ThresholdFormatterType = rt.TypeOf<typeof ThresholdFormatterTypeRT>;
 
-const pointRT = rt.type({
-  timestamp: rt.number,
-  value: rt.number,
-});
-
-export type Point = rt.TypeOf<typeof pointRT>;
-
-const serieRT = rt.type({
-  id: rt.string,
-  points: rt.array(pointRT),
-});
-
-const seriesRT = rt.array(serieRT);
-
-export type Series = rt.TypeOf<typeof seriesRT>;
-
-export const getLogAlertsChartPreviewDataSuccessResponsePayloadRT = rt.type({
-  data: rt.type({
-    series: seriesRT,
-  }),
-});
-
-export type GetLogAlertsChartPreviewDataSuccessResponsePayload = rt.TypeOf<
-  typeof getLogAlertsChartPreviewDataSuccessResponsePayloadRT
->;
-
-/**
- * Properties specific to the Metrics Source Configuration.
- */
-export const SourceConfigurationTimestampColumnRuntimeType = rt.type({
-  timestampColumn: rt.type({
-    id: rt.string,
-  }),
-});
-export const SourceConfigurationMessageColumnRuntimeType = rt.type({
-  messageColumn: rt.type({
-    id: rt.string,
-  }),
-});
-
-export const SourceConfigurationFieldColumnRuntimeType = rt.type({
-  fieldColumn: rt.type({
-    id: rt.string,
-    field: rt.string,
-  }),
-});
-
-export const SourceConfigurationColumnRuntimeType = rt.union([
-  SourceConfigurationTimestampColumnRuntimeType,
-  SourceConfigurationMessageColumnRuntimeType,
-  SourceConfigurationFieldColumnRuntimeType,
-]);
-
-// Kibana data views
-export const logDataViewReferenceRT = rt.type({
-  type: rt.literal('data_view'),
-  dataViewId: rt.string,
-});
-
-// Index name
-export const logIndexNameReferenceRT = rt.type({
-  type: rt.literal('index_name'),
-  indexName: rt.string,
-});
-
-export const logIndexReferenceRT = rt.union([logDataViewReferenceRT, logIndexNameReferenceRT]);
-
-/**
- * Source status
- */
-const SourceStatusFieldRuntimeType = rt.type({
-  name: rt.string,
-  type: rt.string,
-  searchable: rt.boolean,
-  aggregatable: rt.boolean,
-  displayable: rt.boolean,
-});
-export const SourceStatusRuntimeType = rt.type({
-  logIndicesExist: rt.boolean,
-  metricIndicesExist: rt.boolean,
-  remoteClustersExist: rt.boolean,
-  indexFields: rt.array(SourceStatusFieldRuntimeType),
-});
-export const metricsSourceStatusRT = rt.strict({
-  metricIndicesExist: SourceStatusRuntimeType.props.metricIndicesExist,
-  remoteClustersExist: SourceStatusRuntimeType.props.metricIndicesExist,
-  indexFields: SourceStatusRuntimeType.props.indexFields,
-});
-
-export type MetricsSourceStatus = rt.TypeOf<typeof metricsSourceStatusRT>;
-
 export enum Comparator {
   GT = '>',
   LT = '<',
@@ -139,23 +35,10 @@ export enum Aggregators {
   SUM = 'sum',
   MIN = 'min',
   MAX = 'max',
-  RATE = 'rate',
   CARDINALITY = 'cardinality',
-  P95 = 'p95',
-  P99 = 'p99',
-  CUSTOM = 'custom',
 }
-
-const metricsExplorerOptionsMetricRT = rt.intersection([
-  metricsExplorerMetricRT,
-  rt.partial({
-    rate: rt.boolean,
-    color: rt.keyof(Object.fromEntries(values(Color).map((c) => [c, null])) as Record<Color, null>),
-    label: rt.string,
-  }),
-]);
-
-export type MetricsExplorerOptionsMetric = rt.TypeOf<typeof metricsExplorerOptionsMetricRT>;
+export const aggType = fromEnum('Aggregators', Aggregators);
+export type AggType = rt.TypeOf<typeof aggType>;
 
 export enum MetricsExplorerChartType {
   line = 'line',
@@ -163,11 +46,6 @@ export enum MetricsExplorerChartType {
   bar = 'bar',
 }
 
-export enum InfraRuleType {
-  MetricThreshold = 'metrics.alert.threshold',
-  InventoryThreshold = 'metrics.alert.inventory.threshold',
-}
-
 export enum AlertStates {
   OK,
   ALERT,
@@ -176,27 +54,6 @@ export enum AlertStates {
   ERROR,
 }
 
-const metricAnomalyNodeTypeRT = rt.union([rt.literal('hosts'), rt.literal('k8s')]);
-const metricAnomalyMetricRT = rt.union([
-  rt.literal('memory_usage'),
-  rt.literal('network_in'),
-  rt.literal('network_out'),
-]);
-const metricAnomalyInfluencerFilterRT = rt.type({
-  fieldName: rt.string,
-  fieldValue: rt.string,
-});
-
-export interface MetricAnomalyParams {
-  nodeType: rt.TypeOf<typeof metricAnomalyNodeTypeRT>;
-  metric: rt.TypeOf<typeof metricAnomalyMetricRT>;
-  alertInterval?: string;
-  sourceId?: string;
-  spaceId?: string;
-  threshold: Exclude<ML_ANOMALY_THRESHOLD, ML_ANOMALY_THRESHOLD.LOW>;
-  influencerFilter: rt.TypeOf<typeof metricAnomalyInfluencerFilterRT> | undefined;
-}
-
 // Types for the executor
 
 export interface ThresholdParams {
@@ -209,7 +66,7 @@ export interface ThresholdParams {
   groupBy?: string[];
 }
 
-interface BaseMetricExpressionParams {
+export interface BaseMetricExpressionParams {
   timeSize: number;
   timeUnit: TimeUnitChar;
   sourceId?: string;
@@ -219,38 +76,21 @@ interface BaseMetricExpressionParams {
   warningThreshold?: number[];
 }
 
-export interface NonCountMetricExpressionParams extends BaseMetricExpressionParams {
-  aggType: Exclude<Aggregators, [Aggregators.COUNT, Aggregators.CUSTOM]>;
-  metric: string;
-}
-
-export interface CountMetricExpressionParams extends BaseMetricExpressionParams {
-  aggType: Aggregators.COUNT;
-}
-
-export type CustomMetricAggTypes = Exclude<
-  Aggregators,
-  Aggregators.CUSTOM | Aggregators.RATE | Aggregators.P95 | Aggregators.P99
->;
-
 export interface CustomThresholdExpressionMetric {
   name: string;
-  aggType: CustomMetricAggTypes;
+  aggType: AggType;
   field?: string;
   filter?: string;
 }
 
 export interface CustomMetricExpressionParams extends BaseMetricExpressionParams {
-  aggType: Aggregators.CUSTOM;
+  aggType: typeof CUSTOM_AGGREGATOR;
   metrics: CustomThresholdExpressionMetric[];
   equation?: string;
   label?: string;
 }
 
-export type MetricExpressionParams =
-  | NonCountMetricExpressionParams
-  | CountMetricExpressionParams
-  | CustomMetricExpressionParams;
+export type MetricExpressionParams = CustomMetricExpressionParams;
 
 export const QUERY_INVALID: unique symbol = Symbol('QUERY_INVALID');
 
@@ -269,22 +109,22 @@ export enum InfraFormatterType {
   percent = 'percent',
 }
 
-export type SnapshotCustomAggregation = typeof SNAPSHOT_CUSTOM_AGGREGATIONS[number];
-const snapshotCustomAggregationKeys = SNAPSHOT_CUSTOM_AGGREGATIONS.reduce<
-  Record<SnapshotCustomAggregation, null>
->((acc, agg) => ({ ...acc, [agg]: null }), {} as Record<SnapshotCustomAggregation, null>);
-
-export const SnapshotCustomAggregationRT = rt.keyof(snapshotCustomAggregationKeys);
-
-export const SnapshotCustomMetricInputRT = rt.intersection([
-  rt.type({
-    type: rt.literal('custom'),
-    field: rt.string,
-    aggregation: SnapshotCustomAggregationRT,
-    id: rt.string,
-  }),
-  rt.partial({
-    label: rt.string,
-  }),
-]);
-export type SnapshotCustomMetricInput = rt.TypeOf<typeof SnapshotCustomMetricInputRT>;
+/*
+ * Utils
+ *
+ * This utility function can be used to turn a TypeScript enum into a io-ts codec.
+ */
+export function fromEnum<EnumType extends string>(
+  enumName: string,
+  theEnum: Record<string, EnumType>
+): rt.Type<EnumType, EnumType, unknown> {
+  const isEnumValue = (input: unknown): input is EnumType =>
+    Object.values<unknown>(theEnum).includes(input);
+
+  return new rt.Type<EnumType>(
+    enumName,
+    isEnumValue,
+    (input, context) => (isEnumValue(input) ? rt.success(input) : rt.failure(input, context)),
+    rt.identity
+  );
+}
diff --git a/x-pack/plugins/observability/docs/openapi/slo/bundled.json b/x-pack/plugins/observability/docs/openapi/slo/bundled.json
index b4f52b032a9fcb..fbc6c0bb2e5228 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/bundled.json
+++ b/x-pack/plugins/observability/docs/openapi/slo/bundled.json
@@ -143,7 +143,7 @@
           {
             "name": "page",
             "in": "query",
-            "description": "The page number to return",
+            "description": "The page to use for pagination, must be greater or equal than 1",
             "schema": {
               "type": "integer",
               "default": 1
@@ -153,7 +153,7 @@
           {
             "name": "perPage",
             "in": "query",
-            "description": "The number of SLOs to return per page",
+            "description": "Number of SLOs returned by page",
             "schema": {
               "type": "integer",
               "default": 25,
@@ -280,7 +280,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/slo_response"
+                  "$ref": "#/components/schemas/slo_with_summary_response"
                 }
               }
             }
@@ -361,7 +361,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/slo_response"
+                  "$ref": "#/components/schemas/slo_definition_response"
                 }
               }
             }
@@ -605,6 +605,79 @@
         }
       }
     },
+    "/s/{spaceId}/api/observability/slos/{sloId}/_reset": {
+      "post": {
+        "summary": "Resets an SLO.",
+        "operationId": "resetSloOp",
+        "description": "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
+        "tags": [
+          "slo"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/space_id"
+          },
+          {
+            "$ref": "#/components/parameters/slo_id"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Successful request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/slo_definition_response"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/400_response"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/401_response"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Unauthorized response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/403_response"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/404_response"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/s/{spaceId}/internal/observability/slos/_historical_summary": {
       "post": {
         "summary": "Retrieves the historical summary for a list of SLOs",
@@ -675,6 +748,104 @@
         }
       }
     },
+    "/s/{spaceId}/internal/observability/slos/_definitions": {
+      "get": {
+        "summary": "Get the SLO definitions",
+        "operationId": "getDefinitionsOp",
+        "description": "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n",
+        "tags": [
+          "slo"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/space_id"
+          },
+          {
+            "name": "includeOutdatedOnly",
+            "in": "query",
+            "description": "Indicates if the API returns only outdated SLO or all SLO definitions",
+            "schema": {
+              "type": "boolean"
+            },
+            "example": true
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "description": "Filters the SLOs by name",
+            "schema": {
+              "type": "string"
+            },
+            "example": "my service availability"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "description": "The page to use for pagination, must be greater or equal than 1",
+            "schema": {
+              "type": "number"
+            },
+            "example": 1
+          },
+          {
+            "name": "perPage",
+            "in": "query",
+            "description": "Number of SLOs returned by page",
+            "schema": {
+              "type": "integer",
+              "default": 100,
+              "maximum": 1000
+            },
+            "example": 100
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/find_slo_definitions_response"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/400_response"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/401_response"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Unauthorized response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/403_response"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/s/{spaceId}/api/observability/slos/_delete_instances": {
       "post": {
         "summary": "Batch delete rollup and summary data for the matching list of sloId and instanceId",
@@ -1586,7 +1757,7 @@
           }
         }
       },
-      "slo_response": {
+      "slo_with_summary_response": {
         "title": "SLO response",
         "type": "object",
         "required": [
@@ -1605,7 +1776,8 @@
           "instanceId",
           "tags",
           "createdAt",
-          "updatedAt"
+          "updatedAt",
+          "version"
         ],
         "properties": {
           "id": {
@@ -1707,6 +1879,11 @@
             "description": "The last update date",
             "type": "string",
             "example": "2023-01-12T10:03:19.000Z"
+          },
+          "version": {
+            "description": "The internal SLO version",
+            "type": "number",
+            "example": 2
           }
         }
       },
@@ -1730,7 +1907,7 @@
           "results": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/slo_response"
+              "$ref": "#/components/schemas/slo_with_summary_response"
             }
           }
         }
@@ -1993,6 +2170,126 @@
           }
         }
       },
+      "slo_definition_response": {
+        "title": "SLO definition response",
+        "type": "object",
+        "required": [
+          "id",
+          "name",
+          "description",
+          "indicator",
+          "timeWindow",
+          "budgetingMethod",
+          "objective",
+          "settings",
+          "revision",
+          "enabled",
+          "groupBy",
+          "tags",
+          "createdAt",
+          "updatedAt",
+          "version"
+        ],
+        "properties": {
+          "id": {
+            "description": "The identifier of the SLO.",
+            "type": "string",
+            "example": "8853df00-ae2e-11ed-90af-09bb6422b258"
+          },
+          "name": {
+            "description": "The name of the SLO.",
+            "type": "string",
+            "example": "My Service SLO"
+          },
+          "description": {
+            "description": "The description of the SLO.",
+            "type": "string",
+            "example": "My SLO description"
+          },
+          "indicator": {
+            "discriminator": {
+              "propertyName": "type",
+              "mapping": {
+                "sli.apm.transactionErrorRate": "#/components/schemas/indicator_properties_apm_availability",
+                "sli.kql.custom": "#/components/schemas/indicator_properties_custom_kql",
+                "sli.apm.transactionDuration": "#/components/schemas/indicator_properties_apm_latency",
+                "sli.metric.custom": "#/components/schemas/indicator_properties_custom_metric",
+                "sli.histogram.custom": "#/components/schemas/indicator_properties_histogram",
+                "sli.metric.timeslice": "#/components/schemas/indicator_properties_timeslice_metric"
+              }
+            },
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/indicator_properties_custom_kql"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_apm_availability"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_apm_latency"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_custom_metric"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_histogram"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_timeslice_metric"
+              }
+            ]
+          },
+          "timeWindow": {
+            "$ref": "#/components/schemas/time_window"
+          },
+          "budgetingMethod": {
+            "$ref": "#/components/schemas/budgeting_method"
+          },
+          "objective": {
+            "$ref": "#/components/schemas/objective"
+          },
+          "settings": {
+            "$ref": "#/components/schemas/settings"
+          },
+          "revision": {
+            "description": "The SLO revision",
+            "type": "number",
+            "example": 2
+          },
+          "enabled": {
+            "description": "Indicate if the SLO is enabled",
+            "type": "boolean",
+            "example": true
+          },
+          "groupBy": {
+            "description": "optional group by field to use to generate an SLO per distinct value",
+            "type": "string",
+            "example": "some.field"
+          },
+          "tags": {
+            "description": "List of tags",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "createdAt": {
+            "description": "The creation date",
+            "type": "string",
+            "example": "2023-01-12T10:03:19.000Z"
+          },
+          "updatedAt": {
+            "description": "The last update date",
+            "type": "string",
+            "example": "2023-01-12T10:03:19.000Z"
+          },
+          "version": {
+            "description": "The internal SLO version",
+            "type": "number",
+            "example": 2
+          }
+        }
+      },
       "historical_summary_request": {
         "title": "Historical summary request",
         "type": "object",
@@ -2036,6 +2333,31 @@
           }
         }
       },
+      "find_slo_definitions_response": {
+        "title": "Find SLO definitions response",
+        "description": "A paginated response of SLO definitions matching the query.\n",
+        "type": "object",
+        "properties": {
+          "page": {
+            "type": "number",
+            "example": 2
+          },
+          "perPage": {
+            "type": "number",
+            "example": 100
+          },
+          "total": {
+            "type": "number",
+            "example": 123
+          },
+          "results": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/slo_definition_response"
+            }
+          }
+        }
+      },
       "delete_slo_instances_request": {
         "title": "Delete SLO instances request",
         "description": "The delete SLO instances request takes a list of SLO id and instance id, then delete the rollup and summary data. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n",
diff --git a/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml b/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
index 8efdbd9dfe2c2e..c5b75cdaf73c03 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
@@ -86,14 +86,14 @@ paths:
           example: 'slo.name:latency* and slo.tags : "prod"'
         - name: page
           in: query
-          description: The page number to return
+          description: The page to use for pagination, must be greater or equal than 1
           schema:
             type: integer
             default: 1
           example: 1
         - name: perPage
           in: query
-          description: The number of SLOs to return per page
+          description: Number of SLOs returned by page
           schema:
             type: integer
             default: 25
@@ -176,7 +176,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/slo_response'
+                $ref: '#/components/schemas/slo_with_summary_response'
         '400':
           description: Bad request
           content:
@@ -224,7 +224,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/slo_response'
+                $ref: '#/components/schemas/slo_definition_response'
         '400':
           description: Bad request
           content:
@@ -365,6 +365,49 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/404_response'
+  /s/{spaceId}/api/observability/slos/{sloId}/_reset:
+    post:
+      summary: Resets an SLO.
+      operationId: resetSloOp
+      description: |
+        You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
+      tags:
+        - slo
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/space_id'
+        - $ref: '#/components/parameters/slo_id'
+      responses:
+        '204':
+          description: Successful request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/slo_definition_response'
+        '400':
+          description: Bad request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/400_response'
+        '401':
+          description: Unauthorized response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/401_response'
+        '403':
+          description: Unauthorized response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/403_response'
+        '404':
+          description: Not found response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/404_response'
   /s/{spaceId}/internal/observability/slos/_historical_summary:
     post:
       summary: Retrieves the historical summary for a list of SLOs
@@ -407,6 +450,68 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/403_response'
+  /s/{spaceId}/internal/observability/slos/_definitions:
+    get:
+      summary: Get the SLO definitions
+      operationId: getDefinitionsOp
+      description: |
+        You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
+      tags:
+        - slo
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/space_id'
+        - name: includeOutdatedOnly
+          in: query
+          description: Indicates if the API returns only outdated SLO or all SLO definitions
+          schema:
+            type: boolean
+          example: true
+        - name: search
+          in: query
+          description: Filters the SLOs by name
+          schema:
+            type: string
+          example: my service availability
+        - name: page
+          in: query
+          description: The page to use for pagination, must be greater or equal than 1
+          schema:
+            type: number
+          example: 1
+        - name: perPage
+          in: query
+          description: Number of SLOs returned by page
+          schema:
+            type: integer
+            default: 100
+            maximum: 1000
+          example: 100
+      responses:
+        '200':
+          description: Successful request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/find_slo_definitions_response'
+        '400':
+          description: Bad request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/400_response'
+        '401':
+          description: Unauthorized response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/401_response'
+        '403':
+          description: Unauthorized response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/403_response'
   /s/{spaceId}/api/observability/slos/_delete_instances:
     post:
       summary: Batch delete rollup and summary data for the matching list of sloId and instanceId
@@ -1102,7 +1207,7 @@ components:
           example: 0.9836
         errorBudget:
           $ref: '#/components/schemas/error_budget'
-    slo_response:
+    slo_with_summary_response:
       title: SLO response
       type: object
       required:
@@ -1122,6 +1227,7 @@ components:
         - tags
         - createdAt
         - updatedAt
+        - version
       properties:
         id:
           description: The identifier of the SLO.
@@ -1191,6 +1297,10 @@ components:
           description: The last update date
           type: string
           example: '2023-01-12T10:03:19.000Z'
+        version:
+          description: The internal SLO version
+          type: number
+          example: 2
     find_slo_response:
       title: Find SLO response
       description: |
@@ -1209,7 +1319,7 @@ components:
         results:
           type: array
           items:
-            $ref: '#/components/schemas/slo_response'
+            $ref: '#/components/schemas/slo_with_summary_response'
     400_response:
       title: Bad request
       type: object
@@ -1385,6 +1495,92 @@ components:
           type: array
           items:
             type: string
+    slo_definition_response:
+      title: SLO definition response
+      type: object
+      required:
+        - id
+        - name
+        - description
+        - indicator
+        - timeWindow
+        - budgetingMethod
+        - objective
+        - settings
+        - revision
+        - enabled
+        - groupBy
+        - tags
+        - createdAt
+        - updatedAt
+        - version
+      properties:
+        id:
+          description: The identifier of the SLO.
+          type: string
+          example: 8853df00-ae2e-11ed-90af-09bb6422b258
+        name:
+          description: The name of the SLO.
+          type: string
+          example: My Service SLO
+        description:
+          description: The description of the SLO.
+          type: string
+          example: My SLO description
+        indicator:
+          discriminator:
+            propertyName: type
+            mapping:
+              sli.apm.transactionErrorRate: '#/components/schemas/indicator_properties_apm_availability'
+              sli.kql.custom: '#/components/schemas/indicator_properties_custom_kql'
+              sli.apm.transactionDuration: '#/components/schemas/indicator_properties_apm_latency'
+              sli.metric.custom: '#/components/schemas/indicator_properties_custom_metric'
+              sli.histogram.custom: '#/components/schemas/indicator_properties_histogram'
+              sli.metric.timeslice: '#/components/schemas/indicator_properties_timeslice_metric'
+          oneOf:
+            - $ref: '#/components/schemas/indicator_properties_custom_kql'
+            - $ref: '#/components/schemas/indicator_properties_apm_availability'
+            - $ref: '#/components/schemas/indicator_properties_apm_latency'
+            - $ref: '#/components/schemas/indicator_properties_custom_metric'
+            - $ref: '#/components/schemas/indicator_properties_histogram'
+            - $ref: '#/components/schemas/indicator_properties_timeslice_metric'
+        timeWindow:
+          $ref: '#/components/schemas/time_window'
+        budgetingMethod:
+          $ref: '#/components/schemas/budgeting_method'
+        objective:
+          $ref: '#/components/schemas/objective'
+        settings:
+          $ref: '#/components/schemas/settings'
+        revision:
+          description: The SLO revision
+          type: number
+          example: 2
+        enabled:
+          description: Indicate if the SLO is enabled
+          type: boolean
+          example: true
+        groupBy:
+          description: optional group by field to use to generate an SLO per distinct value
+          type: string
+          example: some.field
+        tags:
+          description: List of tags
+          type: array
+          items:
+            type: string
+        createdAt:
+          description: The creation date
+          type: string
+          example: '2023-01-12T10:03:19.000Z'
+        updatedAt:
+          description: The last update date
+          type: string
+          example: '2023-01-12T10:03:19.000Z'
+        version:
+          description: The internal SLO version
+          type: number
+          example: 2
     historical_summary_request:
       title: Historical summary request
       type: object
@@ -1415,6 +1611,25 @@ components:
               example: 0.9836
             errorBudget:
               $ref: '#/components/schemas/error_budget'
+    find_slo_definitions_response:
+      title: Find SLO definitions response
+      description: |
+        A paginated response of SLO definitions matching the query.
+      type: object
+      properties:
+        page:
+          type: number
+          example: 2
+        perPage:
+          type: number
+          example: 100
+        total:
+          type: number
+          example: 123
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/slo_definition_response'
     delete_slo_instances_request:
       title: Delete SLO instances request
       description: |
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_definitions_response.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_definitions_response.yaml
new file mode 100644
index 00000000000000..274bdc7016a045
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_definitions_response.yaml
@@ -0,0 +1,18 @@
+title: Find SLO definitions response
+description: >
+  A paginated response of SLO definitions matching the query.
+type: object
+properties:
+  page:
+    type: number
+    example: 2
+  perPage:
+    type: number
+    example: 100
+  total:
+    type: number
+    example: 123
+  results:
+    type: array
+    items:
+      $ref: 'slo_definition_response.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_response.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_response.yaml
index 36a701efa34f4a..b94aa6e6dc1c57 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_response.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/find_slo_response.yaml
@@ -15,4 +15,4 @@ properties:
   results:
     type: array
     items:
-      $ref: 'slo_response.yaml'
\ No newline at end of file
+      $ref: 'slo_with_summary_response.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_definition_response.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_definition_response.yaml
new file mode 100644
index 00000000000000..0b4ffa774d10f3
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_definition_response.yaml
@@ -0,0 +1,85 @@
+title: SLO definition response
+type: object
+required:
+  - id
+  - name
+  - description
+  - indicator
+  - timeWindow
+  - budgetingMethod
+  - objective
+  - settings
+  - revision
+  - enabled
+  - groupBy
+  - tags
+  - createdAt
+  - updatedAt
+  - version
+properties:
+  id:
+    description: The identifier of the SLO.
+    type: string
+    example: 8853df00-ae2e-11ed-90af-09bb6422b258
+  name:
+    description: The name of the SLO.
+    type: string
+    example: My Service SLO
+  description:
+    description: The description of the SLO.
+    type: string
+    example: My SLO description
+  indicator:
+    discriminator:
+      propertyName: type
+      mapping:
+        sli.apm.transactionErrorRate: './indicator_properties_apm_availability.yaml'
+        sli.kql.custom: './indicator_properties_custom_kql.yaml'
+        sli.apm.transactionDuration: './indicator_properties_apm_latency.yaml'
+        sli.metric.custom: './indicator_properties_custom_metric.yaml'
+        sli.histogram.custom: './indicator_properties_histogram.yaml'
+        sli.metric.timeslice: './indicator_properties_timeslice_metric.yaml'
+    oneOf:
+      - $ref: "indicator_properties_custom_kql.yaml"
+      - $ref: "indicator_properties_apm_availability.yaml"
+      - $ref: "indicator_properties_apm_latency.yaml"
+      - $ref: "indicator_properties_custom_metric.yaml"
+      - $ref: "indicator_properties_histogram.yaml"
+      - $ref: "indicator_properties_timeslice_metric.yaml"
+  timeWindow:
+    $ref: "time_window.yaml"
+  budgetingMethod:
+    $ref: "budgeting_method.yaml"
+  objective:
+    $ref: "objective.yaml"
+  settings:
+    $ref: "settings.yaml"
+  revision:
+    description: The SLO revision
+    type: number
+    example: 2
+  enabled:
+    description: Indicate if the SLO is enabled
+    type: boolean
+    example: true
+  groupBy:
+    description: optional group by field to use to generate an SLO per distinct value
+    type: string
+    example: "some.field"
+  tags:
+    description: List of tags
+    type: array
+    items:
+      type: string
+  createdAt:
+    description: The creation date
+    type: string
+    example: "2023-01-12T10:03:19.000Z"
+  updatedAt:
+    description: The last update date
+    type: string
+    example: "2023-01-12T10:03:19.000Z"
+  version:
+    description: The internal SLO version
+    type: number
+    example: 2
\ No newline at end of file
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_with_summary_response.yaml
similarity index 96%
rename from x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml
rename to x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_with_summary_response.yaml
index bd58e88c7b641f..df8e35996feb3d 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_with_summary_response.yaml
@@ -17,6 +17,7 @@ required:
   - tags
   - createdAt
   - updatedAt
+  - version
 properties:
   id:
     description: The identifier of the SLO.
@@ -86,3 +87,7 @@ properties:
     description: The last update date
     type: string
     example: "2023-01-12T10:03:19.000Z"
+  version:
+    description: The internal SLO version
+    type: number
+    example: 2
\ No newline at end of file
diff --git a/x-pack/plugins/observability/docs/openapi/slo/entrypoint.yaml b/x-pack/plugins/observability/docs/openapi/slo/entrypoint.yaml
index 687fd94f006a47..b951be467e0062 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/entrypoint.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/entrypoint.yaml
@@ -20,11 +20,15 @@ paths:
   "/s/{spaceId}/api/observability/slos/{sloId}":
     $ref: "paths/s@{spaceid}@api@slos@{sloid}.yaml"
   "/s/{spaceId}/api/observability/slos/{sloId}/enable":
-    $ref: "paths/s@{spaceid}@api@slos@{sloid}@{enable}.yaml"
+    $ref: "paths/s@{spaceid}@api@slos@{sloid}@enable.yaml"
   "/s/{spaceId}/api/observability/slos/{sloId}/disable":
-    $ref: "paths/s@{spaceid}@api@slos@{sloid}@{disable}.yaml"
+    $ref: "paths/s@{spaceid}@api@slos@{sloid}@disable.yaml"
+  "/s/{spaceId}/api/observability/slos/{sloId}/_reset":
+    $ref: "paths/s@{spaceid}@api@slos@{sloid}@_reset.yaml"
   "/s/{spaceId}/internal/observability/slos/_historical_summary":
     $ref: "paths/s@{spaceid}@api@slos@_historical_summary.yaml"
+  "/s/{spaceId}/internal/observability/slos/_definitions":
+    $ref: "paths/s@{spaceid}@api@slos@_definitions.yaml"
   "/s/{spaceId}/api/observability/slos/_delete_instances":
     $ref: "paths/s@{spaceid}@api@slos@_delete_instances.yaml"
 components:
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos.yaml
index b606a0aac05fbf..782e8fb477f94a 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos.yaml
@@ -68,14 +68,14 @@ get:
       example: 'slo.name:latency* and slo.tags : "prod"'
     - name: page
       in: query
-      description: The page number to return
+      description: The page to use for pagination, must be greater or equal than 1
       schema:
         type: integer
         default: 1
       example: 1
     - name: perPage
       in: query
-      description: The number of SLOs to return per page
+      description: Number of SLOs returned by page
       schema:
         type: integer
         default: 25
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@_definitions.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@_definitions.yaml
new file mode 100644
index 00000000000000..508c3cc86f8fe1
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@_definitions.yaml
@@ -0,0 +1,62 @@
+get:
+  summary: Get the SLO definitions
+  operationId: getDefinitionsOp
+  description: >
+    You must have the `read` privileges for the **SLOs** feature in the
+    **Observability** section of the Kibana feature privileges.
+  tags:
+    - slo
+  parameters:
+    - $ref: ../components/headers/kbn_xsrf.yaml
+    - $ref: ../components/parameters/space_id.yaml
+    - name: includeOutdatedOnly
+      in: query
+      description: Indicates if the API returns only outdated SLO or all SLO definitions
+      schema:
+        type: boolean
+      example: true
+    - name: search
+      in: query
+      description: Filters the SLOs by name
+      schema:
+        type: string
+      example: 'my service availability'
+    - name: page
+      in: query
+      description: The page to use for pagination, must be greater or equal than 1
+      schema:
+        type: number
+      example: 1
+    - name: perPage
+      in: query
+      description: Number of SLOs returned by page 
+      schema:
+        type: integer
+        default: 100
+        maximum: 1000
+      example: 100
+  responses:
+    '200':
+      description: Successful request
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/find_slo_definitions_response.yaml'
+    '400':
+      description: Bad request
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/400_response.yaml'
+    '401':
+      description: Unauthorized response
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/401_response.yaml'
+    '403':
+      description: Unauthorized response
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/403_response.yaml'
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}.yaml
index a7740b7517464c..76d8f0eb640da1 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}.yaml
@@ -22,7 +22,7 @@ get:
       content:
         application/json:
           schema:
-            $ref: '../components/schemas/slo_response.yaml'
+            $ref: '../components/schemas/slo_with_summary_response.yaml'
     '400':
       description: Bad request
       content:
@@ -72,7 +72,7 @@ put:
       content:
         application/json:
           schema:
-            $ref: '../components/schemas/slo_response.yaml'
+            $ref: '../components/schemas/slo_definition_response.yaml'
     '400':
       description: Bad request
       content:
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@_reset.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@_reset.yaml
new file mode 100644
index 00000000000000..6739d3df78328e
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@_reset.yaml
@@ -0,0 +1,43 @@
+post:
+  summary: Resets an SLO.
+  operationId: resetSloOp
+  description: >
+    You must have the `write` privileges for the **SLOs** feature in the
+    **Observability** section of the Kibana feature privileges.
+  tags:
+    - slo
+  parameters:
+    - $ref: ../components/headers/kbn_xsrf.yaml
+    - $ref: ../components/parameters/space_id.yaml
+    - $ref: ../components/parameters/slo_id.yaml
+  responses:
+    '204':
+      description: Successful request
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/slo_definition_response.yaml'
+    '400':
+      description: Bad request
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/400_response.yaml'
+    '401':
+      description: Unauthorized response
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/401_response.yaml'
+    '403':
+      description: Unauthorized response
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/403_response.yaml'
+    '404':
+      description: Not found response
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/404_response.yaml'
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@{disable}.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@disable.yaml
similarity index 100%
rename from x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@{disable}.yaml
rename to x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@disable.yaml
diff --git a/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@{enable}.yaml b/x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@enable.yaml
similarity index 100%
rename from x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@{enable}.yaml
rename to x-pack/plugins/observability/docs/openapi/slo/paths/s@{spaceid}@api@slos@{sloid}@enable.yaml
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/budget_consumed.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/budget_consumed.tsx
new file mode 100644
index 00000000000000..85806a8b8d4f56
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/budget_consumed.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFieldNumber, EuiFormRow, EuiIconTip } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { ChangeEvent, useState } from 'react';
+import numeral from '@elastic/numeral';
+
+interface Props {
+  initialBurnRate?: number;
+  errors?: string[];
+  onChange: (burnRate: number) => void;
+  longLookbackWindowInHours: number;
+  sloTimeWindowInHours: number;
+}
+
+export function BudgetConsumed({
+  onChange,
+  initialBurnRate = 1,
+  longLookbackWindowInHours,
+  sloTimeWindowInHours,
+  errors,
+}: Props) {
+  const [budgetConsumed, setBudgetConsumed] = useState<number>(
+    ((initialBurnRate * longLookbackWindowInHours) / sloTimeWindowInHours) * 100
+  );
+  const hasError = errors !== undefined && errors.length > 0;
+
+  const onBudgetConsumedChanged = (event: ChangeEvent<HTMLInputElement>) => {
+    const value = Number(event.target.value);
+    setBudgetConsumed(value);
+    const burnRate = sloTimeWindowInHours * (value / 100 / longLookbackWindowInHours);
+    onChange(burnRate);
+  };
+
+  return (
+    <EuiFormRow
+      label={
+        <>
+          {i18n.translate('xpack.observability.slo.rules.budgetConsumed.rowLabel', {
+            defaultMessage: '% Budget consumed',
+          })}{' '}
+          <EuiIconTip
+            position="top"
+            content={i18n.translate('xpack.observability.slo.rules.budgetConsumed.tooltip', {
+              defaultMessage: 'How much budget is consumed before the first alert is fired.',
+            })}
+          />
+        </>
+      }
+      fullWidth
+      isInvalid={hasError}
+    >
+      <EuiFieldNumber
+        fullWidth
+        step={0.01}
+        min={0.01}
+        max={100}
+        value={numeral(budgetConsumed).format('0[.0]')}
+        onChange={(event) => onBudgetConsumedChanged(event)}
+        data-test-subj="budgetConsumed"
+      />
+    </EuiFormRow>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate.tsx
index 1dd225191cb851..ac7b92950fc964 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate.tsx
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate.tsx
@@ -8,13 +8,13 @@
 import { EuiFieldNumber, EuiFormRow, EuiIconTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { ChangeEvent, useState } from 'react';
+import numeral from '@elastic/numeral';
 
 interface Props {
   initialBurnRate?: number;
   maxBurnRate: number;
   errors?: string[];
   onChange: (burnRate: number) => void;
-  helpText?: string;
 }
 
 export function BurnRate({ onChange, initialBurnRate = 1, maxBurnRate, errors }: Props) {
@@ -48,10 +48,10 @@ export function BurnRate({ onChange, initialBurnRate = 1, maxBurnRate, errors }:
     >
       <EuiFieldNumber
         fullWidth
-        step={0.1}
-        min={1}
+        step={0.01}
+        min={0.01}
         max={maxBurnRate}
-        value={String(burnRate)}
+        value={numeral(burnRate).format('0[.0]')}
         onChange={(event) => onBurnRateChange(event)}
         data-test-subj="burnRate"
       />
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
index fc3e0bf71452b7..e1e858df495a35 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
@@ -118,21 +118,14 @@ export function BurnRateRuleEditor(props: Props) {
         </>
       )}
       <EuiSpacer size="l" />
-      <EuiTitle size="xs">
-        <h5>
-          {i18n.translate('xpack.observability.burnRateRuleEditor.h5.defineMultipleBurnRateLabel', {
-            defaultMessage: 'Define multiple burn rate windows',
-          })}
-        </h5>
-      </EuiTitle>
-      <EuiSpacer size="s" />
-      <Windows
-        slo={selectedSlo}
-        windows={windowDefs}
-        onChange={setWindowDefs}
-        errors={errors.windows}
-      />
-      <EuiSpacer size="m" />
+      {selectedSlo && (
+        <Windows
+          slo={selectedSlo}
+          windows={windowDefs}
+          onChange={setWindowDefs}
+          errors={errors.windows}
+        />
+      )}
     </>
   );
 }
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/slo_selector.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/slo_selector.tsx
index 5ec21da2efc1c6..6e35ce265bad54 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/slo_selector.tsx
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/slo_selector.tsx
@@ -22,7 +22,7 @@ function SloSelector({ initialSlo, onSelected, errors }: Props) {
   const [options, setOptions] = useState<Array<EuiComboBoxOptionOption<string>>>([]);
   const [selectedOptions, setSelectedOptions] = useState<Array<EuiComboBoxOptionOption<string>>>();
   const [searchValue, setSearchValue] = useState<string>('');
-  const { isLoading, data: sloList } = useFetchSloDefinitions({ name: searchValue });
+  const { isLoading, data } = useFetchSloDefinitions({ name: searchValue });
   const hasError = errors !== undefined && errors.length > 0;
 
   useEffect(() => {
@@ -30,17 +30,17 @@ function SloSelector({ initialSlo, onSelected, errors }: Props) {
   }, [initialSlo]);
 
   useEffect(() => {
-    const isLoadedWithData = !isLoading && sloList !== undefined;
+    const isLoadedWithData = !isLoading && !!data?.results;
     const opts: Array<EuiComboBoxOptionOption<string>> = isLoadedWithData
-      ? sloList.map((slo) => ({ value: slo.id, label: slo.name }))
+      ? data?.results?.map((slo) => ({ value: slo.id, label: slo.name }))
       : [];
     setOptions(opts);
-  }, [isLoading, sloList]);
+  }, [isLoading, data]);
 
   const onChange = (opts: Array<EuiComboBoxOptionOption<string>>) => {
     setSelectedOptions(opts);
     const selectedSlo =
-      opts.length === 1 ? sloList?.find((slo) => slo.id === opts[0].value) : undefined;
+      opts.length === 1 ? data?.results?.find((slo) => slo.id === opts[0].value) : undefined;
     onSelected(selectedSlo);
   };
 
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.test.ts b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.test.ts
index d351a2555f6b5e..4e4d7fbc665566 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.test.ts
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.test.ts
@@ -44,7 +44,7 @@ describe('ValidateBurnRateRule', () => {
     expect(errors.windows[0].burnRateThreshold).toHaveLength(1);
   });
 
-  it('validates burnRateThreshold is between 1 and maxBurnRateThreshold', () => {
+  it('validates burnRateThreshold is between 0.01 and maxBurnRateThreshold', () => {
     expect(
       validateBurnRateRule(
         createTestParams({
@@ -55,7 +55,7 @@ describe('ValidateBurnRateRule', () => {
     ).toHaveLength(1);
 
     expect(
-      validateBurnRateRule(createTestParams({ burnRateThreshold: 0.99 })).errors.windows[0]
+      validateBurnRateRule(createTestParams({ burnRateThreshold: 0.001 })).errors.windows[0]
         .burnRateThreshold
     ).toHaveLength(1);
 
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.ts b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.ts
index 20920350f5920d..c184a8fb5c445d 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.ts
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/validation.ts
@@ -46,7 +46,7 @@ export function validateBurnRateRule(
       const result = { longWindow: new Array<string>(), burnRateThreshold: new Array<string>() };
       if (burnRateThreshold === undefined || maxBurnRateThreshold === undefined) {
         result.burnRateThreshold.push(BURN_RATE_THRESHOLD_REQUIRED);
-      } else if (sloId && (burnRateThreshold < 1 || burnRateThreshold > maxBurnRateThreshold)) {
+      } else if (sloId && (burnRateThreshold < 0.01 || burnRateThreshold > maxBurnRateThreshold)) {
         result.burnRateThreshold.push(getInvalidThresholdValueError(maxBurnRateThreshold));
       }
       if (longWindow === undefined) {
@@ -89,6 +89,6 @@ const BURN_RATE_THRESHOLD_REQUIRED = i18n.translate(
 
 const getInvalidThresholdValueError = (maxBurnRate: number) =>
   i18n.translate('xpack.observability.slo.rules.burnRate.errors.invalidThresholdValue', {
-    defaultMessage: 'Burn rate threshold must be between 1 and {maxBurnRate}.',
+    defaultMessage: 'Burn rate threshold must be between 0.01 and {maxBurnRate}.',
     values: { maxBurnRate },
   });
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/windows.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/windows.tsx
index 3f468e21c64793..d4eb6e4627c294 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/windows.tsx
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/windows.tsx
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import React from 'react';
+import React, { useState } from 'react';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -14,6 +14,8 @@ import {
   EuiSelect,
   EuiFormRow,
   EuiText,
+  EuiTitle,
+  EuiSwitch,
 } from '@elastic/eui';
 import { SLOResponse } from '@kbn/slo-schema';
 import { i18n } from '@kbn/i18n';
@@ -31,6 +33,7 @@ import {
   MEDIUM_PRIORITY_ACTION,
 } from '../../../common/constants';
 import { WindowResult } from './validation';
+import { BudgetConsumed } from './budget_consumed';
 
 interface WindowProps extends WindowSchema {
   slo?: SLOResponse;
@@ -38,6 +41,7 @@ interface WindowProps extends WindowSchema {
   onDelete: (id: string) => void;
   disableDelete: boolean;
   errors: WindowResult;
+  budgetMode: boolean;
 }
 
 const ACTION_GROUP_OPTIONS = [
@@ -65,6 +69,7 @@ function Window({
   onDelete,
   errors,
   disableDelete,
+  budgetMode = false,
 }: WindowProps) {
   const onLongWindowDurationChange = (duration: Duration) => {
     const longWindowDurationInMinutes = toMinutes(duration);
@@ -112,6 +117,17 @@ function Window({
     return 'N/A';
   };
 
+  const sloTimeWindowInHours = Math.round(
+    toMinutes(toDuration(slo?.timeWindow.duration ?? '30d')) / 60
+  );
+
+  const computeBudgetConsumed = () => {
+    if (slo && longWindow.value > 0 && burnRateThreshold > 0) {
+      return (burnRateThreshold * longWindow.value) / sloTimeWindowInHours;
+    }
+    return 0;
+  };
+
   const allErrors = [...errors.longWindow, ...errors.burnRateThreshold];
 
   return (
@@ -125,15 +141,27 @@ function Window({
             errors={errors.longWindow}
           />
         </EuiFlexItem>
-        <EuiFlexItem>
-          <BurnRate
-            initialBurnRate={burnRateThreshold}
-            maxBurnRate={maxBurnRateThreshold}
-            onChange={onBurnRateChange}
-            errors={errors.burnRateThreshold}
-            helpText={getErrorBudgetExhaustionText(computeErrorBudgetExhaustionInHours())}
-          />
-        </EuiFlexItem>
+        {!budgetMode && (
+          <EuiFlexItem>
+            <BurnRate
+              initialBurnRate={burnRateThreshold}
+              maxBurnRate={maxBurnRateThreshold}
+              onChange={onBurnRateChange}
+              errors={errors.burnRateThreshold}
+            />
+          </EuiFlexItem>
+        )}
+        {budgetMode && (
+          <EuiFlexItem>
+            <BudgetConsumed
+              initialBurnRate={burnRateThreshold}
+              onChange={onBurnRateChange}
+              errors={errors.burnRateThreshold}
+              sloTimeWindowInHours={sloTimeWindowInHours}
+              longLookbackWindowInHours={longWindow.value}
+            />
+          </EuiFlexItem>
+        )}
         <EuiFlexItem>
           <EuiFormRow
             label={i18n.translate('xpack.observability.slo.rules.actionGroupSelectorLabel', {
@@ -177,20 +205,43 @@ function Window({
         </EuiText>
       )}
       <EuiText color="subdued" size="xs">
-        <p>{getErrorBudgetExhaustionText(computeErrorBudgetExhaustionInHours())}</p>
+        <p>
+          {getErrorBudgetExhaustionText(
+            computeErrorBudgetExhaustionInHours(),
+            computeBudgetConsumed(),
+            burnRateThreshold,
+            budgetMode
+          )}
+        </p>
       </EuiText>
       <EuiSpacer size="s" />
     </>
   );
 }
 
-const getErrorBudgetExhaustionText = (formattedHours: string) =>
-  i18n.translate('xpack.observability.slo.rules.errorBudgetExhaustion.text', {
-    defaultMessage: '{formatedHours} hours until error budget exhaustion.',
-    values: {
-      formatedHours: formattedHours,
-    },
-  });
+const getErrorBudgetExhaustionText = (
+  formattedHours: string,
+  budgetConsumed: number,
+  burnRateThreshold: number,
+  budgetMode = false
+) =>
+  budgetMode
+    ? i18n.translate('xpack.observability.slo.rules.errorBudgetExhaustion.budgetMode.text', {
+        defaultMessage:
+          '{formatedHours} hours until error budget exhaustion. The burn rate threshold is {burnRateThreshold}x.',
+        values: {
+          formatedHours: formattedHours,
+          burnRateThreshold: numeral(burnRateThreshold).format('0[.0]'),
+        },
+      })
+    : i18n.translate('xpack.observability.slo.rules.errorBudgetExhaustion.burnRateMode.text', {
+        defaultMessage:
+          '{formatedHours} hours until error budget exhaustion. {budgetConsumed} budget consumed before first alert.',
+        values: {
+          formatedHours: formattedHours,
+          budgetConsumed: numeral(budgetConsumed).format('0.00%'),
+        },
+      });
 
 export const createNewWindow = (
   slo?: SLOResponse,
@@ -217,6 +268,7 @@ interface WindowsProps {
 }
 
 export function Windows({ slo, windows, errors, onChange, totalNumberOfWindows }: WindowsProps) {
+  const [budgetMode, setBudgetMode] = useState<boolean>(false);
   const handleWindowChange = (windowDef: WindowSchema) => {
     onChange(windows.map((def) => (windowDef.id === def.id ? windowDef : def)));
   };
@@ -229,8 +281,20 @@ export function Windows({ slo, windows, errors, onChange, totalNumberOfWindows }
     onChange([...windows, createNewWindow()]);
   };
 
+  const handleModeChange = () => {
+    setBudgetMode((previous) => !previous);
+  };
+
   return (
     <>
+      <EuiTitle size="xs">
+        <h5>
+          {i18n.translate('xpack.observability.burnRateRuleEditor.h5.defineMultipleBurnRateLabel', {
+            defaultMessage: 'Define multiple burn rate windows',
+          })}
+        </h5>
+      </EuiTitle>
+      <EuiSpacer size="s" />
       {windows.map((windowDef, index) => {
         const windowErrors = errors[index] || {
           longWindow: new Array<string>(),
@@ -245,25 +309,41 @@ export function Windows({ slo, windows, errors, onChange, totalNumberOfWindows }
             onChange={handleWindowChange}
             onDelete={handleWindowDelete}
             disableDelete={windows.length === 1}
+            budgetMode={budgetMode}
           />
         );
       })}
-      <EuiButtonEmpty
-        data-test-subj="sloBurnRateRuleAddWindowButton"
-        color={'primary'}
-        size="xs"
-        iconType={'plusInCircleFilled'}
-        onClick={handleAddWindow}
-        isDisabled={windows.length === (totalNumberOfWindows || 4)}
-        aria-label={i18n.translate('xpack.observability.slo.rules.addWindowAriaLabel', {
-          defaultMessage: 'Add window',
-        })}
-      >
-        <FormattedMessage
-          id="xpack.observability.slo.rules.addWIndowLabel"
-          defaultMessage="Add window"
-        />
-      </EuiButtonEmpty>
+      <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+        <EuiFlexItem grow={0}>
+          <EuiButtonEmpty
+            data-test-subj="sloBurnRateRuleAddWindowButton"
+            color={'primary'}
+            size="s"
+            iconType={'plusInCircleFilled'}
+            onClick={handleAddWindow}
+            isDisabled={windows.length === (totalNumberOfWindows || 4)}
+            aria-label={i18n.translate('xpack.observability.slo.rules.addWindowAriaLabel', {
+              defaultMessage: 'Add window',
+            })}
+          >
+            <FormattedMessage
+              id="xpack.observability.slo.rules.addWIndowLabel"
+              defaultMessage="Add window"
+            />
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem grow={0}>
+          <EuiSwitch
+            compressed
+            onChange={handleModeChange}
+            checked={budgetMode}
+            label={i18n.translate('xpack.observability.slo.rules.useBudgetConsumedModeLabel', {
+              defaultMessage: 'Budget consumed mode',
+            })}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="m" />
     </>
   );
 }
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/__snapshots__/alert_details_app_section.test.tsx.snap b/x-pack/plugins/observability/public/components/custom_threshold/components/__snapshots__/alert_details_app_section.test.tsx.snap
index ca106766d89e9c..2e121934357263 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/__snapshots__/alert_details_app_section.test.tsx.snap
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/__snapshots__/alert_details_app_section.test.tsx.snap
@@ -22,8 +22,14 @@ Array [
       "title": "unknown-index",
     },
     "expression": Object {
-      "aggType": "count",
+      "aggType": "custom",
       "comparator": ">",
+      "metrics": Array [
+        Object {
+          "aggType": "count",
+          "name": "A",
+        },
+      ],
       "threshold": Array [
         2000,
       ],
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.test.tsx
index 2e035cdcf8fb8d..d1ab267f1ce23f 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.test.tsx
@@ -13,9 +13,9 @@ import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { render } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import {
-  buildMetricThresholdAlert,
-  buildMetricThresholdRule,
-} from '../mocks/metric_threshold_rule';
+  buildCustomThresholdAlert,
+  buildCustomThresholdRule,
+} from '../mocks/custom_threshold_rule';
 import AlertDetailsAppSection from './alert_details_app_section';
 import { ExpressionChart } from './expression_chart';
 
@@ -59,8 +59,8 @@ describe('AlertDetailsAppSection', () => {
       <IntlProvider locale="en">
         <QueryClientProvider client={queryClient}>
           <AlertDetailsAppSection
-            alert={buildMetricThresholdAlert()}
-            rule={buildMetricThresholdRule()}
+            alert={buildCustomThresholdAlert()}
+            rule={buildCustomThresholdRule()}
             ruleLink={ruleLink}
             setAlertSummaryFields={mockedSetAlertSummaryFields}
           />
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.tsx
index 11a85e6b17bc28..a5a029d764a892 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_details_app_section.tsx
@@ -28,28 +28,27 @@ import {
   AlertActiveTimeRangeAnnotation,
 } from '@kbn/observability-alert-details';
 import { DataView } from '@kbn/data-views-plugin/common';
+import { MetricsExplorerChartType } from '../../../../common/custom_threshold_rule/types';
 import { useKibana } from '../../../utils/kibana_react';
 import { metricValueFormatter } from '../../../../common/custom_threshold_rule/metric_value_formatter';
 import { AlertSummaryField, TopAlert } from '../../..';
-import { generateUniqueKey } from '../lib/generate_unique_key';
 
 import { ExpressionChart } from './expression_chart';
 import { TIME_LABELS } from './criterion_preview_chart/criterion_preview_chart';
 import { Threshold } from './custom_threshold';
-import { MetricsExplorerChartType } from '../hooks/use_metrics_explorer_options';
-import { AlertParams, MetricThresholdRuleTypeParams } from '../types';
+import { AlertParams, CustomThresholdRuleTypeParams } from '../types';
 
 // TODO Use a generic props for app sections https://github.com/elastic/kibana/issues/152690
-export type MetricThresholdRule = Rule<MetricThresholdRuleTypeParams>;
-export type MetricThresholdAlert = TopAlert;
+export type CustomThresholdRule = Rule<CustomThresholdRuleTypeParams>;
+export type CustomThresholdAlert = TopAlert;
 
 const DEFAULT_DATE_FORMAT = 'YYYY-MM-DD HH:mm';
 const ALERT_START_ANNOTATION_ID = 'alert_start_annotation';
 const ALERT_TIME_RANGE_ANNOTATION_ID = 'alert_time_range_annotation';
 
 interface AppSectionProps {
-  alert: MetricThresholdAlert;
-  rule: MetricThresholdRule;
+  alert: CustomThresholdAlert;
+  rule: CustomThresholdRule;
   ruleLink: string;
   setAlertSummaryFields: React.Dispatch<React.SetStateAction<AlertSummaryField[] | undefined>>;
 }
@@ -132,13 +131,10 @@ export default function AlertDetailsAppSection({
   const overview = !!ruleParams.criteria ? (
     <EuiFlexGroup direction="column" data-test-subj="thresholdAlertOverviewSection">
       {ruleParams.criteria.map((criterion, index) => (
-        <EuiFlexItem key={generateUniqueKey(criterion)}>
+        <EuiFlexItem key={`criterion-${index}`}>
           <EuiPanel hasBorder hasShadow={false}>
             <EuiTitle size="xs">
-              <h4>
-                {criterion.aggType.toUpperCase()}{' '}
-                {'metric' in criterion ? criterion.metric : undefined}
-              </h4>
+              <h4>{criterion.aggType.toUpperCase()} </h4>
             </EuiTitle>
             <EuiText size="s" color="subdued">
               <FormattedMessage
@@ -155,11 +151,14 @@ export default function AlertDetailsAppSection({
               <EuiFlexItem style={{ minHeight: 150, minWidth: 160 }} grow={1}>
                 <Threshold
                   chartProps={chartProps}
-                  id={`threshold-${generateUniqueKey(criterion)}`}
-                  threshold={criterion.threshold[0]}
+                  id={`threshold-${index}`}
+                  threshold={criterion.threshold}
                   value={alert.fields[ALERT_EVALUATION_VALUES]![index]}
                   valueFormatter={(d) =>
-                    metricValueFormatter(d, 'metric' in criterion ? criterion.metric : undefined)
+                    metricValueFormatter(
+                      d,
+                      criterion.metrics[0] ? criterion.metrics[0].name : undefined
+                    )
                   }
                   title={i18n.translate(
                     'xpack.observability.customThreshold.rule.alertDetailsAppSection.thresholdTitle',
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_flyout.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_flyout.tsx
index dc4ef4407c82c4..1a90ffc7460c52 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/alert_flyout.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/alert_flyout.tsx
@@ -8,17 +8,11 @@
 import React, { useCallback, useContext, useMemo } from 'react';
 
 import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '@kbn/rule-data-utils';
-import { MetricsExplorerSeries } from '../../../../common/custom_threshold_rule/metrics_explorer';
-
 import { TriggerActionsContext } from './triggers_actions_context';
-import { useAlertPrefillContext } from '../helpers/use_alert_prefill';
-import { MetricsExplorerOptions } from '../hooks/use_metrics_explorer_options';
 import { observabilityRuleCreationValidConsumers } from '../../../../common/constants';
 
 interface Props {
   visible?: boolean;
-  options?: Partial<MetricsExplorerOptions>;
-  series?: MetricsExplorerSeries;
   setVisible: React.Dispatch<React.SetStateAction<boolean>>;
 }
 
@@ -34,14 +28,9 @@ export function AlertFlyout(props: Props) {
         onClose: onCloseFlyout,
         canChangeTrigger: false,
         ruleTypeId: OBSERVABILITY_THRESHOLD_RULE_TYPE_ID,
-        metadata: {
-          currentOptions: props.options,
-          series: props.series,
-        },
         validConsumers: observabilityRuleCreationValidConsumers,
         useRuleProducer: true,
       }),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [triggersActionsUI, onCloseFlyout]
   );
 
@@ -49,8 +38,5 @@ export function AlertFlyout(props: Props) {
 }
 
 export function PrefilledThresholdAlertFlyout({ onClose }: { onClose(): void }) {
-  const { metricThresholdPrefill } = useAlertPrefillContext();
-  const { groupBy, filterQuery, metrics } = metricThresholdPrefill;
-
-  return <AlertFlyout options={{ groupBy, filterQuery, metrics }} visible setVisible={onClose} />;
+  return <AlertFlyout visible setVisible={onClose} />;
 }
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/criterion_preview_chart/criterion_preview_chart.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/criterion_preview_chart/criterion_preview_chart.tsx
index a5ed7cd38c580c..5669f7a190f81a 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/criterion_preview_chart/criterion_preview_chart.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/criterion_preview_chart/criterion_preview_chart.tsx
@@ -12,10 +12,17 @@ import { i18n } from '@kbn/i18n';
 import { EuiLoadingChart, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { sum, min as getMin, max as getMax } from 'lodash';
-import { GetLogAlertsChartPreviewDataSuccessResponsePayload } from '../../../../../common/custom_threshold_rule/types';
 import { formatNumber } from '../../../../../common/custom_threshold_rule/formatters/number';
 
-type Series = GetLogAlertsChartPreviewDataSuccessResponsePayload['data']['series'];
+interface Point {
+  timestamp: number;
+  value: number;
+}
+
+type Series = Array<{
+  id: string;
+  points: Point[];
+}>;
 
 export const NUM_BUCKETS = 20;
 
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.stories.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.stories.tsx
index f58894e7918d9e..e4580ee6dc68f9 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.stories.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.stories.tsx
@@ -12,14 +12,15 @@ import { decorateWithGlobalStorybookThemeProviders } from '../../../../test_util
 import {
   Aggregators,
   Comparator,
-  MetricExpressionParams,
+  CustomMetricExpressionParams,
 } from '../../../../../common/custom_threshold_rule/types';
+import { CUSTOM_AGGREGATOR } from '../../../../../common/custom_threshold_rule/constants';
 import { TimeUnitChar } from '../../../../../common';
 
 import { CustomEquationEditor, CustomEquationEditorProps } from './custom_equation_editor';
 import { aggregationType } from '../expression_row';
 import { MetricExpression } from '../../types';
-import { validateMetricThreshold } from '../validation';
+import { validateCustomThreshold } from '../validation';
 
 export default {
   title: 'app/Alerts/CustomEquationEditor',
@@ -67,8 +68,8 @@ const CustomEquationEditorTemplate: Story<CustomEquationEditorProps> = (args) =>
   );
 
   useEffect(() => {
-    const validationObject = validateMetricThreshold({
-      criteria: [expression as MetricExpressionParams],
+    const validationObject = validateCustomThreshold({
+      criteria: [expression as CustomMetricExpressionParams],
       searchConfiguration: {},
     });
     setErrors(validationObject.errors[0]);
@@ -89,9 +90,15 @@ export const CustomEquationEditorDefault = CustomEquationEditorTemplate.bind({})
 export const CustomEquationEditorWithEquationErrors = CustomEquationEditorTemplate.bind({});
 export const CustomEquationEditorWithFieldError = CustomEquationEditorTemplate.bind({});
 
-const BASE_ARGS = {
+const BASE_ARGS: Partial<CustomEquationEditorProps> = {
   expression: {
-    aggType: Aggregators.CUSTOM,
+    aggType: CUSTOM_AGGREGATOR,
+    metrics: [
+      {
+        name: 'A',
+        aggType: Aggregators.COUNT,
+      },
+    ],
     timeSize: 1,
     timeUnit: 'm' as TimeUnitChar,
     threshold: [1],
@@ -113,12 +120,16 @@ CustomEquationEditorDefault.args = {
 CustomEquationEditorWithEquationErrors.args = {
   ...BASE_ARGS,
   expression: {
-    ...BASE_ARGS.expression,
+    aggType: CUSTOM_AGGREGATOR,
     equation: 'Math.round(A / B)',
     metrics: [
       { name: 'A', aggType: Aggregators.AVERAGE, field: 'system.cpu.user.pct' },
       { name: 'B', aggType: Aggregators.MAX, field: 'system.cpu.cores' },
     ],
+    timeSize: 1,
+    timeUnit: 'm' as TimeUnitChar,
+    threshold: [1],
+    comparator: Comparator.GT,
   },
   errors: {
     equation:
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.tsx
index d0871dbfb75b24..164db3bac16827 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/custom_equation_editor.tsx
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
 import {
   EuiFieldText,
   EuiFormRow,
@@ -16,15 +17,13 @@ import {
   EuiPopover,
 } from '@elastic/eui';
 import React, { useState, useCallback, useMemo } from 'react';
-import { omit, range, first, xor, debounce } from 'lodash';
+import { range, first, xor, debounce } from 'lodash';
 import { IErrorObject } from '@kbn/triggers-actions-ui-plugin/public';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { DataViewBase } from '@kbn/es-query';
 import { i18n } from '@kbn/i18n';
-import { OMITTED_AGGREGATIONS_FOR_CUSTOM_METRICS } from '../../../../../common/custom_threshold_rule/metrics_explorer';
 import {
   Aggregators,
-  CustomMetricAggTypes,
   CustomThresholdExpressionMetric,
 } from '../../../../../common/custom_threshold_rule/types';
 
@@ -45,7 +44,7 @@ export interface CustomEquationEditorProps {
 
 const NEW_METRIC = {
   name: 'A',
-  aggType: Aggregators.COUNT as CustomMetricAggTypes,
+  aggType: Aggregators.COUNT as Aggregators,
 };
 const MAX_VARIABLES = 26;
 const CHAR_CODE_FOR_A = 65;
@@ -111,14 +110,12 @@ export function CustomEquationEditor({
   const disableAdd = customMetrics?.length === MAX_VARIABLES;
   const disableDelete = customMetrics?.length === 1;
 
-  const filteredAggregationTypes = omit(aggregationTypes, OMITTED_AGGREGATIONS_FOR_CUSTOM_METRICS);
-
   const metricRows = customMetrics?.map((row) => (
     <MetricRowWithAgg
       key={row.name}
       name={row.name}
       aggType={row.aggType}
-      aggregationTypes={filteredAggregationTypes}
+      aggregationTypes={aggregationTypes}
       field={row.field}
       filter={row.filter}
       fields={fields}
@@ -161,6 +158,7 @@ export function CustomEquationEditor({
         <EuiPopover
           button={
             <EuiFormRow
+              data-test-subj="equationAndThreshold"
               fullWidth
               label={i18n.translate(
                 'xpack.observability.customThreshold.rule.alertFlyout.customEquationEditor.equationAndThreshold',
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/metric_row_with_agg.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/metric_row_with_agg.tsx
index 891c0ceaabbb54..51c4713fef264d 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/metric_row_with_agg.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_equation/metric_row_with_agg.tsx
@@ -6,32 +6,29 @@
  */
 
 import {
-  EuiFormRow,
-  EuiFlexItem,
-  EuiFlexGroup,
-  EuiSelect,
   EuiComboBox,
   EuiComboBoxOptionOption,
-  EuiPopover,
   EuiExpression,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiPopover,
+  EuiSelect,
 } from '@elastic/eui';
-import React, { useMemo, useCallback, useState } from 'react';
-import { get } from 'lodash';
-import { i18n } from '@kbn/i18n';
-import { ValidNormalizedTypes } from '@kbn/triggers-actions-ui-plugin/public';
 import { DataViewBase } from '@kbn/es-query';
+import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import {
-  Aggregators,
-  CustomMetricAggTypes,
-} from '../../../../../common/custom_threshold_rule/types';
-import { MetricRowControls } from './metric_row_controls';
-import { NormalizedFields, MetricRowBaseProps } from './types';
-import { ClosablePopoverTitle } from '../closable_popover_title';
+import { ValidNormalizedTypes } from '@kbn/triggers-actions-ui-plugin/public';
+import { get } from 'lodash';
+import React, { useCallback, useMemo, useState } from 'react';
+import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
 import { RuleFlyoutKueryBar } from '../../../rule_kql_filter/kuery_bar';
+import { ClosablePopoverTitle } from '../closable_popover_title';
+import { MetricRowControls } from './metric_row_controls';
+import { MetricRowBaseProps, NormalizedFields } from './types';
 
 interface MetricRowWithAggProps extends MetricRowBaseProps {
-  aggType?: CustomMetricAggTypes;
+  aggType?: Aggregators;
   field?: string;
   dataView: DataViewBase;
   filter?: string;
@@ -93,8 +90,8 @@ export function MetricRowWithAgg({
     (customAggType: string) => {
       onChange({
         name,
-        field,
-        aggType: customAggType as CustomMetricAggTypes,
+        field: customAggType === Aggregators.COUNT ? undefined : field,
+        aggType: customAggType as Aggregators,
       });
     },
     [name, field, onChange]
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.stories.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.stories.tsx
index 8e1e6b590e6014..9598aabcbf70fe 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.stories.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.stories.tsx
@@ -34,7 +34,7 @@ const defaultProps: Props = {
   chartProps: { theme: EUI_CHARTS_THEME_LIGHT.theme, baseTheme: LIGHT_THEME },
   comparator: Comparator.GT,
   id: 'componentId',
-  threshold: 90,
+  threshold: [90],
   title: 'Threshold breached',
   value: 93,
   valueFormatter: (d) => `${d}%`,
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.test.tsx
index a1d61e0ce28cd1..7731792f7b3221 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.test.tsx
@@ -19,7 +19,7 @@ describe('Threshold', () => {
       chartProps: { theme: EUI_CHARTS_THEME_LIGHT.theme, baseTheme: LIGHT_THEME },
       comparator: Comparator.GT,
       id: 'componentId',
-      threshold: 90,
+      threshold: [90],
       title: 'Threshold breached',
       value: 93,
       valueFormatter: (d) => `${d}%`,
@@ -41,4 +41,12 @@ describe('Threshold', () => {
     const component = renderComponent();
     expect(component.queryByTestId('thresholdRule-90-93')).toBeTruthy();
   });
+
+  it('shows component for between', () => {
+    const component = renderComponent({
+      comparator: Comparator.BETWEEN,
+      threshold: [90, 95],
+    });
+    expect(component.queryByTestId('thresholdRule-90-95-93')).toBeTruthy();
+  });
 });
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.tsx
index 0dad6a2d98a185..5f28676eb37b61 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/custom_threshold.tsx
@@ -21,7 +21,7 @@ export interface Props {
   chartProps: ChartProps;
   comparator: Comparator | string;
   id: string;
-  threshold: number;
+  threshold: number[];
   title: string;
   value: number;
   valueFormatter: (d: number) => string;
@@ -48,7 +48,7 @@ export function Threshold({
         minWidth: '100%',
       }}
       hasShadow={false}
-      data-test-subj={`thresholdRule-${threshold}-${value}`}
+      data-test-subj={`thresholdRule-${threshold.join('-')}-${value}`}
     >
       <Chart>
         <Settings theme={theme} baseTheme={baseTheme} locale={i18n.getLocale()} />
@@ -63,7 +63,10 @@ export function Threshold({
                     {i18n.translate(
                       'xpack.observability.customThreshold.rule.thresholdExtraTitle',
                       {
-                        values: { comparator, threshold: valueFormatter(threshold) },
+                        values: {
+                          comparator,
+                          threshold: threshold.map((t) => valueFormatter(t)).join(' - '),
+                        },
                         defaultMessage: `Alert when {comparator} {threshold}`,
                       }
                     )}
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.test.tsx
index e9d6d2c726665f..956391a3f29b78 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.test.tsx
@@ -5,16 +5,17 @@
  * 2.0.
  */
 
-import React, { ReactElement } from 'react';
-import { act } from 'react-dom/test-utils';
 import { LineAnnotation, RectAnnotation } from '@elastic/charts';
-import { DataViewBase } from '@kbn/es-query';
-import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
 // We are using this inside a `jest.mock` call. Jest requires dynamic dependencies to be prefixed with `mock`
 import { coreMock as mockCoreMock } from '@kbn/core/public/mocks';
+import { DataViewBase } from '@kbn/es-query';
+import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
+import React, { ReactElement } from 'react';
+import { act } from 'react-dom/test-utils';
+import { CUSTOM_AGGREGATOR } from '../../../../common/custom_threshold_rule/constants';
+import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
 import { MetricExpression } from '../types';
 import { ExpressionChart } from './expression_chart';
-import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
 
 const mockStartServices = mockCoreMock.createStart();
 
@@ -37,8 +38,8 @@ const mockResponse = {
   series: [{ id: 'Everything', rows: [], columns: [] }],
 };
 
-jest.mock('../hooks/use_metrics_explorer_chart_data', () => ({
-  useMetricsExplorerChartData: () => ({ loading: false, data: { pages: [mockResponse] } }),
+jest.mock('../hooks/use_expression_chart_data', () => ({
+  useExpressionChartData: () => ({ loading: false, data: { pages: [mockResponse] } }),
 }));
 
 describe('ExpressionChart', () => {
@@ -76,7 +77,13 @@ describe('ExpressionChart', () => {
 
   it('should display no data message', async () => {
     const expression: MetricExpression = {
-      aggType: Aggregators.AVERAGE,
+      aggType: CUSTOM_AGGREGATOR,
+      metrics: [
+        {
+          name: 'A',
+          aggType: Aggregators.COUNT,
+        },
+      ],
       timeSize: 1,
       timeUnit: 'm',
       sourceId: 'default',
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.tsx
index e5e9f532b07d0e..c18b2860df95d0 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_chart.tsx
@@ -25,18 +25,11 @@ import { first, last } from 'lodash';
 import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 import { useKibana } from '../../../utils/kibana_react';
-import {
-  MetricsExplorerAggregation,
-  MetricsExplorerRow,
-} from '../../../../common/custom_threshold_rule/metrics_explorer';
 import { Color } from '../../../../common/custom_threshold_rule/color_palette';
-import {
-  MetricsExplorerChartType,
-  MetricsExplorerOptionsMetric,
-} from '../../../../common/custom_threshold_rule/types';
+import { MetricsExplorerChartType } from '../../../../common/custom_threshold_rule/types';
 import { MetricExpression, TimeRange } from '../types';
 import { createFormatterForMetric } from '../helpers/create_formatter_for_metric';
-import { useMetricsExplorerChartData } from '../hooks/use_metrics_explorer_chart_data';
+import { useExpressionChartData } from '../hooks/use_expression_chart_data';
 import {
   ChartContainer,
   LoadingState,
@@ -47,8 +40,8 @@ import {
 import { ThresholdAnnotations } from './criterion_preview_chart/threshold_annotations';
 import { CUSTOM_EQUATION } from '../i18n_strings';
 import { calculateDomain } from '../helpers/calculate_domain';
-import { getMetricId } from '../helpers/get_metric_id';
 import { MetricExplorerSeriesChart } from './series_chart';
+import { MetricsExplorerRow } from '../types';
 
 interface Props {
   expression: MetricExpression;
@@ -74,7 +67,7 @@ export function ExpressionChart({
   timeFieldName,
 }: Props) {
   const { charts, uiSettings } = useKibana().services;
-  const { isLoading, data } = useMetricsExplorerChartData(
+  const { isLoading, data } = useExpressionChartData(
     expression,
     derivedIndexPattern,
     filterQuery,
@@ -106,15 +99,7 @@ export function ExpressionChart({
 
   const firstTimestamp = first(firstSeries.rows)!.timestamp;
   const lastTimestamp = last(firstSeries.rows)!.timestamp;
-  const metric: MetricsExplorerOptionsMetric = {
-    field: expression.metric,
-    aggregation: expression.aggType as MetricsExplorerAggregation,
-    color: Color.color0,
-  };
-
-  if (metric.aggregation === 'custom') {
-    metric.label = expression.label || CUSTOM_EQUATION;
-  }
+  const name = expression.label || CUSTOM_EQUATION;
 
   const dateFormatter =
     firstTimestamp == null || lastTimestamp == null
@@ -130,13 +115,13 @@ export function ExpressionChart({
     rows: firstSeries.rows.map((row) => {
       const newRow: MetricsExplorerRow = { ...row };
       thresholds.forEach((thresholdValue, index) => {
-        newRow[getMetricId(metric, `threshold_${index}`)] = thresholdValue;
+        newRow[`metric_threshold_${index}`] = thresholdValue;
       });
       return newRow;
     }),
   };
 
-  const dataDomain = calculateDomain(series, [metric], false);
+  const dataDomain = calculateDomain(series);
   const domain = {
     max: Math.max(dataDomain.max, last(thresholds) || dataDomain.max) * 1.1,
     min: Math.min(dataDomain.min, first(thresholds) || dataDomain.min) * 0.9, // add 10% floor,
@@ -155,7 +140,8 @@ export function ExpressionChart({
         <Chart ref={chartRef}>
           <MetricExplorerSeriesChart
             type={chartType}
-            metric={metric}
+            name={name}
+            color={Color.color0}
             id="0"
             series={series}
             stack={false}
@@ -192,7 +178,7 @@ export function ExpressionChart({
           <Axis
             id={'values'}
             position={Position.Left}
-            tickFormat={createFormatterForMetric(metric)}
+            tickFormat={createFormatterForMetric(expression.metrics)}
             domain={domain}
           />
           <Tooltip
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.test.tsx
index ed0c4c52f772ca..8b0a4de92bd7e1 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.test.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import { Comparator } from '../../../../common/custom_threshold_rule/types';
 import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
 import React from 'react';
 import { act } from 'react-dom/test-utils';
 
+import { CUSTOM_AGGREGATOR } from '../../../../common/custom_threshold_rule/constants';
+import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
 import { MetricExpression } from '../types';
 import { ExpressionRow } from './expression_row';
 
@@ -22,16 +23,10 @@ describe('ExpressionRow', () => {
           {
             name: 'system.cpu.user.pct',
             type: 'test',
-            searchable: true,
-            aggregatable: true,
-            displayable: true,
           },
           {
             name: 'system.load.1',
             type: 'test',
-            searchable: true,
-            aggregatable: true,
-            displayable: true,
           },
         ]}
         remove={() => {}}
@@ -61,33 +56,45 @@ describe('ExpressionRow', () => {
   }
 
   it('should display thresholds as a percentage for pct metrics', async () => {
-    const expression = {
-      metric: 'system.cpu.user.pct',
+    const expression: MetricExpression = {
+      aggType: CUSTOM_AGGREGATOR,
       comparator: Comparator.GT,
+      metrics: [
+        {
+          name: 'A',
+          aggType: Aggregators.COUNT,
+          field: 'system.cpu.user.pct',
+        },
+      ],
       threshold: [0.5],
       timeSize: 1,
       timeUnit: 'm',
-      aggType: 'custom',
     };
-    const { wrapper, update } = await setup(expression as MetricExpression);
+    const { wrapper, update } = await setup(expression);
     await update();
     const [valueMatch] =
       wrapper
         .html()
         .match(
-          '<span class="euiExpression__value css-uocz3u-euiExpression__value-columns">50</span>'
+          '<span class="euiExpression__value css-uocz3u-euiExpression__value-columns">50%</span>'
         ) ?? [];
     expect(valueMatch).toBeTruthy();
   });
 
   it('should display thresholds as a decimal for all other metrics', async () => {
     const expression = {
-      metric: 'system.load.1',
+      aggType: CUSTOM_AGGREGATOR,
       comparator: Comparator.GT,
+      metrics: [
+        {
+          name: 'A',
+          aggType: Aggregators.COUNT,
+          field: 'system.load.1',
+        },
+      ],
       threshold: [0.5],
       timeSize: 1,
       timeUnit: 'm',
-      aggType: 'custom',
     };
     const { wrapper } = await setup(expression as MetricExpression);
     const [valueMatch] =
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.tsx
index bfb2c2f4c33de2..0f53594bd49e91 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/expression_row.tsx
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
 import {
   EuiButtonIcon,
   EuiFieldText,
@@ -11,7 +12,6 @@ import {
   EuiFlexItem,
   EuiFormRow,
   EuiSpacer,
-  EuiText,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useCallback, useMemo, useState } from 'react';
@@ -19,19 +19,24 @@ import { euiStyled } from '@kbn/kibana-react-plugin/common';
 import {
   AggregationType,
   builtInComparators,
+  COMPARATORS,
   IErrorObject,
   ThresholdExpression,
 } from '@kbn/triggers-actions-ui-plugin/public';
-import { DataViewBase } from '@kbn/es-query';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import { debounce } from 'lodash';
-import { Comparator } from '../../../../common/custom_threshold_rule/types';
-import { AGGREGATION_TYPES, DerivedIndexPattern, MetricExpression } from '../types';
+import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
+import { MetricExpression } from '../types';
 import { CustomEquationEditor } from './custom_equation';
 import { CUSTOM_EQUATION, LABEL_HELP_MESSAGE, LABEL_LABEL } from '../i18n_strings';
 import { decimalToPct, pctToDecimal } from '../helpers/corrected_percent_convert';
 
+// Create a new object with COMPARATORS.NOT_BETWEEN removed as we use OUTSIDE_RANGE
+const updatedBuiltInComparators = { ...builtInComparators };
+delete updatedBuiltInComparators[COMPARATORS.NOT_BETWEEN];
+
 const customComparators = {
-  ...builtInComparators,
+  ...updatedBuiltInComparators,
   [Comparator.OUTSIDE_RANGE]: {
     text: i18n.translate('xpack.observability.customThreshold.rule.alertFlyout.outsideRangeLabel', {
       defaultMessage: 'Is not between',
@@ -42,7 +47,7 @@ const customComparators = {
 };
 
 interface ExpressionRowProps {
-  fields: DerivedIndexPattern['fields'];
+  fields: DataViewFieldBase[];
   expressionId: number;
   expression: MetricExpression;
   errors: IErrorObject;
@@ -74,9 +79,12 @@ export const ExpressionRow: React.FC<ExpressionRowProps> = (props) => {
     canDelete,
   } = props;
 
-  const { metric, comparator = Comparator.GT, threshold = [] } = expression;
+  const { metrics, comparator = Comparator.GT, threshold = [] } = expression;
 
-  const isMetricPct = useMemo(() => Boolean(metric && metric.endsWith('.pct')), [metric]);
+  const isMetricPct = useMemo(
+    () => Boolean(metrics.length === 1 && metrics[0].field?.endsWith('.pct')),
+    [metrics]
+  );
   const [label, setLabel] = useState<string | undefined>(expression?.label || undefined);
 
   const updateComparator = useCallback(
@@ -217,17 +225,8 @@ const ThresholdElement: React.FC<{
         onChangeSelectedThreshold={updateThreshold}
         errors={errors}
         display="fullWidth"
+        unit={isMetricPct ? '%' : ''}
       />
-
-      {isMetricPct && (
-        <div
-          style={{
-            alignSelf: 'center',
-          }}
-        >
-          <EuiText size={'s'}>%</EuiText>
-        </div>
-      )}
     </>
   );
 };
@@ -242,7 +241,7 @@ export const aggregationType: { [key: string]: AggregationType } = {
     ),
     fieldRequired: true,
     validNormalizedTypes: ['number', 'histogram'],
-    value: AGGREGATION_TYPES.AVERAGE,
+    value: Aggregators.AVERAGE,
   },
   max: {
     text: i18n.translate(
@@ -253,7 +252,7 @@ export const aggregationType: { [key: string]: AggregationType } = {
     ),
     fieldRequired: true,
     validNormalizedTypes: ['number', 'date', 'histogram'],
-    value: AGGREGATION_TYPES.MAX,
+    value: Aggregators.MAX,
   },
   min: {
     text: i18n.translate(
@@ -264,7 +263,7 @@ export const aggregationType: { [key: string]: AggregationType } = {
     ),
     fieldRequired: true,
     validNormalizedTypes: ['number', 'date', 'histogram'],
-    value: AGGREGATION_TYPES.MIN,
+    value: Aggregators.MIN,
   },
   cardinality: {
     text: i18n.translate(
@@ -274,20 +273,9 @@ export const aggregationType: { [key: string]: AggregationType } = {
       }
     ),
     fieldRequired: false,
-    value: AGGREGATION_TYPES.CARDINALITY,
+    value: Aggregators.CARDINALITY,
     validNormalizedTypes: ['number', 'string', 'ip', 'date'],
   },
-  rate: {
-    text: i18n.translate(
-      'xpack.observability.customThreshold.rule.alertFlyout.aggregationText.rate',
-      {
-        defaultMessage: 'Rate',
-      }
-    ),
-    fieldRequired: false,
-    value: AGGREGATION_TYPES.RATE,
-    validNormalizedTypes: ['number'],
-  },
   count: {
     text: i18n.translate(
       'xpack.observability.customThreshold.rule.alertFlyout.aggregationText.count',
@@ -296,7 +284,7 @@ export const aggregationType: { [key: string]: AggregationType } = {
       }
     ),
     fieldRequired: false,
-    value: AGGREGATION_TYPES.COUNT,
+    value: Aggregators.COUNT,
     validNormalizedTypes: ['number'],
   },
   sum: {
@@ -307,35 +295,7 @@ export const aggregationType: { [key: string]: AggregationType } = {
       }
     ),
     fieldRequired: false,
-    value: AGGREGATION_TYPES.SUM,
-    validNormalizedTypes: ['number', 'histogram'],
-  },
-  p95: {
-    text: i18n.translate(
-      'xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p95',
-      {
-        defaultMessage: '95th Percentile',
-      }
-    ),
-    fieldRequired: false,
-    value: AGGREGATION_TYPES.P95,
-    validNormalizedTypes: ['number', 'histogram'],
-  },
-  p99: {
-    text: i18n.translate(
-      'xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p99',
-      {
-        defaultMessage: '99th Percentile',
-      }
-    ),
-    fieldRequired: false,
-    value: AGGREGATION_TYPES.P99,
-    validNormalizedTypes: ['number', 'histogram'],
-  },
-  custom: {
-    text: CUSTOM_EQUATION,
-    fieldRequired: false,
-    value: AGGREGATION_TYPES.CUSTOM,
+    value: Aggregators.SUM,
     validNormalizedTypes: ['number', 'histogram'],
   },
 };
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/group_by.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/group_by.tsx
index a0ea640e19366b..199f5357fbea47 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/group_by.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/group_by.tsx
@@ -6,26 +6,26 @@
  */
 
 import { EuiComboBox } from '@elastic/eui';
+import { DataViewFieldBase } from '@kbn/es-query';
 import { i18n } from '@kbn/i18n';
 
 import React, { useCallback } from 'react';
-import { MetricsExplorerOptions } from '../hooks/use_metrics_explorer_options';
-import { DerivedIndexPattern } from '../types';
+
+export type MetricsExplorerFields = Array<DataViewFieldBase & { aggregatable: boolean }>;
+
+export type GroupBy = string | null | string[];
+export interface GroupByOptions {
+  groupBy: GroupBy;
+}
 
 interface Props {
-  options: MetricsExplorerOptions;
-  onChange: (groupBy: string | null | string[]) => void;
-  fields: DerivedIndexPattern['fields'];
+  options: GroupByOptions;
+  onChange: (groupBy: GroupBy) => void;
+  fields: MetricsExplorerFields;
   errorOptions?: string[];
 }
 
-export function MetricsExplorerGroupBy({
-  options,
-  onChange,
-  fields,
-  errorOptions,
-  ...rest
-}: Props) {
+export function GroupBy({ options, onChange, fields, errorOptions, ...rest }: Props) {
   const handleChange = useCallback(
     (selectedOptions: Array<{ label: string }>) => {
       const groupBy = selectedOptions.map((option) => option.label);
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.test.ts b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.test.ts
new file mode 100644
index 00000000000000..bfc8cb955a2b89
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.test.ts
@@ -0,0 +1,205 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { PainlessTinyMathParser } from './painless_tinymath_parser';
+
+describe('PainlessTinyMathParser', () => {
+  it('should parse a simple equation without aggregations A-Z ', () => {
+    const equation = '1 + 1';
+    const parser = new PainlessTinyMathParser({ equation });
+    expect(parser.parse()).toEqual('1+1');
+  });
+  it('should parse a simple equation with one aggregations A', () => {
+    const equation = '100 * A';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual('100*average(system.cpu.system.pct)');
+  });
+  it('should parse a simple equation with two aggregations A and B', () => {
+    const equation = '100 * A + B / 100';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      '100*average(system.cpu.system.pct)+average(system.cpu.user.pct)/100'
+    );
+  });
+  it('should parse an equation with three aggregations A, B and C with parentheses', () => {
+    const equation = '100 * (A + B / 100) - C';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+        C: 'average(system.cpu.cores)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      '100*(average(system.cpu.system.pct)+average(system.cpu.user.pct)/100)-average(system.cpu.cores)'
+    );
+  });
+  it('should parse an equation with one condition', () => {
+    const equation = 'A > 0 ? 10 : 20';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual('ifelse(average(system.cpu.system.pct)>0, 10, 20)');
+  });
+
+  it('should parse an equation with two condition one of them is a single chart', () => {
+    const equation = 'A > B || A ? 20 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>average(system.cpu.user.pct),1,0) + ifelse(average(system.cpu.system.pct) > 0,1,0) > 0, 20, 30)'
+    );
+  });
+  it('should parse an equation with one condition that when TRUE is a condition', () => {
+    const equation = 'A > 0 ? B > 0 ? 10 : 20 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(average(system.cpu.system.pct)>0, ifelse(average(system.cpu.user.pct)>0, 10, 20), 30)'
+    );
+  });
+  it('should parse an equation with two condition with OR', () => {
+    const equation = 'A > 0 || B > 10 ? 100 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>0,1,0) + ifelse(average(system.cpu.user.pct)>10,1,0) > 0, 100, 30)'
+    );
+  });
+  it('should parse an equation with two condition with AND', () => {
+    const equation = 'A > 0 && B > 10 ? 100 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>0,1,0) * ifelse(average(system.cpu.user.pct)>10,1,0) > 0, 100, 30)'
+    );
+  });
+  it('should parse an equation with two condition with OR and NOT with parentheses', () => {
+    const equation = '!(A > 0) || B == 10 ? 100 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>0,0,1) + ifelse(average(system.cpu.user.pct)==10,1,0) > 0, 100, 30)'
+    );
+  });
+  it('should parse an equation with three conditions with mix of OR and AND with parentheses', () => {
+    const equation = '(A > 0 || B == 10) && A < 200 ? 100 : 30';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>0,1,0) + ifelse(average(system.cpu.user.pct)==10,1,0) * ifelse(average(system.cpu.system.pct)<200,1,0) > 0, 100, 30)'
+    );
+  });
+  it('should parse an equation with four conditions with mix of OR and AND with NOT and NOT EQUAL and parentheses where FALSE is a condition', () => {
+    const equation = '!(A > 0) || B !== 10 && !(A < 200 || B == 2) ? 100 : A == 10 ? 200 : 300';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)>0,0,1) + ifelse(average(system.cpu.user.pct)==10,0,1) * ifelse(average(system.cpu.system.pct)<200,0,1) + ifelse(average(system.cpu.user.pct)==2,1,0) > 0, 100, ifelse(average(system.cpu.system.pct)==10, 200, 300))'
+    );
+  });
+
+  it('should parse a complex equation with many nested conditions and many aggregations', () => {
+    const equation =
+      'A == 10 && F == 10 ? B == 20 ? C < 200 ? D > 200 ? 300 : A - D : B/C : 20 : A * C > C * D ? (A+B)/C > 100 ? D !== 20 ? 200 : 100 : 200 : B/C';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+        C: 'average(system.cpu.total.pct)',
+        D: 'average(system.cpu.cores)',
+        E: 'count()',
+        F: 'sum(system.cpu.total.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)==10,1,0) * ifelse(sum(system.cpu.total.pct)==10,1,0) > 0, ifelse(average(system.cpu.user.pct)==20, ifelse(average(system.cpu.total.pct)<200, ifelse(average(system.cpu.cores)>200, 300, average(system.cpu.system.pct)-average(system.cpu.cores)), average(system.cpu.user.pct)/average(system.cpu.total.pct)), 20), ifelse(average(system.cpu.system.pct)*average(system.cpu.total.pct)>average(system.cpu.total.pct)*average(system.cpu.cores), ifelse((average(system.cpu.system.pct)+average(system.cpu.user.pct))/average(system.cpu.total.pct)>100, ifelse(ifelse(average(system.cpu.cores)==20,0,1) > 0, 200, 100), 200), average(system.cpu.user.pct)/average(system.cpu.total.pct)))'
+    );
+  });
+
+  it('should parse a complex equation with deeply nested conditions and many aggregations with parentheses', () => {
+    const equation =
+      'A == 10 && (F == 10 || (B > 20 && B ==20) || D > 20) ? B == 20 ? C < 200 ? D > 200 ? 300 : A - D : B/C : 20 : A * C > C * D ? (A+B)/C > 100 ? D !== 20 ? 200 : 100 : 200 : B/C';
+    const parser = new PainlessTinyMathParser({
+      equation,
+      aggMap: {
+        A: 'average(system.cpu.system.pct)',
+        B: 'average(system.cpu.user.pct)',
+        C: 'average(system.cpu.total.pct)',
+        D: 'average(system.cpu.cores)',
+        E: 'count()',
+        F: 'sum(system.cpu.total.pct)',
+      },
+    });
+    // ✅ checked with Lens Formula editor
+    expect(parser.parse()).toEqual(
+      'ifelse(ifelse(average(system.cpu.system.pct)==10,1,0) * ifelse(sum(system.cpu.total.pct)==10,1,0) + ifelse(average(system.cpu.user.pct)>20,1,0) * ifelse(average(system.cpu.user.pct)==20,1,0) + ifelse(average(system.cpu.cores)>20,1,0) > 0, ifelse(average(system.cpu.user.pct)==20, ifelse(average(system.cpu.total.pct)<200, ifelse(average(system.cpu.cores)>200, 300, average(system.cpu.system.pct)-average(system.cpu.cores)), average(system.cpu.user.pct)/average(system.cpu.total.pct)), 20), ifelse(average(system.cpu.system.pct)*average(system.cpu.total.pct)>average(system.cpu.total.pct)*average(system.cpu.cores), ifelse((average(system.cpu.system.pct)+average(system.cpu.user.pct))/average(system.cpu.total.pct)>100, ifelse(ifelse(average(system.cpu.cores)==20,0,1) > 0, 200, 100), 200), average(system.cpu.user.pct)/average(system.cpu.total.pct)))'
+    );
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.ts b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.ts
new file mode 100644
index 00000000000000..0bbcab23948ba1
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/painless_tinymath_parser.ts
@@ -0,0 +1,208 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// This is a parser of a subset operations/expression/statement of Painless  A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, = to be used in Lens formula editor that uses TinyMath
+// The goal is to parse painless expressions to a format that can be used in Lens formula editor
+// The parser will also replace the characters A-Z with the values from aggMap
+// Example: "A > 0 ? 10 : 20" will be parsed to "ifelse(average(system.cpu.system.pct) > 0, 10, 20)"
+// Technically, this parser is NOT following the normal rules of parsing, means building AST, grammar file, tokenizer, and handling function, because it is a subset of Painless
+// This parser is using a simple recursive function to parse the expression and replace the characters with the values from aggMap
+
+export interface AggMap {
+  [key: string]: string;
+}
+interface PainlessTinyMathParserProps {
+  equation: string;
+  aggMap?: AggMap;
+}
+export class PainlessTinyMathParser {
+  private IF = '?';
+  private ELSE = ':';
+  private AND = '&';
+  private OR = '|';
+  private NOT_EQUAL = '!=';
+  private NOT = '!';
+  private openParenthesesRegex = /^\(*/g;
+  private notRegex = /^\!/g;
+  private closeParenthesesRegex = /\)*$/g;
+  private logicalConditionRegex = /(\s*[|&]{2})/g;
+
+  private aggMap = {};
+  private equation = '';
+
+  constructor({ equation, aggMap }: PainlessTinyMathParserProps) {
+    this.aggMap = aggMap || this.aggMap;
+    this.equation = this.clean(equation) || this.equation;
+    return this;
+  }
+
+  clean(expression: string): string {
+    return expression
+      .replace(/(\s|\n)/g, '')
+      .replace('===', '==')
+      .replace('!==', '!=');
+  }
+
+  diveIntoString(
+    expression: string,
+    levelDownChar: string,
+    levelUpChar: string
+  ): number | undefined {
+    // Search for the first ? and then start count the depth of the nest IFs
+    const expressionLength = expression.length;
+    let currentDepth = 0;
+    for (let i = expression.indexOf(levelDownChar); i < expressionLength; i++) {
+      const char = expression.charAt(i);
+
+      if (char === levelDownChar) {
+        currentDepth += 1;
+      }
+      if (char === levelUpChar) {
+        currentDepth -= 1;
+      }
+      if (currentDepth === 0) {
+        return i;
+      }
+      // IT IS THE LAST CHAR AND THE DEPTH IS NOT 0, SO IT IS INVALID IF ELSE EXPRESSION
+      if (i === expressionLength - 1 && currentDepth !== 0) {
+        throw new Error('Invalid expression');
+      }
+    }
+  }
+
+  replaceCharactersWithAggMap(inputString: string, aggMap: AggMap): string {
+    // Use a regular expression to match any character from 'A' to 'Z'
+    const regex = /[A-Z]/g;
+
+    return inputString.replace(regex, (match) => {
+      const replacement = aggMap[match]; // Get the replacement from the map
+      return replacement ? replacement : match; // Use the replacement or the original character
+    });
+  }
+
+  parseCondition(condition: string): string {
+    // If the condition does not contain any logical operators, return it as it is
+    if (
+      !condition.includes(this.AND) &&
+      !condition.includes(this.OR) &&
+      !condition.includes(this.NOT_EQUAL)
+    ) {
+      return condition;
+    }
+
+    const parts = condition.split(this.logicalConditionRegex);
+    const filteredParts = parts.filter((part) => part.trim() !== '' || part.includes(this.IF));
+    const res = filteredParts.map((part) => {
+      // Handle the OR and AND cases and replace them with + and *
+      if (part.includes('||')) {
+        return part.replace('||', '+').trim();
+      }
+      if (part.includes('&&')) {
+        return part.replace('&&', '*').trim();
+      }
+
+      // Handle the NOT and NOT_EQUAL cases and replace them with == and !=
+      let isNOT = false;
+      if (part.includes(this.NOT)) isNOT = true;
+      if (part.includes(this.NOT_EQUAL)) {
+        part = part.replace('!=', '==');
+      }
+      // Strip the part from the parentheses and the NOT characters
+      let stripedPart = part
+        .replace(this.notRegex, '')
+        .replace(this.openParenthesesRegex, '')
+        .replace(this.closeParenthesesRegex, '')
+        .replace(this.NOT, '')
+        .trim();
+      // Build the ifelse function and switch the true/false position if it is a NOT case
+      // Every condition will be evaluated to 0 or 1 and then we will use the ifelse function to return the correct value
+      // example: ifelse(A > 0, 1, 0) example for NOT: ifelse(A > 0, 0, 1)
+      // If the condition is a single character e.g. A || B, we will add > 0 to it
+      if (/^[A-Z]$/.test(stripedPart)) {
+        stripedPart = stripedPart + ' > 0';
+      }
+      let result = `ifelse(${stripedPart},${isNOT ? '0,1' : '1,0'})`;
+
+      const openParentheses = part.match(this.openParenthesesRegex);
+      const closeParentheses = part.match(this.closeParenthesesRegex);
+
+      // Ignore parentheses if they are opened and closed in the same condition as we put them using ifelse function
+      // Extra parentheses will throw error in Lens
+      // We keep the open parentheses and the closing parentheses that are not part of the same condition
+      if (
+        openParentheses &&
+        openParentheses.length > 0 &&
+        closeParentheses &&
+        closeParentheses.length > 0
+      ) {
+        return result;
+      }
+      // Put back the open parentheses
+      if (openParentheses && openParentheses.length > 0) {
+        result = openParentheses[0] + result;
+      }
+      // Put back the closing parentheses
+      if (closeParentheses && closeParentheses.length > 0) {
+        result = result + closeParentheses[0];
+      }
+      return result;
+    });
+
+    // At the end of the loop, we will have an array of conditions with AND(*) and OR(+)
+    // And to evaluate the whole condition, by wrapping them with ifelse and check if all the conditions are true (>0)
+    const conditions = res.join(' ') + ' > 0';
+    return conditions;
+  }
+
+  getTrueBranch(expression: string) {
+    const lastColonPosition = this.diveIntoString(expression, this.IF, this.ELSE);
+    if (lastColonPosition !== undefined) {
+      return expression.substring(expression.indexOf(this.IF) + 1, lastColonPosition);
+    }
+    return '';
+  }
+
+  getFalseBrach(expression: string) {
+    const lastColonPosition = this.diveIntoString(expression, this.IF, this.ELSE);
+    if (lastColonPosition !== undefined) {
+      return expression.substring(lastColonPosition + 1);
+    }
+    return '';
+  }
+
+  getCondition(expression: string): string {
+    return expression.substring(0, expression.indexOf(this.IF));
+  }
+
+  parse(): string {
+    const recursiveParseConditions = (expression: string): string => {
+      const condition = this.parseCondition(this.getCondition(expression));
+      const trueBranch = this.getTrueBranch(expression);
+      const falseBranch = this.getFalseBrach(expression);
+
+      let fullCondition = `ifelse(${condition}, ${trueBranch}, ${falseBranch})`;
+
+      if (trueBranch.includes(this.IF)) {
+        const parsedTrueBranch = recursiveParseConditions(trueBranch);
+        fullCondition = fullCondition.replace(trueBranch, parsedTrueBranch);
+      }
+      if (falseBranch.includes(this.IF)) {
+        const parsedFalseBranch = recursiveParseConditions(falseBranch);
+        fullCondition = fullCondition.replace(falseBranch, parsedFalseBranch);
+      }
+      const result = this.replaceCharactersWithAggMap(fullCondition, this.aggMap);
+      return result;
+    };
+
+    if (!this.equation || this.equation === '') throw new Error('Invalid Equation');
+
+    if (this.equation.includes(this.IF)) {
+      return recursiveParseConditions(this.equation);
+    }
+    return this.replaceCharactersWithAggMap(this.equation, this.aggMap);
+  }
+}
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.test.tsx
new file mode 100644
index 00000000000000..9226da0ca23705
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.test.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { act } from 'react-dom/test-utils';
+import { DataView } from '@kbn/data-views-plugin/common';
+import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
+import { CUSTOM_AGGREGATOR } from '../../../../../common/custom_threshold_rule/constants';
+import { Comparator, Aggregators } from '../../../../../common/custom_threshold_rule/types';
+import { useKibana } from '../../../../utils/kibana_react';
+import { kibanaStartMock } from '../../../../utils/kibana_react.mock';
+import { MetricExpression } from '../../types';
+import { PreviewChart } from './preview_chart';
+
+jest.mock('../../../../utils/kibana_react');
+
+const useKibanaMock = useKibana as jest.Mock;
+
+const mockKibana = () => {
+  useKibanaMock.mockReturnValue({
+    ...kibanaStartMock.startContract(),
+  });
+};
+
+describe('Preview chart', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockKibana();
+  });
+  async function setup(expression: MetricExpression, dataView?: DataView) {
+    const wrapper = mountWithIntl(
+      <PreviewChart
+        metricExpression={expression}
+        dataView={dataView}
+        filterQuery={''}
+        groupBy={[]}
+        error={{}}
+      />
+    );
+
+    const update = async () =>
+      await act(async () => {
+        await nextTick();
+        wrapper.update();
+      });
+
+    await update();
+
+    return { wrapper, update };
+  }
+
+  it('should display no data message', async () => {
+    const expression: MetricExpression = {
+      aggType: CUSTOM_AGGREGATOR,
+      metrics: [
+        {
+          name: 'A',
+          aggType: Aggregators.COUNT,
+        },
+      ],
+      timeSize: 1,
+      timeUnit: 'm',
+      sourceId: 'default',
+      threshold: [1],
+      comparator: Comparator.GT_OR_EQ,
+    };
+    const { wrapper } = await setup(expression);
+    expect(wrapper.find('[data-test-subj="thresholdRuleNoChartData"]').exists()).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.tsx
new file mode 100644
index 00000000000000..d5a8b763ca7b57
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/preview_chart/preview_chart.tsx
@@ -0,0 +1,339 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React, { useState, useEffect } from 'react';
+import { EuiEmptyPrompt, useEuiTheme } from '@elastic/eui';
+import { FillStyle, OperationType } from '@kbn/lens-plugin/public';
+import { DataView } from '@kbn/data-views-plugin/common';
+import { FormattedMessage } from '@kbn/i18n-react';
+import useAsync from 'react-use/lib/useAsync';
+import {
+  LensAttributes,
+  LensAttributesBuilder,
+  XYChart,
+  XYDataLayer,
+  XYLayerOptions,
+  XYReferenceLinesLayer,
+} from '@kbn/lens-embeddable-utils';
+
+import { IErrorObject } from '@kbn/triggers-actions-ui-plugin/public';
+import { i18n } from '@kbn/i18n';
+import {
+  Aggregators,
+  Comparator,
+  AggType,
+} from '../../../../../common/custom_threshold_rule/types';
+import { useKibana } from '../../../../utils/kibana_react';
+import { MetricExpression } from '../../types';
+import { AggMap, PainlessTinyMathParser } from './painless_tinymath_parser';
+
+interface PreviewChartPros {
+  metricExpression: MetricExpression;
+  dataView?: DataView;
+  filterQuery?: string;
+  groupBy?: string | string[];
+  error?: IErrorObject;
+}
+
+const getOperationTypeFromRuleAggType = (aggType: AggType): OperationType => {
+  if (aggType === Aggregators.AVERAGE) return 'average';
+  if (aggType === Aggregators.CARDINALITY) return 'unique_count';
+  return aggType;
+};
+
+export function PreviewChart({
+  metricExpression,
+  dataView,
+  filterQuery,
+  groupBy,
+  error,
+}: PreviewChartPros) {
+  const {
+    services: { lens },
+  } = useKibana();
+  const { euiTheme } = useEuiTheme();
+  const { metrics, timeSize, timeUnit, threshold, comparator, equation } = metricExpression;
+  const [attributes, setAttributes] = useState<LensAttributes>();
+  const [aggMap, setAggMap] = useState<AggMap>();
+  const [formula, setFormula] = useState<string>('');
+  const [thresholdReferenceLine, setThresholdReferenceLine] = useState<XYReferenceLinesLayer[]>();
+  const [chartLoading, setChartLoading] = useState<boolean>(false);
+  const formulaAsync = useAsync(() => {
+    return lens.stateHelperApi();
+  }, [lens]);
+
+  // Handle Lens error
+  useEffect(() => {
+    // Lens does not expose or provide a way to check if there is an error in the chart, yet.
+    // To work around this, we check if the element with class 'lnsEmbeddedError' is found in the DOM.
+    setTimeout(function () {
+      const errorDiv = document.querySelector('.lnsEmbeddedError');
+      if (errorDiv) {
+        const paragraphElements = errorDiv.querySelectorAll('p');
+        if (!paragraphElements || paragraphElements.length < 2) return;
+        paragraphElements[0].innerText = i18n.translate(
+          'xpack.observability.customThreshold.rule..charts.error_equation.title',
+          {
+            defaultMessage: 'An error occurred while rendering the chart',
+          }
+        );
+        paragraphElements[1].innerText = i18n.translate(
+          'xpack.observability.customThreshold.rule..charts.error_equation.description',
+          {
+            defaultMessage: 'Check the rule equation.',
+          }
+        );
+      }
+    });
+  }, [chartLoading, attributes]);
+
+  // Build the threshold reference line
+  useEffect(() => {
+    if (!threshold) return;
+    const refLayers = [];
+    const isPercent = Boolean(metrics.length === 1 && metrics[0].field?.endsWith('.pct'));
+    const format = {
+      id: isPercent ? 'percent' : 'number',
+      params: {
+        decimals: isPercent ? 0 : 2,
+      },
+    };
+
+    if (
+      comparator === Comparator.OUTSIDE_RANGE ||
+      (comparator === Comparator.BETWEEN && threshold.length === 2)
+    ) {
+      const refLineStart = new XYReferenceLinesLayer({
+        data: [
+          {
+            value: (threshold[0] || 0).toString(),
+            color: euiTheme.colors.danger,
+            fill: comparator === Comparator.OUTSIDE_RANGE ? 'below' : 'above',
+            format,
+          },
+        ],
+      });
+      const refLineEnd = new XYReferenceLinesLayer({
+        data: [
+          {
+            value: (threshold[1] || 0).toString(),
+            color: euiTheme.colors.danger,
+            fill: comparator === Comparator.OUTSIDE_RANGE ? 'above' : 'below',
+            format,
+          },
+        ],
+      });
+
+      refLayers.push(refLineStart, refLineEnd);
+    } else {
+      let fill: FillStyle = 'above';
+      if (comparator === Comparator.LT || comparator === Comparator.LT_OR_EQ) {
+        fill = 'below';
+      }
+      const thresholdRefLine = new XYReferenceLinesLayer({
+        data: [
+          {
+            value: (threshold[0] || 0).toString(),
+            color: euiTheme.colors.danger,
+            fill,
+            format,
+          },
+        ],
+      });
+      // A transparent line to add extra buffer at the top of threshold
+      const bufferRefLine = new XYReferenceLinesLayer({
+        data: [
+          {
+            value: Math.round((threshold[0] || 0) * 1.1).toString(),
+            color: 'transparent',
+            fill,
+            format,
+          },
+        ],
+      });
+      refLayers.push(thresholdRefLine, bufferRefLine);
+    }
+    setThresholdReferenceLine(refLayers);
+  }, [threshold, comparator, euiTheme.colors.danger, metrics]);
+
+  // Build the aggregation map from the metrics
+  useEffect(() => {
+    if (!metrics || metrics.length === 0) {
+      return;
+    }
+    const aggMapFromMetrics = metrics.reduce((acc, metric) => {
+      const operation = getOperationTypeFromRuleAggType(metric.aggType);
+      let sourceField = metric.field;
+
+      if (metric.aggType === Aggregators.COUNT) {
+        sourceField = '___records___';
+      }
+      let operationField = `${operation}(${sourceField})`;
+      if (metric?.filter) {
+        const aggFilter = JSON.stringify(metric.filter).replace(/"|\\/g, '');
+        operationField = `${operation}(${sourceField},kql='${aggFilter}')`;
+      }
+      return {
+        ...acc,
+        [metric.name]: operationField,
+      };
+    }, {} as AggMap);
+
+    setAggMap(aggMapFromMetrics);
+  }, [metrics]);
+
+  // Parse the equation
+  useEffect(() => {
+    try {
+      if (!aggMap) return;
+      const parser = new PainlessTinyMathParser({
+        aggMap,
+        equation: equation || Object.keys(aggMap || {}).join(' + '),
+      });
+
+      setFormula(parser.parse());
+    } catch (e) {
+      // The error will appear on Lens chart.
+      setAttributes(undefined);
+      return;
+    }
+  }, [aggMap, equation]);
+
+  useEffect(() => {
+    if (!formulaAsync.value || !dataView || !formula) {
+      return;
+    }
+    const isPercent = Boolean(metrics.length === 1 && metrics[0].field?.endsWith('.pct'));
+    const baseLayer = {
+      type: 'formula',
+      value: formula,
+      label: 'Custom Threshold',
+      groupBy,
+      format: {
+        id: isPercent ? 'percent' : 'number',
+        params: {
+          decimals: isPercent ? 0 : 2,
+        },
+      },
+      filter: {
+        language: 'kuery',
+        query: filterQuery || '',
+      },
+    };
+
+    const xYDataLayerOptions: XYLayerOptions = {
+      buckets: {
+        type: 'date_histogram',
+        params: {
+          interval: `${timeSize}${timeUnit}`,
+        },
+      },
+      seriesType: 'bar',
+    };
+
+    if (groupBy && groupBy?.length) {
+      xYDataLayerOptions.breakdown = {
+        type: 'top_values',
+        field: groupBy[0],
+        params: {
+          size: 3,
+          secondaryFields: (groupBy as string[]).slice(1),
+          accuracyMode: false,
+        },
+      };
+    }
+
+    const xyDataLayer = new XYDataLayer({
+      data: [baseLayer].map((layer) => ({
+        type: layer.type,
+        value: layer.value,
+        label: layer.label,
+        format: layer.format,
+        filter: layer.filter,
+      })),
+      options: xYDataLayerOptions,
+    });
+
+    const layers: Array<XYDataLayer | XYReferenceLinesLayer> = [xyDataLayer];
+    if (thresholdReferenceLine) {
+      layers.push(...thresholdReferenceLine);
+    }
+    const attributesLens = new LensAttributesBuilder({
+      visualization: new XYChart({
+        visualOptions: {
+          valueLabels: 'hide',
+          axisTitlesVisibilitySettings: {
+            x: true,
+            yLeft: false,
+            yRight: true,
+          },
+        },
+        layers,
+        formulaAPI: formulaAsync.value.formula,
+        dataView,
+      }),
+    }).build();
+    const lensBuilderAtt = { ...attributesLens, type: 'lens' };
+    setAttributes(lensBuilderAtt);
+  }, [
+    comparator,
+    dataView,
+    equation,
+    filterQuery,
+    formula,
+    formulaAsync.value,
+    groupBy,
+    metrics,
+    threshold,
+    thresholdReferenceLine,
+    timeSize,
+    timeUnit,
+  ]);
+
+  if (
+    !dataView ||
+    !attributes ||
+    error?.equation ||
+    Object.keys(error?.metrics || {}).length !== 0 ||
+    !timeSize
+  ) {
+    return (
+      <div style={{ maxHeight: 180, minHeight: 180 }}>
+        <EuiEmptyPrompt
+          iconType="visArea"
+          titleSize="xxs"
+          data-test-subj="thresholdRuleNoChartData"
+          body={
+            <FormattedMessage
+              id="xpack.observability.customThreshold.rule..charts.noData.title"
+              defaultMessage="No chart data available, check the rule {errorSourceField}"
+              values={{
+                errorSourceField:
+                  Object.keys(error?.metrics || {}).length !== 0
+                    ? 'aggregation fields'
+                    : error?.equation
+                    ? 'equation'
+                    : 'conditions',
+              }}
+            />
+          }
+        />
+      </div>
+    );
+  }
+  return (
+    <div>
+      <lens.EmbeddableComponent
+        onLoad={setChartLoading}
+        id="customThresholdPreviewChart"
+        style={{ height: 180 }}
+        timeRange={{ from: `now-${timeSize * 20}${timeUnit}`, to: 'now' }}
+        attributes={attributes}
+        disableTriggers={true}
+      />
+    </div>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/series_chart.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/series_chart.tsx
index c0e35c85580bcb..b5049788dd2a22 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/series_chart.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/series_chart.tsx
@@ -14,21 +14,17 @@ import {
   AreaSeriesStyle,
   BarSeriesStyle,
 } from '@elastic/charts';
-import { MetricsExplorerSeries } from '../../../../common/custom_threshold_rule/metrics_explorer';
+import { MetricsExplorerSeries } from '../types';
 import { Color, colorTransformer } from '../../../../common/custom_threshold_rule/color_palette';
-import {
-  MetricsExplorerChartType,
-  MetricsExplorerOptionsMetric,
-} from '../../../../common/custom_threshold_rule/types';
+import { MetricsExplorerChartType } from '../../../../common/custom_threshold_rule/types';
 
-import { getMetricId } from '../helpers/get_metric_id';
 import { useKibanaTimeZoneSetting } from '../hooks/use_kibana_time_zone_setting';
-import { createMetricLabel } from '../helpers/create_metric_label';
 
 type NumberOrString = string | number;
 
 interface Props {
-  metric: MetricsExplorerOptionsMetric;
+  name: string;
+  color: Color;
   id: NumberOrString | NumberOrString[];
   series: MetricsExplorerSeries;
   type: MetricsExplorerChartType;
@@ -43,17 +39,15 @@ export function MetricExplorerSeriesChart(props: Props) {
   return <MetricsExplorerAreaChart {...props} />;
 }
 
-export function MetricsExplorerAreaChart({ metric, id, series, type, stack, opacity }: Props) {
+export function MetricsExplorerAreaChart({ name, color, id, series, type, stack, opacity }: Props) {
   const timezone = useKibanaTimeZoneSetting();
-  const color = (metric.color && colorTransformer(metric.color)) || colorTransformer(Color.color0);
+  const seriesColor = (color && colorTransformer(color)) || colorTransformer(Color.color0);
 
   const yAccessors = Array.isArray(id)
-    ? id.map((i) => getMetricId(metric, i)).slice(id.length - 1, id.length)
-    : [getMetricId(metric, id)];
+    ? id.map((i) => `metric_${i}`).slice(id.length - 1, id.length)
+    : [`metric_${id}`];
   const y0Accessors =
-    Array.isArray(id) && id.length > 1
-      ? id.map((i) => getMetricId(metric, i)).slice(0, 1)
-      : undefined;
+    Array.isArray(id) && id.length > 1 ? id.map((i) => `metric_${i}`).slice(0, 1) : undefined;
   const chartId = `series-${series.id}-${yAccessors.join('-')}`;
 
   const seriesAreaStyle: RecursivePartial<AreaSeriesStyle> = {
@@ -71,7 +65,7 @@ export function MetricsExplorerAreaChart({ metric, id, series, type, stack, opac
     <AreaSeries
       id={chartId}
       key={chartId}
-      name={createMetricLabel(metric)}
+      name={name}
       xScaleType={ScaleType.Time}
       yScaleType={ScaleType.Linear}
       xAccessor="timestamp"
@@ -80,24 +74,24 @@ export function MetricsExplorerAreaChart({ metric, id, series, type, stack, opac
       data={series.rows}
       stackAccessors={stack ? ['timestamp'] : void 0}
       areaSeriesStyle={seriesAreaStyle}
-      color={color}
+      color={seriesColor}
       timeZone={timezone}
     />
   );
 }
 
-export function MetricsExplorerBarChart({ metric, id, series, stack }: Props) {
+export function MetricsExplorerBarChart({ name, color, id, series, stack }: Props) {
   const timezone = useKibanaTimeZoneSetting();
-  const color = (metric.color && colorTransformer(metric.color)) || colorTransformer(Color.color0);
+  const seriesColor = (color && colorTransformer(color)) || colorTransformer(Color.color0);
 
   const yAccessors = Array.isArray(id)
-    ? id.map((i) => getMetricId(metric, i)).slice(id.length - 1, id.length)
-    : [getMetricId(metric, id)];
+    ? id.map((i) => `metric_${i}`).slice(id.length - 1, id.length)
+    : [`metric_${id}`];
   const chartId = `series-${series.id}-${yAccessors.join('-')}`;
 
   const seriesBarStyle: RecursivePartial<BarSeriesStyle> = {
     rectBorder: {
-      stroke: color,
+      stroke: seriesColor,
       strokeWidth: 1,
       visible: true,
     },
@@ -109,7 +103,7 @@ export function MetricsExplorerBarChart({ metric, id, series, stack }: Props) {
     <BarSeries
       id={chartId}
       key={chartId}
-      name={createMetricLabel(metric)}
+      name={name}
       xScaleType={ScaleType.Time}
       yScaleType={ScaleType.Linear}
       xAccessor="timestamp"
@@ -117,7 +111,7 @@ export function MetricsExplorerBarChart({ metric, id, series, stack }: Props) {
       data={series.rows}
       stackAccessors={stack ? ['timestamp'] : void 0}
       barSeriesStyle={seriesBarStyle}
-      color={color}
+      color={seriesColor}
       timeZone={timezone}
     />
   );
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/components/validation.tsx b/x-pack/plugins/observability/public/components/custom_threshold/components/validation.tsx
index d40a1f2852bcc6..f360b415fa1be0 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/components/validation.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/components/validation.tsx
@@ -11,25 +11,17 @@ import { i18n } from '@kbn/i18n';
 import { ValidationResult } from '@kbn/triggers-actions-ui-plugin/public';
 import { isEmpty } from 'lodash';
 import {
-  Aggregators,
   Comparator,
   CustomMetricExpressionParams,
-  MetricExpressionParams,
 } from '../../../../common/custom_threshold_rule/types';
 
 export const EQUATION_REGEX = /[^A-Z|+|\-|\s|\d+|\.|\(|\)|\/|\*|>|<|=|\?|\:|&|\!|\|]+/g;
 
-const isCustomMetricExpressionParams = (
-  subject: MetricExpressionParams
-): subject is CustomMetricExpressionParams => {
-  return subject.aggType === Aggregators.CUSTOM;
-};
-
-export function validateMetricThreshold({
+export function validateCustomThreshold({
   criteria,
   searchConfiguration,
 }: {
-  criteria: MetricExpressionParams[];
+  criteria: CustomMetricExpressionParams[];
   searchConfiguration: SerializedSearchSourceFields;
 }): ValidationResult {
   const validationResult = { errors: {} };
@@ -46,7 +38,6 @@ export function validateMetricThreshold({
         threshold0: string[];
         threshold1: string[];
       };
-      metric: string[];
       metricsError?: string;
       metrics: Record<string, { aggType?: string; field?: string; filter?: string }>;
       equation?: string;
@@ -187,66 +178,53 @@ export function validateMetricThreshold({
       );
     }
 
-    if (c.aggType !== 'count' && c.aggType !== 'custom' && !c.metric) {
-      errors[id].metric.push(
-        i18n.translate(
-          'xpack.observability.customThreshold.rule.alertFlyout.error.metricRequired',
-          {
-            defaultMessage: 'Metric is required.',
-          }
-        )
+    if (!c.metrics || (c.metrics && c.metrics.length < 1)) {
+      errors[id].metricsError = i18n.translate(
+        'xpack.observability.customThreshold.rule.alertFlyout.error.metricsError',
+        {
+          defaultMessage: 'You must define at least 1 custom metric',
+        }
       );
-    }
-
-    if (isCustomMetricExpressionParams(c)) {
-      if (!c.metrics || (c.metrics && c.metrics.length < 1)) {
-        errors[id].metricsError = i18n.translate(
-          'xpack.observability.customThreshold.rule.alertFlyout.error.metricsError',
-          {
-            defaultMessage: 'You must define at least 1 custom metric',
-          }
-        );
-      } else {
-        c.metrics.forEach((metric) => {
-          const customMetricErrors: { aggType?: string; field?: string; filter?: string } = {};
-          if (!metric.aggType) {
-            customMetricErrors.aggType = i18n.translate(
-              'xpack.observability.customThreshold.rule.alertFlyout.error.metrics.aggTypeRequired',
-              {
-                defaultMessage: 'Aggregation is required',
-              }
-            );
-          }
-          if (metric.aggType !== 'count' && !metric.field) {
-            customMetricErrors.field = i18n.translate(
-              'xpack.observability.customThreshold.rule.alertFlyout.error.metrics.fieldRequired',
-              {
-                defaultMessage: 'Field is required',
-              }
-            );
-          }
-          if (metric.aggType === 'count' && metric.filter) {
-            try {
-              fromKueryExpression(metric.filter);
-            } catch (e) {
-              customMetricErrors.filter = e.message;
+    } else {
+      c.metrics.forEach((metric) => {
+        const customMetricErrors: { aggType?: string; field?: string; filter?: string } = {};
+        if (!metric.aggType) {
+          customMetricErrors.aggType = i18n.translate(
+            'xpack.observability.customThreshold.rule.alertFlyout.error.metrics.aggTypeRequired',
+            {
+              defaultMessage: 'Aggregation is required',
             }
+          );
+        }
+        if (metric.aggType !== 'count' && !metric.field) {
+          customMetricErrors.field = i18n.translate(
+            'xpack.observability.customThreshold.rule.alertFlyout.error.metrics.fieldRequired',
+            {
+              defaultMessage: 'Field is required',
+            }
+          );
+        }
+        if (metric.aggType === 'count' && metric.filter) {
+          try {
+            fromKueryExpression(metric.filter);
+          } catch (e) {
+            customMetricErrors.filter = e.message;
           }
-          if (!isEmpty(customMetricErrors)) {
-            errors[id].metrics[metric.name] = customMetricErrors;
-          }
-        });
-      }
+        }
+        if (!isEmpty(customMetricErrors)) {
+          errors[id].metrics[metric.name] = customMetricErrors;
+        }
+      });
+    }
 
-      if (c.equation && c.equation.match(EQUATION_REGEX)) {
-        errors[id].equation = i18n.translate(
-          'xpack.observability.customThreshold.rule.alertFlyout.error.equation.invalidCharacters',
-          {
-            defaultMessage:
-              'The equation field only supports the following characters: A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, =',
-          }
-        );
-      }
+    if (c.equation && c.equation.match(EQUATION_REGEX)) {
+      errors[id].equation = i18n.translate(
+        'xpack.observability.customThreshold.rule.alertFlyout.error.equation.invalidCharacters',
+        {
+          defaultMessage:
+            'The equation field only supports the following characters: A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, =',
+        }
+      );
     }
   });
 
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
index f11fc9db40b221..78fa6c3244427c 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
@@ -13,12 +13,14 @@ import { queryClient } from '@kbn/osquery-plugin/public/query_client';
 import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
 
 import { Aggregators, Comparator } from '../../../common/custom_threshold_rule/types';
-import { MetricsExplorerMetric } from '../../../common/custom_threshold_rule/metrics_explorer';
 import { useKibana } from '../../utils/kibana_react';
 import { kibanaStartMock } from '../../utils/kibana_react.mock';
 import Expressions from './custom_threshold_rule_expression';
 
 jest.mock('../../utils/kibana_react');
+jest.mock('./components/preview_chart/preview_chart', () => ({
+  PreviewChart: jest.fn(() => <div data-test-subj="ExpressionChart" />),
+}));
 
 const useKibanaMock = useKibana as jest.Mock;
 
@@ -36,11 +38,7 @@ describe('Expression', () => {
     mockKibana();
   });
 
-  async function setup(currentOptions: {
-    metrics?: MetricsExplorerMetric[];
-    filterQuery?: string;
-    groupBy?: string;
-  }) {
+  async function setup() {
     const ruleParams = {
       criteria: [],
       groupBy: undefined,
@@ -64,7 +62,6 @@ describe('Expression', () => {
           setRuleParams={(key, value) => Reflect.set(ruleParams, key, value)}
           setRuleProperty={() => {}}
           metadata={{
-            currentOptions,
             adHocDataViewList: [],
           }}
           dataViews={dataViewMock}
@@ -84,41 +81,8 @@ describe('Expression', () => {
     return { wrapper, update, ruleParams };
   }
 
-  it('should prefill the alert using the context metadata', async () => {
-    const currentOptions = {
-      groupBy: 'host.hostname',
-      filterQuery: 'foo',
-      metrics: [
-        { aggregation: 'avg', field: 'system.load.1' },
-        { aggregation: 'cardinality', field: 'system.cpu.user.pct' },
-      ] as MetricsExplorerMetric[],
-    };
-    const { ruleParams } = await setup(currentOptions);
-    expect(ruleParams.groupBy).toBe('host.hostname');
-    expect(ruleParams.searchConfiguration.query.query).toBe('foo');
-    expect(ruleParams.criteria).toEqual([
-      {
-        metric: 'system.load.1',
-        comparator: Comparator.GT,
-        threshold: [],
-        timeSize: 1,
-        timeUnit: 'm',
-        aggType: 'avg',
-      },
-      {
-        metric: 'system.cpu.user.pct',
-        comparator: Comparator.GT,
-        threshold: [],
-        timeSize: 1,
-        timeUnit: 'm',
-        aggType: 'cardinality',
-      },
-    ]);
-  });
-
   it('should use default metrics', async () => {
-    const currentOptions = {};
-    const { ruleParams } = await setup(currentOptions);
+    const { ruleParams } = await setup();
     expect(ruleParams.criteria).toEqual([
       {
         metrics: [
@@ -137,13 +101,6 @@ describe('Expression', () => {
   });
 
   it('should show an error message when searchSource throws an error', async () => {
-    const currentOptions = {
-      groupBy: 'host.hostname',
-      metrics: [
-        { aggregation: 'avg', field: 'system.load.1' },
-        { aggregation: 'cardinality', field: 'system.cpu.user.pct' },
-      ] as MetricsExplorerMetric[],
-    };
     const errorMessage = 'Error in searchSource create';
     const kibanaMock = kibanaStartMock.startContract();
     useKibanaMock.mockReturnValue({
@@ -169,20 +126,13 @@ describe('Expression', () => {
         },
       },
     });
-    const { wrapper } = await setup(currentOptions);
+    const { wrapper } = await setup();
     expect(wrapper.find(`[data-test-subj="thresholdRuleExpressionError"]`).first().text()).toBe(
       errorMessage
     );
   });
 
   it('should show no timestamp error when selected data view does not have a timeField', async () => {
-    const currentOptions = {
-      groupBy: 'host.hostname',
-      metrics: [
-        { aggregation: 'avg', field: 'system.load.1' },
-        { aggregation: 'cardinality', field: 'system.cpu.user.pct' },
-      ] as MetricsExplorerMetric[],
-    };
     const mockedIndex = {
       id: 'c34a7c79-a88b-4b4a-ad19-72f6d24104e4',
       title: 'metrics-fake_hosts',
@@ -234,7 +184,7 @@ describe('Expression', () => {
         },
       },
     });
-    const { wrapper } = await setup(currentOptions);
+    const { wrapper } = await setup();
     expect(
       wrapper.find(`[data-test-subj="thresholdRuleDataViewErrorNoTimestamp"]`).first().text()
     ).toBe(
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
index 26de96e3bd835e..2c5f7438b048fe 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
@@ -36,13 +36,13 @@ import {
 } from '@kbn/triggers-actions-ui-plugin/public';
 
 import { useKibana } from '../../utils/kibana_react';
+import { CUSTOM_AGGREGATOR } from '../../../common/custom_threshold_rule/constants';
 import { Aggregators, Comparator } from '../../../common/custom_threshold_rule/types';
 import { TimeUnitChar } from '../../../common/utils/formatters/duration';
 import { AlertContextMeta, AlertParams, MetricExpression } from './types';
-import { ExpressionChart } from './components/expression_chart';
 import { ExpressionRow } from './components/expression_row';
-import { MetricsExplorerGroupBy } from './components/group_by';
-import { MetricsExplorerOptions } from './hooks/use_metrics_explorer_options';
+import { MetricsExplorerFields, GroupBy } from './components/group_by';
+import { PreviewChart } from './components/preview_chart/preview_chart';
 
 const FILTER_TYPING_DEBOUNCE_MS = 500;
 
@@ -51,8 +51,8 @@ type Props = Omit<
   'defaultActionGroupId' | 'actionGroups' | 'charts' | 'data' | 'unifiedSearch'
 >;
 
-export const defaultExpression = {
-  aggType: Aggregators.CUSTOM,
+export const defaultExpression: MetricExpression = {
+  aggType: CUSTOM_AGGREGATOR,
   comparator: Comparator.GT,
   metrics: [
     {
@@ -63,7 +63,7 @@ export const defaultExpression = {
   threshold: [1000],
   timeSize: 1,
   timeUnit: 'm',
-} as MetricExpression;
+};
 
 // eslint-disable-next-line import/no-default-export
 export default function Expressions(props: Props) {
@@ -152,15 +152,7 @@ export default function Expressions(props: Props) {
       setTimeSize(ruleParams.criteria[0].timeSize);
       setTimeUnit(ruleParams.criteria[0].timeUnit);
     } else {
-      preFillAlertCriteria();
-    }
-
-    if (!ruleParams.filterQuery) {
-      preFillAlertFilter();
-    }
-
-    if (!ruleParams.groupBy) {
-      preFillAlertGroupBy();
+      setRuleParams('criteria', [defaultExpression]);
     }
 
     if (typeof ruleParams.alertOnNoData === 'undefined') {
@@ -171,17 +163,6 @@ export default function Expressions(props: Props) {
     }
   }, [metadata]); // eslint-disable-line react-hooks/exhaustive-deps
 
-  const options = useMemo<MetricsExplorerOptions>(() => {
-    if (metadata?.currentOptions?.metrics) {
-      return metadata.currentOptions as MetricsExplorerOptions;
-    } else {
-      return {
-        metrics: [],
-        aggregation: 'count',
-      };
-    }
-  }, [metadata]);
-
   const onSelectDataView = useCallback(
     (newDataView: DataView) => {
       const ruleCriteria = (ruleParams.criteria ? ruleParams.criteria.slice() : []).map(
@@ -282,67 +263,11 @@ export default function Expressions(props: Props) {
     [ruleParams.criteria, setRuleParams]
   );
 
-  const preFillAlertCriteria = useCallback(() => {
-    const md = metadata;
-    if (md?.currentOptions?.metrics?.length) {
-      setRuleParams(
-        'criteria',
-        md.currentOptions.metrics.map((metric) => ({
-          metric: metric.field,
-          comparator: Comparator.GT,
-          threshold: [],
-          timeSize,
-          timeUnit,
-          aggType: metric.aggregation,
-        })) as AlertParams['criteria']
-      );
-    } else {
-      setRuleParams('criteria', [defaultExpression]);
-    }
-  }, [metadata, setRuleParams, timeSize, timeUnit]);
-
-  const preFillAlertFilter = useCallback(() => {
-    const md = metadata;
-    if (md && md.currentOptions?.filterQuery) {
-      setRuleParams('searchConfiguration', {
-        ...ruleParams.searchConfiguration,
-        query: {
-          query: md.currentOptions.filterQuery,
-          language: 'kuery',
-        },
-      });
-    } else if (md && md.currentOptions?.groupBy && md.series) {
-      const { groupBy } = md.currentOptions;
-      const query = Array.isArray(groupBy)
-        ? groupBy.map((field, index) => `${field}: "${md.series?.keys?.[index]}"`).join(' and ')
-        : `${groupBy}: "${md.series.id}"`;
-      setRuleParams('searchConfiguration', {
-        ...ruleParams.searchConfiguration,
-        query: {
-          query,
-          language: 'kuery',
-        },
-      });
-    }
-  }, [metadata, setRuleParams, ruleParams.searchConfiguration]);
-
-  const preFillAlertGroupBy = useCallback(() => {
-    const md = metadata;
-    if (md && md.currentOptions?.groupBy && !md.series) {
-      setRuleParams('groupBy', md.currentOptions.groupBy);
-    }
-  }, [metadata, setRuleParams]);
-
   const hasGroupBy = useMemo(
     () => ruleParams.groupBy && ruleParams.groupBy.length > 0,
     [ruleParams.groupBy]
   );
 
-  const disableNoData = useMemo(
-    () => ruleParams.criteria?.every((c) => c.aggType === Aggregators.COUNT),
-    [ruleParams.criteria]
-  );
-
   // Test to see if any of the group fields in groupBy are already filtered down to a single
   // group by the filterQuery. If this is the case, then a groupBy is unnecessary, as it would only
   // ever produce one group instance
@@ -393,7 +318,6 @@ export default function Expressions(props: Props) {
       defaultMessage: 'Search for observability data… (e.g. host.name:host-1)',
     }
   );
-
   return (
     <>
       <EuiTitle size="xs">
@@ -477,7 +401,7 @@ export default function Expressions(props: Props) {
               )}
               <ExpressionRow
                 canDelete={(ruleParams.criteria && ruleParams.criteria.length > 1) || false}
-                fields={derivedIndexPattern.fields as any}
+                fields={derivedIndexPattern.fields}
                 remove={removeExpression}
                 addExpression={addExpression}
                 key={idx} // idx's don't usually make good key's but here the index has semantic meaning
@@ -487,13 +411,12 @@ export default function Expressions(props: Props) {
                 expression={e || {}}
                 dataView={derivedIndexPattern}
               >
-                {/* Preview */}
-                <ExpressionChart
-                  expression={e}
-                  derivedIndexPattern={derivedIndexPattern}
+                <PreviewChart
+                  metricExpression={e}
+                  dataView={dataView}
                   filterQuery={(ruleParams.searchConfiguration?.query as Query)?.query as string}
                   groupBy={ruleParams.groupBy}
-                  timeFieldName={dataView?.timeFieldName}
+                  error={(errors[idx] as IErrorObject) || emptyError}
                 />
               </ExpressionRow>
             </div>
@@ -543,12 +466,11 @@ export default function Expressions(props: Props) {
         fullWidth
         display="rowCompressed"
       >
-        <MetricsExplorerGroupBy
+        <GroupBy
           onChange={onGroupByChange}
-          fields={derivedIndexPattern.fields as any}
+          fields={derivedIndexPattern.fields as MetricsExplorerFields}
           options={{
-            ...options,
-            groupBy: ruleParams.groupBy || undefined,
+            groupBy: ruleParams.groupBy || null,
           }}
           errorOptions={redundantFilterGroupBy}
         />
@@ -591,22 +513,19 @@ export default function Expressions(props: Props) {
               }
             )}{' '}
             <EuiToolTip
-              content={
-                (disableNoData ? `${docCountNoDataDisabledHelpText} ` : '') +
-                i18n.translate(
-                  'xpack.observability.customThreshold.rule.alertFlyout.groupDisappearHelpText',
-                  {
-                    defaultMessage:
-                      'Enable this to trigger the action if a previously detected group begins to report no results. This is not recommended for dynamically scaling infrastructures that may rapidly start and stop nodes automatically.',
-                  }
-                )
-              }
+              content={i18n.translate(
+                'xpack.observability.customThreshold.rule.alertFlyout.groupDisappearHelpText',
+                {
+                  defaultMessage:
+                    'Enable this to trigger the action if a previously detected group begins to report no results. This is not recommended for dynamically scaling infrastructures that may rapidly start and stop nodes automatically.',
+                }
+              )}
             >
               <EuiIcon type="questionInCircle" color="subdued" />
             </EuiToolTip>
           </>
         }
-        disabled={disableNoData || !hasGroupBy}
+        disabled={!hasGroupBy}
         checked={Boolean(hasGroupBy && ruleParams.alertOnGroupDisappear)}
         onChange={(e) => setRuleParams('alertOnGroupDisappear', e.target.checked)}
       />
@@ -614,10 +533,3 @@ export default function Expressions(props: Props) {
     </>
   );
 }
-
-const docCountNoDataDisabledHelpText = i18n.translate(
-  'xpack.observability.customThreshold.rule.alertFlyout.docCountNoDataDisabledHelpText',
-  {
-    defaultMessage: '[This setting is not applicable to the Document Count aggregator.]',
-  }
-);
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/calculate_domain.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/calculate_domain.ts
index 16d0d54d825c16..8de019598bc6e2 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/calculate_domain.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/helpers/calculate_domain.ts
@@ -5,10 +5,8 @@
  * 2.0.
  */
 
-import { min, max, sum, isNumber } from 'lodash';
-import { MetricsExplorerSeries } from '../../../../common/custom_threshold_rule/metrics_explorer';
-import { MetricsExplorerOptionsMetric } from '../../../../common/custom_threshold_rule/types';
-import { getMetricId } from './get_metric_id';
+import { min, max, isNumber } from 'lodash';
+import { MetricsExplorerSeries } from '../types';
 
 const getMin = (values: Array<number | null>) => {
   const minValue = min(values);
@@ -20,24 +18,7 @@ const getMax = (values: Array<number | null>) => {
   return isNumber(maxValue) && Number.isFinite(maxValue) ? maxValue : undefined;
 };
 
-export const calculateDomain = (
-  series: MetricsExplorerSeries,
-  metrics: MetricsExplorerOptionsMetric[],
-  stacked = false
-): { min: number; max: number } => {
-  const values = series.rows
-    .reduce((acc, row) => {
-      const rowValues = metrics
-        .map((m, index) => {
-          return (row[getMetricId(m, index)] as number) || null;
-        })
-        .filter((v) => isNumber(v));
-      const minValue = getMin(rowValues);
-      // For stacked domains we want to add 10% head room so the charts have
-      // enough room to draw the 2 pixel line as well.
-      const maxValue = stacked ? sum(rowValues) * 1.1 : getMax(rowValues);
-      return acc.concat([minValue || null, maxValue || null]);
-    }, [] as Array<number | null>)
-    .filter((v) => isNumber(v));
+export const calculateDomain = (series: MetricsExplorerSeries): { min: number; max: number } => {
+  const values = series.rows.map((row) => row.metric_0 as number | null).filter((v) => isNumber(v));
   return { min: getMin(values) || 0, max: getMax(values) || 0 };
 };
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metric.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metric.ts
index 1423413e983886..97087797094d00 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metric.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metric.ts
@@ -6,21 +6,15 @@
  */
 
 import numeral from '@elastic/numeral';
-import { InfraFormatterType } from '../../../../common/custom_threshold_rule/types';
+import { CustomThresholdExpressionMetric } from '../../../../common/custom_threshold_rule/types';
 import { createFormatter } from '../../../../common/custom_threshold_rule/formatters';
-import { MetricsExplorerMetric } from '../../../../common/custom_threshold_rule/metrics_explorer';
 import { metricToFormat } from './metric_to_format';
 
-export const createFormatterForMetric = (metric?: MetricsExplorerMetric) => {
-  if (metric?.aggregation === 'custom') {
-    return (input: number) => numeral(input).format('0.[0000]');
-  }
-  if (metric && metric.field) {
-    const format = metricToFormat(metric);
-    if (format === InfraFormatterType.bits && metric.aggregation === 'rate') {
-      return createFormatter(InfraFormatterType.bits, '{{value}}/s');
-    }
+export const createFormatterForMetric = (metrics: CustomThresholdExpressionMetric[]) => {
+  if (metrics.length === 1) {
+    const format = metricToFormat(metrics[0]);
     return createFormatter(format);
   }
-  return createFormatter(InfraFormatterType.number);
+
+  return (input: number) => numeral(input).format('0.[0000]');
 };
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metrics.test.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metrics.test.ts
index 0da0e765d724a4..000058abc2f9bf 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metrics.test.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_formatter_for_metrics.test.ts
@@ -5,38 +5,36 @@
  * 2.0.
  */
 
-import { MetricsExplorerMetric } from '../../../../common/custom_threshold_rule/metrics_explorer';
+import {
+  Aggregators,
+  CustomThresholdExpressionMetric,
+} from '../../../../common/custom_threshold_rule/types';
 import { createFormatterForMetric } from './create_formatter_for_metric';
 
 describe('createFormatterForMetric()', () => {
   it('should just work for count', () => {
-    const metric: MetricsExplorerMetric = { aggregation: 'count' };
+    const metric: CustomThresholdExpressionMetric[] = [{ name: 'A', aggType: Aggregators.COUNT }];
     const format = createFormatterForMetric(metric);
     expect(format(1291929)).toBe('1,291,929');
   });
   it('should just work for numerics', () => {
-    const metric: MetricsExplorerMetric = { aggregation: 'avg', field: 'system.load.1' };
+    const metric: CustomThresholdExpressionMetric[] = [
+      { name: 'A', aggType: Aggregators.AVERAGE, field: 'system.load.1' },
+    ];
     const format = createFormatterForMetric(metric);
     expect(format(1000.2)).toBe('1,000.2');
   });
   it('should just work for percents', () => {
-    const metric: MetricsExplorerMetric = { aggregation: 'avg', field: 'system.cpu.total.pct' };
+    const metric: CustomThresholdExpressionMetric[] = [
+      { name: 'A', aggType: Aggregators.AVERAGE, field: 'system.cpu.total.pct' },
+    ];
     const format = createFormatterForMetric(metric);
     expect(format(0.349)).toBe('34.9%');
   });
-  it('should just work for rates', () => {
-    const metric: MetricsExplorerMetric = {
-      aggregation: 'rate',
-      field: 'host.network.egress.bytes',
-    };
-    const format = createFormatterForMetric(metric);
-    expect(format(103929292)).toBe('831.4 Mbit/s');
-  });
   it('should just work for bytes', () => {
-    const metric: MetricsExplorerMetric = {
-      aggregation: 'avg',
-      field: 'host.network.egress.bytes',
-    };
+    const metric: CustomThresholdExpressionMetric[] = [
+      { name: 'A', aggType: Aggregators.AVERAGE, field: 'host.network.egress.bytes' },
+    ];
     const format = createFormatterForMetric(metric);
     expect(format(103929292)).toBe('103.9 MB');
   });
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.test.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.test.ts
deleted file mode 100644
index 70c4959aafc19b..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { MetricsExplorerMetric } from '../../../../common/custom_threshold_rule/metrics_explorer';
-import { createMetricLabel } from './create_metric_label';
-
-describe('createMetricLabel()', () => {
-  it('should work with metrics with fields', () => {
-    const metric: MetricsExplorerMetric = { aggregation: 'avg', field: 'system.load.1' };
-    expect(createMetricLabel(metric)).toBe('avg(system.load.1)');
-  });
-  it('should work with document count', () => {
-    const metric: MetricsExplorerMetric = { aggregation: 'count' };
-    expect(createMetricLabel(metric)).toBe('count()');
-  });
-});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.ts
deleted file mode 100644
index 1b3496c07cd43f..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/create_metric_label.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { MetricsExplorerOptionsMetric } from '../hooks/use_metrics_explorer_options';
-
-export const createMetricLabel = (metric: MetricsExplorerOptionsMetric) => {
-  if (metric.label) {
-    return metric.label;
-  }
-  return `${metric.aggregation}(${metric.field || ''})`;
-};
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/metric_to_format.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/metric_to_format.ts
index 2a7d28b72b7c70..67710c49c2acd8 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/metric_to_format.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/helpers/metric_to_format.ts
@@ -6,18 +6,17 @@
  */
 
 import { last } from 'lodash';
-import { InfraFormatterType } from '../../../../common/custom_threshold_rule/types';
-import { MetricsExplorerMetric } from '../../../../common/custom_threshold_rule/metrics_explorer';
+import {
+  CustomThresholdExpressionMetric,
+  InfraFormatterType,
+} from '../../../../common/custom_threshold_rule/types';
 
-export const metricToFormat = (metric?: MetricsExplorerMetric) => {
+export const metricToFormat = (metric?: CustomThresholdExpressionMetric) => {
   if (metric && metric.field) {
     const suffix = last(metric.field.split(/\./));
     if (suffix === 'pct') {
       return InfraFormatterType.percent;
     }
-    if (suffix === 'bytes' && metric.aggregation === 'rate') {
-      return InfraFormatterType.bits;
-    }
     if (suffix === 'bytes') {
       return InfraFormatterType.bytes;
     }
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/use_alert_prefill.ts b/x-pack/plugins/observability/public/components/custom_threshold/helpers/use_alert_prefill.ts
deleted file mode 100644
index 3f659b1041762e..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/use_alert_prefill.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import createContainer from 'constate';
-import { useMetricThresholdAlertPrefill } from '../hooks/use_metric_threshold_alert_prefill';
-
-const useAlertPrefill = () => {
-  const metricThresholdPrefill = useMetricThresholdAlertPrefill();
-  return { metricThresholdPrefill };
-};
-
-export const [AlertPrefillProvider, useAlertPrefillContext] = createContainer(useAlertPrefill);
diff --git a/x-pack/plugins/observability/public/utils/metrics_explorer.ts b/x-pack/plugins/observability/public/components/custom_threshold/hooks/mocks/metrics_explorer.ts
similarity index 69%
rename from x-pack/plugins/observability/public/utils/metrics_explorer.ts
rename to x-pack/plugins/observability/public/components/custom_threshold/hooks/mocks/metrics_explorer.ts
index 136df771318118..79e281717ab847 100644
--- a/x-pack/plugins/observability/public/utils/metrics_explorer.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/hooks/mocks/metrics_explorer.ts
@@ -6,19 +6,13 @@
  */
 
 import {
+  ExpressionOptions,
+  ExpressionTimestampsRT,
   MetricsExplorerResponse,
   MetricsExplorerSeries,
-} from '../../common/custom_threshold_rule/metrics_explorer';
-import {
-  MetricsExplorerChartOptions,
-  MetricsExplorerChartType,
-  MetricsExplorerOptions,
-  MetricsExplorerTimeOptions,
-  MetricsExplorerTimestampsRT,
-  MetricsExplorerYAxisMode,
-} from '../components/custom_threshold/hooks/use_metrics_explorer_options';
+} from '../../types';
 
-export const options: MetricsExplorerOptions = {
+export const options: ExpressionOptions = {
   limit: 3,
   groupBy: 'host.name',
   aggregation: 'avg',
@@ -41,22 +35,9 @@ export const source = {
   },
   anomalyThreshold: 20,
 };
-
-export const chartOptions: MetricsExplorerChartOptions = {
-  type: MetricsExplorerChartType.line,
-  yAxisMode: MetricsExplorerYAxisMode.fromZero,
-  stack: false,
-};
-
 export const derivedIndexPattern = { title: 'metricbeat-*', fields: [] };
 
-export const timeRange: MetricsExplorerTimeOptions = {
-  from: 'now-1h',
-  to: 'now',
-  interval: '>=10s',
-};
-
-export const mockedTimestamps: MetricsExplorerTimestampsRT = {
+export const mockedTimestamps: ExpressionTimestampsRT = {
   fromTimestamp: 1678376367166,
   toTimestamp: 1678379973620,
   interval: '>=10s',
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_chart_data.ts b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_chart_data.ts
similarity index 58%
rename from x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_chart_data.ts
rename to x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_chart_data.ts
index ef810bc8857d91..1f135473c0866a 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_chart_data.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_chart_data.ts
@@ -8,20 +8,24 @@
 import DateMath from '@kbn/datemath';
 import { DataViewBase } from '@kbn/es-query';
 import { useMemo } from 'react';
-import { MetricExplorerCustomMetricAggregations } from '../../../../common/custom_threshold_rule/metrics_explorer';
-import { CustomThresholdExpressionMetric } from '../../../../common/custom_threshold_rule/types';
-import { MetricExpression, TimeRange } from '../types';
-import { useMetricsExplorerData } from './use_metrics_explorer_data';
-
 import {
-  MetricsExplorerOptions,
-  MetricsExplorerTimestampsRT,
-} from './use_metrics_explorer_options';
+  Aggregators,
+  AggType,
+  CustomThresholdExpressionMetric,
+} from '../../../../common/custom_threshold_rule/types';
+import {
+  ExpressionOptions,
+  ExpressionTimestampsRT,
+  MetricExpression,
+  MetricsExplorerMetricRT,
+  TimeRange,
+} from '../types';
+import { useExpressionData } from './use_expression_data';
 
 const DEFAULT_TIME_RANGE = {};
 const DEFAULT_TIMESTAMP = '@timestamp';
 
-export const useMetricsExplorerChartData = (
+export const useExpressionChartData = (
   expression: MetricExpression,
   derivedIndexPattern: DataViewBase,
   filterQuery?: string,
@@ -31,7 +35,7 @@ export const useMetricsExplorerChartData = (
 ) => {
   const { timeSize, timeUnit } = expression || { timeSize: 1, timeUnit: 'm' };
 
-  const options: MetricsExplorerOptions = useMemo(
+  const options: ExpressionOptions = useMemo(
     () => ({
       limit: 1,
       forceInterval: true,
@@ -39,29 +43,28 @@ export const useMetricsExplorerChartData = (
       groupBy,
       filterQuery,
       metrics: [
-        expression.aggType === 'custom'
-          ? {
-              aggregation: 'custom',
-              custom_metrics:
-                expression?.metrics?.map(mapMetricThresholdMetricToMetricsExplorerMetric) ?? [],
-              equation: expression.equation,
-            }
-          : { field: expression.metric, aggregation: expression.aggType },
+        {
+          aggregation: 'custom',
+          // Infra API expects this field to be custom_metrics
+          // since the same field is used in the metric threshold rule
+          custom_metrics:
+            expression?.metrics?.map(mapCustomThresholdMetricToMetricsExplorerMetric) ?? [],
+          equation: expression.equation,
+        },
       ],
-      aggregation: expression.aggType || 'avg',
+      aggregation: expression.aggType || 'custom',
     }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       expression.aggType,
       expression.equation,
-      expression.metric,
       // eslint-disable-next-line react-hooks/exhaustive-deps
       JSON.stringify(expression.metrics),
       filterQuery,
       groupBy,
     ]
   );
-  const timestamps: MetricsExplorerTimestampsRT = useMemo(() => {
+  const timestamps: ExpressionTimestampsRT = useMemo(() => {
     const from = timeRange.from ?? `now-${(timeSize || 1) * 20}${timeUnit}`;
     const to = timeRange.to ?? 'now';
     const fromTimestamp = DateMath.parse(from)!.valueOf();
@@ -74,23 +77,23 @@ export const useMetricsExplorerChartData = (
     };
   }, [timeRange.from, timeRange.to, timeSize, timeUnit, timeFieldName]);
 
-  return useMetricsExplorerData(options, derivedIndexPattern, timestamps);
+  return useExpressionData(options, derivedIndexPattern, timestamps);
 };
 
-const mapMetricThresholdMetricToMetricsExplorerMetric = (
+const mapCustomThresholdMetricToMetricsExplorerMetric = (
   metric: CustomThresholdExpressionMetric
-) => {
+): MetricsExplorerMetricRT => {
   if (metric.aggType === 'count') {
     return {
       name: metric.name,
-      aggregation: 'count' as MetricExplorerCustomMetricAggregations,
+      aggregation: Aggregators.COUNT,
       filter: metric.filter,
     };
   }
 
   return {
     name: metric.name,
-    aggregation: metric.aggType as MetricExplorerCustomMetricAggregations,
+    aggregation: metric.aggType as AggType,
     field: metric.field,
   };
 };
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.ts b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_data.ts
similarity index 84%
rename from x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.ts
rename to x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_data.ts
index 59857990b906e2..e6058a124e0866 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_expression_data.ts
@@ -9,22 +9,19 @@ import { DataViewBase } from '@kbn/es-query';
 import { useInfiniteQuery } from '@tanstack/react-query';
 
 import { useKibana } from '@kbn/kibana-react-plugin/public';
+import { convertKueryToElasticSearchQuery } from '../helpers/kuery';
+import { decodeOrThrow } from '../helpers/runtime_types';
 import {
+  ExpressionOptions,
+  ExpressionTimestampsRT,
   MetricsExplorerResponse,
   metricsExplorerResponseRT,
-} from '../../../../common/custom_threshold_rule/metrics_explorer';
-
-import {
-  MetricsExplorerOptions,
-  MetricsExplorerTimestampsRT,
-} from './use_metrics_explorer_options';
-import { convertKueryToElasticSearchQuery } from '../helpers/kuery';
-import { decodeOrThrow } from '../helpers/runtime_types';
+} from '../types';
 
-export function useMetricsExplorerData(
-  options: MetricsExplorerOptions,
+export function useExpressionData(
+  options: ExpressionOptions,
   derivedIndexPattern: DataViewBase,
-  { fromTimestamp, toTimestamp, interval, timeFieldName }: MetricsExplorerTimestampsRT,
+  { fromTimestamp, toTimestamp, interval, timeFieldName }: ExpressionTimestampsRT,
   enabled = true
 ) {
   const { http } = useKibana().services;
@@ -51,7 +48,7 @@ export function useMetricsExplorerData(
         body: JSON.stringify({
           forceInterval: options.forceInterval,
           dropLastBucket: options.dropLastBucket != null ? options.dropLastBucket : true,
-          metrics: options.aggregation === 'count' ? [{ aggregation: 'count' }] : options.metrics,
+          metrics: options.metrics,
           groupBy: options.groupBy,
           afterKey,
           limit: options.limit,
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metric_threshold_alert_prefill.ts b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metric_threshold_alert_prefill.ts
index 6314ddb20a115a..c54e7a075956a0 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metric_threshold_alert_prefill.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metric_threshold_alert_prefill.ts
@@ -7,19 +7,27 @@
 
 import { isEqual } from 'lodash';
 import { useState } from 'react';
-import { MetricsExplorerMetric } from '../../../../common/custom_threshold_rule/metrics_explorer';
+import {
+  Aggregators,
+  CustomThresholdExpressionMetric,
+} from '../../../../common/custom_threshold_rule/types';
 
-export interface MetricThresholdPrefillOptions {
-  groupBy: string | string[] | undefined;
+export interface CustomThresholdPrefillOptions {
+  groupBy?: string[];
   filterQuery: string | undefined;
-  metrics: MetricsExplorerMetric[];
+  metrics: CustomThresholdExpressionMetric[];
 }
 
-export const useMetricThresholdAlertPrefill = () => {
-  const [prefillOptionsState, setPrefillOptionsState] = useState<MetricThresholdPrefillOptions>({
+export const useCustomThresholdAlertPrefill = () => {
+  const [prefillOptionsState, setPrefillOptionsState] = useState<CustomThresholdPrefillOptions>({
     groupBy: undefined,
     filterQuery: undefined,
-    metrics: [],
+    metrics: [
+      {
+        name: 'A',
+        aggType: Aggregators.COUNT,
+      },
+    ],
   });
 
   const { groupBy, filterQuery, metrics } = prefillOptionsState;
@@ -28,7 +36,7 @@ export const useMetricThresholdAlertPrefill = () => {
     groupBy,
     filterQuery,
     metrics,
-    setPrefillOptions(newState: MetricThresholdPrefillOptions) {
+    setPrefillOptions(newState: CustomThresholdPrefillOptions) {
       if (!isEqual(newState, prefillOptionsState)) setPrefillOptionsState(newState);
     },
   };
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.test.tsx
index b0d846ce9b93d9..b7e750875a5ff9 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_data.test.tsx
@@ -6,24 +6,19 @@
  */
 
 import React from 'react';
+import { DataViewBase } from '@kbn/es-query';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { useMetricsExplorerData } from './use_metrics_explorer_data';
-
 import { renderHook } from '@testing-library/react-hooks';
 import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
-
-import {
-  MetricsExplorerOptions,
-  MetricsExplorerTimestampsRT,
-} from './use_metrics_explorer_options';
-import { DataViewBase } from '@kbn/es-query';
+import { ExpressionOptions, ExpressionTimestampsRT } from '../types';
+import { useExpressionData } from './use_expression_data';
 import {
   createSeries,
   derivedIndexPattern,
   mockedTimestamps,
   options,
   resp,
-} from '../../../utils/metrics_explorer';
+} from './mocks/metrics_explorer';
 
 const mockedFetch = jest.fn();
 
@@ -51,10 +46,10 @@ const renderUseMetricsExplorerDataHook = () => {
   };
   return renderHook(
     (props: {
-      options: MetricsExplorerOptions;
+      options: ExpressionOptions;
       derivedIndexPattern: DataViewBase;
-      timestamps: MetricsExplorerTimestampsRT;
-    }) => useMetricsExplorerData(props.options, props.derivedIndexPattern, props.timestamps),
+      timestamps: ExpressionTimestampsRT;
+    }) => useExpressionData(props.options, props.derivedIndexPattern, props.timestamps),
     {
       initialProps: {
         options,
@@ -72,7 +67,7 @@ jest.mock('../helpers/kuery', () => {
   };
 });
 
-describe('useMetricsExplorerData Hook', () => {
+describe('useExpressionData Hook', () => {
   afterEach(() => {
     queryClient.clear();
   });
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.test.tsx
deleted file mode 100644
index 9def4a44d6a8e5..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.test.tsx
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { renderHook, act } from '@testing-library/react-hooks';
-import {
-  useMetricsExplorerOptions,
-  MetricsExplorerOptions,
-  MetricsExplorerTimeOptions,
-  DEFAULT_OPTIONS,
-  DEFAULT_TIMERANGE,
-} from './use_metrics_explorer_options';
-
-let PREFILL: Record<string, any> = {};
-jest.mock('../helpers/use_alert_prefill', () => ({
-  useAlertPrefillContext: () => ({
-    metricThresholdPrefill: {
-      setPrefillOptions(opts: Record<string, any>) {
-        PREFILL = opts;
-      },
-    },
-  }),
-}));
-
-jest.mock('./use_kibana_timefilter_time', () => ({
-  useKibanaTimefilterTime: (defaults: { from: string; to: string }) => [() => defaults],
-  useSyncKibanaTimeFilterTime: () => [() => {}],
-}));
-
-const renderUseMetricsExplorerOptionsHook = () => renderHook(() => useMetricsExplorerOptions());
-
-interface LocalStore {
-  [key: string]: string;
-}
-
-interface LocalStorage {
-  getItem: (key: string) => string | null;
-  setItem: (key: string, value: string) => void;
-}
-
-const STORE: LocalStore = {};
-const localStorageMock: LocalStorage = {
-  getItem: (key: string) => {
-    return STORE[key] || null;
-  },
-  setItem: (key: string, value: any) => {
-    STORE[key] = value.toString();
-  },
-};
-
-Object.defineProperty(window, 'localStorage', {
-  value: localStorageMock,
-});
-
-describe('useMetricExplorerOptions', () => {
-  beforeEach(() => {
-    delete STORE.MetricsExplorerOptions;
-    delete STORE.MetricsExplorerTimeRange;
-    PREFILL = {};
-  });
-
-  it('should just work', () => {
-    const { result } = renderUseMetricsExplorerOptionsHook();
-    expect(result.current.options).toEqual(DEFAULT_OPTIONS);
-    expect(result.current.timeRange).toEqual(DEFAULT_TIMERANGE);
-    expect(result.current.isAutoReloading).toEqual(false);
-    expect(STORE.MetricsExplorerOptions).toEqual(JSON.stringify(DEFAULT_OPTIONS));
-  });
-
-  it('should change the store when options update', () => {
-    const { result, rerender } = renderUseMetricsExplorerOptionsHook();
-    const newOptions: MetricsExplorerOptions = {
-      ...DEFAULT_OPTIONS,
-      metrics: [{ aggregation: 'count' }],
-    };
-    act(() => {
-      result.current.setOptions(newOptions);
-    });
-    rerender();
-    expect(result.current.options).toEqual(newOptions);
-    expect(STORE.MetricsExplorerOptions).toEqual(JSON.stringify(newOptions));
-  });
-
-  it('should change the store when timerange update', () => {
-    const { result, rerender } = renderUseMetricsExplorerOptionsHook();
-    const newTimeRange: MetricsExplorerTimeOptions = {
-      ...DEFAULT_TIMERANGE,
-      from: 'now-15m',
-    };
-    act(() => {
-      result.current.setTimeRange(newTimeRange);
-    });
-    rerender();
-    expect(result.current.timeRange).toEqual(newTimeRange);
-  });
-
-  it('should load from store when available', () => {
-    const newOptions: MetricsExplorerOptions = {
-      ...DEFAULT_OPTIONS,
-      metrics: [{ aggregation: 'avg', field: 'system.load.1' }],
-    };
-    STORE.MetricsExplorerOptions = JSON.stringify(newOptions);
-    const { result } = renderUseMetricsExplorerOptionsHook();
-    expect(result.current.options).toEqual(newOptions);
-  });
-
-  it('should sync the options to the threshold alert preview context', () => {
-    const { result, rerender } = renderUseMetricsExplorerOptionsHook();
-
-    const newOptions: MetricsExplorerOptions = {
-      ...DEFAULT_OPTIONS,
-      metrics: [{ aggregation: 'count' }],
-      filterQuery: 'foo',
-      groupBy: 'host.hostname',
-    };
-    act(() => {
-      result.current.setOptions(newOptions);
-    });
-    rerender();
-    expect(PREFILL.metrics).toEqual(newOptions.metrics);
-    expect(PREFILL.groupBy).toEqual(newOptions.groupBy);
-    expect(PREFILL.filterQuery).toEqual(newOptions.filterQuery);
-  });
-});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.ts b/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.ts
deleted file mode 100644
index 7d734a961b04e3..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/hooks/use_metrics_explorer_options.ts
+++ /dev/null
@@ -1,236 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import DateMath from '@kbn/datemath';
-import * as t from 'io-ts';
-import { values } from 'lodash';
-import createContainer from 'constate';
-import type { TimeRange } from '@kbn/es-query';
-import { useState, useEffect, useMemo, Dispatch, SetStateAction } from 'react';
-
-import { metricsExplorerMetricRT } from '../../../../common/custom_threshold_rule/metrics_explorer';
-import { Color } from '../../../../common/custom_threshold_rule/color_palette';
-
-import { useAlertPrefillContext } from '../helpers/use_alert_prefill';
-import { useKibanaTimefilterTime, useSyncKibanaTimeFilterTime } from './use_kibana_timefilter_time';
-
-const metricsExplorerOptionsMetricRT = t.intersection([
-  metricsExplorerMetricRT,
-  t.partial({
-    rate: t.boolean,
-    color: t.keyof(Object.fromEntries(values(Color).map((c) => [c, null])) as Record<Color, null>),
-    label: t.string,
-  }),
-]);
-
-export type MetricsExplorerOptionsMetric = t.TypeOf<typeof metricsExplorerOptionsMetricRT>;
-
-export enum MetricsExplorerChartType {
-  line = 'line',
-  area = 'area',
-  bar = 'bar',
-}
-
-export enum MetricsExplorerYAxisMode {
-  fromZero = 'fromZero',
-  auto = 'auto',
-}
-
-export const metricsExplorerChartOptionsRT = t.type({
-  yAxisMode: t.keyof(
-    Object.fromEntries(values(MetricsExplorerYAxisMode).map((v) => [v, null])) as Record<
-      MetricsExplorerYAxisMode,
-      null
-    >
-  ),
-  type: t.keyof(
-    Object.fromEntries(values(MetricsExplorerChartType).map((v) => [v, null])) as Record<
-      MetricsExplorerChartType,
-      null
-    >
-  ),
-  stack: t.boolean,
-});
-
-export type MetricsExplorerChartOptions = t.TypeOf<typeof metricsExplorerChartOptionsRT>;
-
-const metricExplorerOptionsRequiredRT = t.type({
-  aggregation: t.string,
-  metrics: t.array(metricsExplorerOptionsMetricRT),
-});
-
-const metricExplorerOptionsOptionalRT = t.partial({
-  limit: t.number,
-  groupBy: t.union([t.string, t.array(t.string)]),
-  filterQuery: t.string,
-  source: t.string,
-  forceInterval: t.boolean,
-  dropLastBucket: t.boolean,
-});
-export const metricExplorerOptionsRT = t.intersection([
-  metricExplorerOptionsRequiredRT,
-  metricExplorerOptionsOptionalRT,
-]);
-
-export type MetricsExplorerOptions = t.TypeOf<typeof metricExplorerOptionsRT>;
-
-export const metricsExplorerTimestampsRT = t.type({
-  fromTimestamp: t.number,
-  toTimestamp: t.number,
-  interval: t.string,
-  timeFieldName: t.string,
-});
-export type MetricsExplorerTimestampsRT = t.TypeOf<typeof metricsExplorerTimestampsRT>;
-
-export const metricsExplorerTimeOptionsRT = t.type({
-  from: t.string,
-  to: t.string,
-  interval: t.string,
-});
-export type MetricsExplorerTimeOptions = t.TypeOf<typeof metricsExplorerTimeOptionsRT>;
-
-export const DEFAULT_TIMERANGE: MetricsExplorerTimeOptions = {
-  from: 'now-1h',
-  to: 'now',
-  interval: '>=10s',
-};
-
-export const DEFAULT_CHART_OPTIONS: MetricsExplorerChartOptions = {
-  type: MetricsExplorerChartType.line,
-  yAxisMode: MetricsExplorerYAxisMode.fromZero,
-  stack: false,
-};
-
-export const DEFAULT_METRICS: MetricsExplorerOptionsMetric[] = [
-  {
-    aggregation: 'avg',
-    field: 'system.cpu.total.norm.pct',
-    color: Color.color0,
-  },
-  {
-    aggregation: 'avg',
-    field: 'kubernetes.pod.cpu.usage.node.pct',
-    color: Color.color1,
-  },
-  {
-    aggregation: 'avg',
-    field: 'docker.cpu.total.pct',
-    color: Color.color2,
-  },
-];
-
-export const DEFAULT_OPTIONS: MetricsExplorerOptions = {
-  aggregation: 'avg',
-  metrics: DEFAULT_METRICS,
-  source: 'default',
-};
-
-export const DEFAULT_METRICS_EXPLORER_VIEW_STATE = {
-  options: DEFAULT_OPTIONS,
-  chartOptions: DEFAULT_CHART_OPTIONS,
-  currentTimerange: DEFAULT_TIMERANGE,
-};
-
-function parseJsonOrDefault<Obj>(value: string | null, defaultValue: Obj): Obj {
-  if (!value) {
-    return defaultValue;
-  }
-  try {
-    return JSON.parse(value) as Obj;
-  } catch (e) {
-    return defaultValue;
-  }
-}
-
-function useStateWithLocalStorage<State>(
-  key: string,
-  defaultState: State
-): [State, Dispatch<SetStateAction<State>>] {
-  const storageState = localStorage.getItem(key);
-  const [state, setState] = useState<State>(parseJsonOrDefault<State>(storageState, defaultState));
-  useEffect(() => {
-    localStorage.setItem(key, JSON.stringify(state));
-  }, [key, state]);
-  return [state, setState];
-}
-
-const getDefaultTimeRange = ({ from, to }: TimeRange) => {
-  const fromTimestamp = DateMath.parse(from)!.valueOf();
-  const toTimestamp = DateMath.parse(to, { roundUp: true })!.valueOf();
-  return {
-    fromTimestamp,
-    toTimestamp,
-    interval: DEFAULT_TIMERANGE.interval,
-  };
-};
-
-export const useMetricsExplorerOptions = () => {
-  const TIME_DEFAULTS = { from: 'now-1h', to: 'now' };
-  const [getTime] = useKibanaTimefilterTime(TIME_DEFAULTS);
-  const { from, to } = getTime();
-
-  const [options, setOptions] = useStateWithLocalStorage<MetricsExplorerOptions>(
-    'MetricsExplorerOptions',
-    DEFAULT_OPTIONS
-  );
-  const [timeRange, setTimeRange] = useState<MetricsExplorerTimeOptions>({
-    from,
-    to,
-    interval: DEFAULT_TIMERANGE.interval,
-  });
-  const [timestamps, setTimestamps] = useState<MetricsExplorerTimestampsRT>({
-    ...getDefaultTimeRange({ from, to }),
-    timeFieldName: '@timestamp',
-  });
-
-  useSyncKibanaTimeFilterTime(TIME_DEFAULTS, {
-    from: timeRange.from,
-    to: timeRange.to,
-  });
-
-  const [chartOptions, setChartOptions] = useStateWithLocalStorage<MetricsExplorerChartOptions>(
-    'MetricsExplorerChartOptions',
-    DEFAULT_CHART_OPTIONS
-  );
-  const [isAutoReloading, setAutoReloading] = useState<boolean>(false);
-
-  const { metricThresholdPrefill } = useAlertPrefillContext();
-  // For Jest compatibility; including metricThresholdPrefill as a dep in useEffect causes an
-  // infinite loop in test environment
-  const prefillContext = useMemo(() => metricThresholdPrefill, [metricThresholdPrefill]);
-
-  useEffect(() => {
-    if (prefillContext) {
-      const { setPrefillOptions } = prefillContext;
-      const { metrics, groupBy, filterQuery } = options;
-
-      setPrefillOptions({ metrics, groupBy, filterQuery });
-    }
-  }, [options, prefillContext]);
-
-  return {
-    defaultViewState: {
-      options: DEFAULT_OPTIONS,
-      chartOptions: DEFAULT_CHART_OPTIONS,
-      currentTimerange: timeRange,
-    },
-    options,
-    chartOptions,
-    setChartOptions,
-    timeRange,
-    isAutoReloading,
-    setOptions,
-    setTimeRange,
-    startAutoReload: () => setAutoReloading(true),
-    stopAutoReload: () => setAutoReloading(false),
-    timestamps,
-    setTimestamps,
-  };
-};
-
-export const [MetricsExplorerOptionsContainer, useMetricsExplorerOptionsContainerContext] =
-  createContainer(useMetricsExplorerOptions);
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.test.ts b/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.test.ts
deleted file mode 100644
index f6b20963ccb001..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.test.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
-import { MetricExpression } from '../types';
-import { generateUniqueKey } from './generate_unique_key';
-
-describe('generateUniqueKey', () => {
-  const mockedCriteria: Array<[MetricExpression, string]> = [
-    [
-      {
-        aggType: Aggregators.COUNT,
-        comparator: Comparator.LT,
-        threshold: [2000, 5000],
-        timeSize: 15,
-        timeUnit: 'm',
-      },
-      'count<2000,5000',
-    ],
-    [
-      {
-        aggType: Aggregators.CUSTOM,
-        comparator: Comparator.GT_OR_EQ,
-        threshold: [30],
-        timeSize: 15,
-        timeUnit: 'm',
-      },
-      'custom>=30',
-    ],
-    [
-      {
-        aggType: Aggregators.AVERAGE,
-        comparator: Comparator.LT_OR_EQ,
-        threshold: [500],
-        timeSize: 15,
-        timeUnit: 'm',
-        metric: 'metric',
-      },
-      'avg(metric)<=500',
-    ],
-  ];
-  it.each(mockedCriteria)('unique key of %p is %s', (input, output) => {
-    const uniqueKey = generateUniqueKey(input);
-
-    expect(uniqueKey).toBe(output);
-  });
-});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.ts b/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.ts
deleted file mode 100644
index ec83311055a086..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/lib/generate_unique_key.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { MetricExpression } from '../types';
-
-export const generateUniqueKey = (criterion: MetricExpression) => {
-  const metric = criterion.metric ? `(${criterion.metric})` : '';
-
-  return criterion.aggType + metric + criterion.comparator + criterion.threshold.join(',');
-};
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/lib/transform_metrics_explorer_data.ts b/x-pack/plugins/observability/public/components/custom_threshold/lib/transform_metrics_explorer_data.ts
deleted file mode 100644
index 2a301369244205..00000000000000
--- a/x-pack/plugins/observability/public/components/custom_threshold/lib/transform_metrics_explorer_data.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { first } from 'lodash';
-import { MetricsExplorerResponse } from '../../../../common/custom_threshold_rule/metrics_explorer';
-import { MetricThresholdAlertParams, ExpressionChartSeries } from '../types';
-
-export const transformMetricsExplorerData = (
-  params: MetricThresholdAlertParams,
-  data: MetricsExplorerResponse | null
-) => {
-  const { criteria } = params;
-  const firstSeries = first(data?.series);
-  if (criteria && firstSeries) {
-    const series = firstSeries.rows.reduce((acc, row) => {
-      const { timestamp } = row;
-      criteria.forEach((item, index) => {
-        if (!acc[index]) {
-          acc[index] = [];
-        }
-        const value = (row[`metric_${index}`] as number) || 0;
-        acc[index].push({ timestamp, value });
-      });
-      return acc;
-    }, [] as ExpressionChartSeries);
-    return { id: firstSeries.id, series };
-  }
-};
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/mocks/metric_threshold_rule.ts b/x-pack/plugins/observability/public/components/custom_threshold/mocks/custom_threshold_rule.ts
similarity index 78%
rename from x-pack/plugins/observability/public/components/custom_threshold/mocks/metric_threshold_rule.ts
rename to x-pack/plugins/observability/public/components/custom_threshold/mocks/custom_threshold_rule.ts
index 4f2e4ea3772bce..f93bac2b0f104b 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/mocks/metric_threshold_rule.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/mocks/custom_threshold_rule.ts
@@ -6,13 +6,14 @@
  */
 
 import { v4 as uuidv4 } from 'uuid';
+import { CUSTOM_AGGREGATOR } from '../../../../common/custom_threshold_rule/constants';
 import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
 
-import { MetricThresholdAlert, MetricThresholdRule } from '../components/alert_details_app_section';
+import { CustomThresholdAlert, CustomThresholdRule } from '../components/alert_details_app_section';
 
-export const buildMetricThresholdRule = (
-  rule: Partial<MetricThresholdRule> = {}
-): MetricThresholdRule => {
+export const buildCustomThresholdRule = (
+  rule: Partial<CustomThresholdRule> = {}
+): CustomThresholdRule => {
   return {
     alertTypeId: 'metrics.alert.threshold',
     createdBy: 'admin',
@@ -59,29 +60,47 @@ export const buildMetricThresholdRule = (
     params: {
       criteria: [
         {
-          aggType: Aggregators.COUNT,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
+          metrics: [
+            {
+              name: 'A',
+              aggType: Aggregators.COUNT,
+            },
+          ],
           threshold: [2000],
           timeSize: 15,
           timeUnit: 'm',
         },
         {
-          aggType: Aggregators.MAX,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
+          metrics: [
+            {
+              name: 'B',
+              aggType: Aggregators.MAX,
+              field: 'system.cpu.user.pct',
+            },
+          ],
           threshold: [4],
           timeSize: 15,
           timeUnit: 'm',
-          metric: 'system.cpu.user.pct',
           warningComparator: Comparator.GT,
           warningThreshold: [2.2],
         },
         {
-          aggType: Aggregators.MIN,
+          aggType: CUSTOM_AGGREGATOR,
           comparator: Comparator.GT,
+          metrics: [
+            {
+              name: 'C',
+              aggType: Aggregators.MIN,
+              field: 'system.memory.used.pct',
+            },
+          ],
           threshold: [0.8],
           timeSize: 15,
           timeUnit: 'm',
-          metric: 'system.memory.used.pct',
         },
       ],
       searchConfiguration: {
@@ -126,9 +145,9 @@ export const buildMetricThresholdRule = (
   };
 };
 
-export const buildMetricThresholdAlert = (
-  alert: Partial<MetricThresholdAlert> = {}
-): MetricThresholdAlert => {
+export const buildCustomThresholdAlert = (
+  alert: Partial<CustomThresholdAlert> = {}
+): CustomThresholdAlert => {
   return {
     link: '/app/metrics/explorer',
     reason: 'system.cpu.user.pct reported no data in the last 1m for ',
@@ -136,20 +155,32 @@ export const buildMetricThresholdAlert = (
       'kibana.alert.rule.parameters': {
         criteria: [
           {
-            aggType: Aggregators.AVERAGE,
+            aggType: CUSTOM_AGGREGATOR,
             comparator: Comparator.GT,
+            metrics: [
+              {
+                name: 'A',
+                aggType: Aggregators.AVERAGE,
+                field: 'system.cpu.user.pct',
+              },
+            ],
             threshold: [2000],
             timeSize: 15,
             timeUnit: 'm',
-            metric: 'system.cpu.user.pct',
           },
           {
-            aggType: Aggregators.MAX,
+            aggType: CUSTOM_AGGREGATOR,
             comparator: Comparator.GT,
+            metrics: [
+              {
+                name: 'B',
+                aggType: Aggregators.MAX,
+                metric: 'system.cpu.user.pct',
+              },
+            ],
             threshold: [4],
             timeSize: 15,
             timeUnit: 'm',
-            metric: 'system.cpu.user.pct',
             warningComparator: Comparator.GT,
             warningThreshold: [2.2],
           },
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/types.ts b/x-pack/plugins/observability/public/components/custom_threshold/types.ts
index d0b173b4d7c348..e726a8fd013277 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/types.ts
+++ b/x-pack/plugins/observability/public/components/custom_threshold/types.ts
@@ -24,64 +24,22 @@ import {
 import { UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
 import { UsageCollectionStart } from '@kbn/usage-collection-plugin/public';
-import { TimeUnitChar } from '../../../common/utils/formatters';
-import { MetricsExplorerSeries } from '../../../common/custom_threshold_rule/metrics_explorer';
 import {
-  Comparator,
   CustomMetricExpressionParams,
-  MetricExpressionParams,
-  MetricsSourceStatus,
-  NonCountMetricExpressionParams,
-  SnapshotCustomMetricInput,
+  BaseMetricExpressionParams,
+  aggType,
 } from '../../../common/custom_threshold_rule/types';
 import { ObservabilityPublicStart } from '../../plugin';
-import { MetricsExplorerOptions } from './hooks/use_metrics_explorer_options';
 
 export interface AlertContextMeta {
   adHocDataViewList: DataView[];
-  currentOptions?: Partial<MetricsExplorerOptions>;
-  series?: MetricsExplorerSeries;
 }
 
-export type MetricExpression = Omit<
-  MetricExpressionParams,
-  'metric' | 'timeSize' | 'timeUnit' | 'metrics' | 'equation'
-> & {
-  metric?: NonCountMetricExpressionParams['metric'];
-  metrics?: CustomMetricExpressionParams['metrics'];
-  label?: CustomMetricExpressionParams['label'];
-  equation?: CustomMetricExpressionParams['equation'];
-  timeSize?: MetricExpressionParams['timeSize'];
-  timeUnit?: MetricExpressionParams['timeUnit'];
+export type MetricExpression = Omit<CustomMetricExpressionParams, 'timeSize' | 'timeUnit'> & {
+  timeSize?: BaseMetricExpressionParams['timeSize'];
+  timeUnit?: BaseMetricExpressionParams['timeUnit'];
 };
 
-export enum AGGREGATION_TYPES {
-  COUNT = 'count',
-  AVERAGE = 'avg',
-  SUM = 'sum',
-  MIN = 'min',
-  MAX = 'max',
-  RATE = 'rate',
-  CARDINALITY = 'cardinality',
-  P95 = 'p95',
-  P99 = 'p99',
-  CUSTOM = 'custom',
-}
-
-export interface MetricThresholdAlertParams {
-  criteria?: MetricExpression[];
-  groupBy?: string | string[];
-  filterQuery?: string;
-  sourceId?: string;
-}
-
-export interface ExpressionChartRow {
-  timestamp: number;
-  value: number;
-}
-
-export type ExpressionChartSeries = ExpressionChartRow[][];
-
 export interface TimeRange {
   from?: string;
   to?: string;
@@ -106,8 +64,6 @@ export interface InfraClientStartDeps {
   discover: DiscoverStart;
   embeddable?: EmbeddableStart;
   lens: LensPublicStart;
-  // TODO:: check if needed => https://github.com/elastic/kibana/issues/159340
-  // ml: MlPluginStart;
   observability: ObservabilityPublicStart;
   observabilityShared: ObservabilitySharedPluginStart;
   osquery?: unknown; // OsqueryPluginStart;
@@ -125,56 +81,121 @@ export interface InfraClientStartDeps {
 export type RendererResult = React.ReactElement<any> | null;
 
 export type RendererFunction<RenderArgs, Result = RendererResult> = (args: RenderArgs) => Result;
-export interface DerivedIndexPattern {
-  fields: MetricsSourceStatus['indexFields'];
-  title: string;
-}
-
-export const SnapshotMetricTypeKeys = {
-  count: null,
-  cpu: null,
-  diskLatency: null,
-  load: null,
-  memory: null,
-  memoryTotal: null,
-  tx: null,
-  rx: null,
-  logRate: null,
-  diskIOReadBytes: null,
-  diskIOWriteBytes: null,
-  s3TotalRequests: null,
-  s3NumberOfObjects: null,
-  s3BucketSize: null,
-  s3DownloadBytes: null,
-  s3UploadBytes: null,
-  rdsConnections: null,
-  rdsQueriesExecuted: null,
-  rdsActiveTransactions: null,
-  rdsLatency: null,
-  sqsMessagesVisible: null,
-  sqsMessagesDelayed: null,
-  sqsMessagesSent: null,
-  sqsMessagesEmpty: null,
-  sqsOldestMessage: null,
-  custom: null,
-};
-export const SnapshotMetricTypeRT = rt.keyof(SnapshotMetricTypeKeys);
-
-export type SnapshotMetricType = rt.TypeOf<typeof SnapshotMetricTypeRT>;
-export interface InventoryMetricConditions {
-  metric: SnapshotMetricType;
-  timeSize: number;
-  timeUnit: TimeUnitChar;
-  sourceId?: string;
-  threshold: number[];
-  comparator: Comparator;
-  customMetric?: SnapshotCustomMetricInput;
-  warningThreshold?: number[];
-  warningComparator?: Comparator;
-}
 
-export interface MetricThresholdRuleTypeParams extends RuleTypeParams {
-  criteria: MetricExpressionParams[];
+export interface CustomThresholdRuleTypeParams extends RuleTypeParams {
+  criteria: CustomMetricExpressionParams[];
   searchConfiguration: SerializedSearchSourceFields;
   groupBy?: string | string[];
 }
+
+export const expressionTimestampsRT = rt.type({
+  fromTimestamp: rt.number,
+  toTimestamp: rt.number,
+  interval: rt.string,
+  timeFieldName: rt.string,
+});
+export type ExpressionTimestampsRT = rt.TypeOf<typeof expressionTimestampsRT>;
+
+/*
+ * Expression options
+ */
+export const metricsExplorerMetricRT = rt.intersection([
+  rt.type({
+    name: rt.string,
+    aggregation: aggType,
+  }),
+  rt.partial({
+    field: rt.string,
+    filter: rt.string,
+  }),
+]);
+const customThresholdExpressionMetricRT = rt.intersection([
+  rt.type({
+    aggregation: rt.string,
+  }),
+  rt.partial({
+    field: rt.union([rt.string, rt.undefined]),
+    custom_metrics: rt.array(metricsExplorerMetricRT),
+    equation: rt.string,
+  }),
+]);
+export const expressionOptionsRT = rt.intersection([
+  rt.type({
+    aggregation: rt.string,
+    metrics: rt.array(customThresholdExpressionMetricRT),
+  }),
+  rt.partial({
+    limit: rt.number,
+    groupBy: rt.union([rt.string, rt.array(rt.string)]),
+    filterQuery: rt.string,
+    source: rt.string,
+    forceInterval: rt.boolean,
+    dropLastBucket: rt.boolean,
+  }),
+]);
+
+export type MetricsExplorerMetricRT = rt.TypeOf<typeof metricsExplorerMetricRT>;
+export type ExpressionOptions = rt.TypeOf<typeof expressionOptionsRT>;
+/*
+ * End of expression options
+ */
+
+/*
+ * Metrics explorer types
+ */
+export const timeRangeRT = rt.type({
+  from: rt.number,
+  to: rt.number,
+  interval: rt.string,
+});
+
+export const afterKeyObjectRT = rt.record(rt.string, rt.union([rt.string, rt.null]));
+
+export const metricsExplorerPageInfoRT = rt.type({
+  total: rt.number,
+  afterKey: rt.union([rt.string, rt.null, afterKeyObjectRT]),
+});
+
+export const metricsExplorerColumnTypeRT = rt.keyof({
+  date: null,
+  number: null,
+  string: null,
+});
+
+export const metricsExplorerColumnRT = rt.type({
+  name: rt.string,
+  type: metricsExplorerColumnTypeRT,
+});
+
+export const metricsExplorerRowRT = rt.intersection([
+  rt.type({
+    timestamp: rt.number,
+  }),
+  rt.record(
+    rt.string,
+    rt.union([rt.string, rt.number, rt.null, rt.undefined, rt.array(rt.object)])
+  ),
+]);
+
+export const metricsExplorerSeriesRT = rt.intersection([
+  rt.type({
+    id: rt.string,
+    columns: rt.array(metricsExplorerColumnRT),
+    rows: rt.array(metricsExplorerRowRT),
+  }),
+  rt.partial({
+    keys: rt.array(rt.string),
+  }),
+]);
+
+export const metricsExplorerResponseRT = rt.type({
+  series: rt.array(metricsExplorerSeriesRT),
+  pageInfo: metricsExplorerPageInfoRT,
+});
+
+export type MetricsExplorerRow = rt.TypeOf<typeof metricsExplorerRowRT>;
+export type MetricsExplorerSeries = rt.TypeOf<typeof metricsExplorerSeriesRT>;
+export type MetricsExplorerResponse = rt.TypeOf<typeof metricsExplorerResponseRT>;
+/*
+ * End of metrics explorer types
+ */
diff --git a/x-pack/plugins/observability/public/components/slo/error_rate_chart/use_lens_definition.ts b/x-pack/plugins/observability/public/components/slo/error_rate_chart/use_lens_definition.ts
index ce01ac20ee69df..36cea6b76404e9 100644
--- a/x-pack/plugins/observability/public/components/slo/error_rate_chart/use_lens_definition.ts
+++ b/x-pack/plugins/observability/public/components/slo/error_rate_chart/use_lens_definition.ts
@@ -555,7 +555,7 @@ export function useLensDefinition(slo: SLOResponse): TypedLensByValueInput['attr
       adHocDataViews: {
         '32ca1ad4-81c0-4daf-b9d1-07118044bdc5': {
           id: '32ca1ad4-81c0-4daf-b9d1-07118044bdc5',
-          title: '.slo-observability.sli-v2.*',
+          title: '.slo-observability.sli-v3.*',
           timeFieldName: '@timestamp',
           sourceFilters: [],
           fieldFormats: {},
diff --git a/x-pack/plugins/observability/public/data/slo/slo.ts b/x-pack/plugins/observability/public/data/slo/slo.ts
index 5e210526884fde..c53d55a32839f4 100644
--- a/x-pack/plugins/observability/public/data/slo/slo.ts
+++ b/x-pack/plugins/observability/public/data/slo/slo.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
+import { ALL_VALUE, FindSLOResponse, SLOWithSummaryResponse } from '@kbn/slo-schema';
 import { cloneDeep } from 'lodash';
 import { v4 as uuidv4 } from 'uuid';
-import { ALL_VALUE, FindSLOResponse, SLOWithSummaryResponse } from '@kbn/slo-schema';
 import {
   buildDegradingSummary,
   buildHealthySummary,
@@ -16,8 +16,8 @@ import {
   buildTimeslicesObjective,
   buildViolatedSummary,
 } from './common';
-import { buildCalendarAlignedTimeWindow, buildRollingTimeWindow } from './time_window';
 import { buildApmAvailabilityIndicator, buildCustomKqlIndicator } from './indicator';
+import { buildCalendarAlignedTimeWindow, buildRollingTimeWindow } from './time_window';
 
 export const emptySloList: FindSLOResponse = {
   results: [],
@@ -68,6 +68,7 @@ const baseSlo: Omit<SLOWithSummaryResponse, 'id'> = {
   enabled: true,
   createdAt: now,
   updatedAt: now,
+  version: 2,
 };
 
 export const sloList: FindSLOResponse = {
diff --git a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_definitions.ts b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_definitions.ts
index e74b3570177e4f..b3b7f59dd37cf9 100644
--- a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_definitions.ts
+++ b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_definitions.ts
@@ -5,24 +5,16 @@
  * 2.0.
  */
 
-import { FindSloDefinitionsResponse, SLOResponse } from '@kbn/slo-schema';
-import {
-  QueryObserverResult,
-  RefetchOptions,
-  RefetchQueryFilters,
-  useQuery,
-} from '@tanstack/react-query';
+import { FindSLODefinitionsResponse } from '@kbn/slo-schema';
+import { useQuery } from '@tanstack/react-query';
 import { useKibana } from '../../utils/kibana_react';
 import { sloKeys } from './query_key_factory';
 
 export interface UseFetchSloDefinitionsResponse {
+  data: FindSLODefinitionsResponse | undefined;
   isLoading: boolean;
   isSuccess: boolean;
   isError: boolean;
-  data: SLOResponse[] | undefined;
-  refetch: <TPageData>(
-    options?: (RefetchOptions & RefetchQueryFilters<TPageData>) | undefined
-  ) => Promise<QueryObserverResult<SLOResponse[], unknown>>;
 }
 
 interface Params {
@@ -33,18 +25,13 @@ export function useFetchSloDefinitions({ name = '' }: Params): UseFetchSloDefini
   const { http } = useKibana().services;
   const search = name.endsWith('*') ? name : `${name}*`;
 
-  const { isLoading, isError, isSuccess, data, refetch } = useQuery({
+  const { isLoading, isError, isSuccess, data } = useQuery({
     queryKey: sloKeys.definitions(search),
     queryFn: async ({ signal }) => {
       try {
-        const response = await http.get<FindSloDefinitionsResponse>(
-          '/internal/observability/slos/_definitions',
-          {
-            query: {
-              search,
-            },
-            signal,
-          }
+        const response = await http.get<FindSLODefinitionsResponse>(
+          '/api/observability/slos/_definitions',
+          { query: { search }, signal }
         );
 
         return response;
@@ -56,5 +43,5 @@ export function useFetchSloDefinitions({ name = '' }: Params): UseFetchSloDefini
     refetchOnWindowFocus: false,
   });
 
-  return { isLoading, isError, isSuccess, data, refetch };
+  return { isLoading, isError, isSuccess, data };
 }
diff --git a/x-pack/plugins/observability/public/locators/slo_edit.test.ts b/x-pack/plugins/observability/public/locators/slo_edit.test.ts
index a01a988dcdb550..cb485ea3e3877d 100644
--- a/x-pack/plugins/observability/public/locators/slo_edit.test.ts
+++ b/x-pack/plugins/observability/public/locators/slo_edit.test.ts
@@ -20,7 +20,7 @@ describe('SloEditLocator', () => {
   it('should return correct url when slo is provided', async () => {
     const location = await locator.getLocation(buildSlo({ id: 'foo' }));
     expect(location.path).toEqual(
-      "/slos/edit/foo?_a=(budgetingMethod:occurrences,createdAt:'2022-12-29T10:11:12.000Z',description:'some%20description%20useful',enabled:!t,groupBy:'*',id:foo,indicator:(params:(filter:'baz:%20foo%20and%20bar%20%3E%202',good:'http_status:%202xx',index:some-index,timestampField:custom_timestamp,total:'a%20query'),type:sli.kql.custom),instanceId:'*',name:'super%20important%20level%20service',objective:(target:0.98),revision:1,settings:(frequency:'1m',syncDelay:'1m'),summary:(errorBudget:(consumed:0.064,initial:0.02,isEstimated:!f,remaining:0.936),sliValue:0.99872,status:HEALTHY),tags:!(k8s,production,critical),timeWindow:(duration:'30d',type:rolling),updatedAt:'2022-12-29T10:11:12.000Z')"
+      "/slos/edit/foo?_a=(budgetingMethod:occurrences,createdAt:'2022-12-29T10:11:12.000Z',description:'some%20description%20useful',enabled:!t,groupBy:'*',id:foo,indicator:(params:(filter:'baz:%20foo%20and%20bar%20%3E%202',good:'http_status:%202xx',index:some-index,timestampField:custom_timestamp,total:'a%20query'),type:sli.kql.custom),instanceId:'*',name:'super%20important%20level%20service',objective:(target:0.98),revision:1,settings:(frequency:'1m',syncDelay:'1m'),summary:(errorBudget:(consumed:0.064,initial:0.02,isEstimated:!f,remaining:0.936),sliValue:0.99872,status:HEALTHY),tags:!(k8s,production,critical),timeWindow:(duration:'30d',type:rolling),updatedAt:'2022-12-29T10:11:12.000Z',version:2)"
     );
   });
 });
diff --git a/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx b/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
index f31d36c8222648..4f938a809a82da 100644
--- a/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
@@ -252,6 +252,7 @@ describe('SLO Details Page', () => {
       settings,
       updatedAt,
       instanceId,
+      version,
       ...newSlo
     } = slo;
 
diff --git a/x-pack/plugins/observability/public/plugin.mock.tsx b/x-pack/plugins/observability/public/plugin.mock.tsx
index 9732f67aac35f7..6710b12dd6ca13 100644
--- a/x-pack/plugins/observability/public/plugin.mock.tsx
+++ b/x-pack/plugins/observability/public/plugin.mock.tsx
@@ -12,6 +12,7 @@ import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { contentManagementMock } from '@kbn/content-management-plugin/public/mocks';
 import { sharePluginMock } from '@kbn/share-plugin/public/mocks';
 import { unifiedSearchPluginMock } from '@kbn/unified-search-plugin/public/mocks';
+import { lensPluginMock } from '@kbn/lens-plugin/public/mocks';
 
 const triggersActionsUiStartMock = {
   createStart() {
@@ -103,7 +104,7 @@ export const observabilityPublicPluginsStartMock = {
       dataViewEditor: dataViewEditor.createStart(),
       dataViews: dataViews.createStart(),
       discover: null,
-      lens: null,
+      lens: lensPluginMock.createStartContract(),
       share: sharePluginMock.createStartContract(),
       triggersActionsUi: triggersActionsUiStartMock.createStart(),
       unifiedSearch: unifiedSearchPluginMock.createStartContract(),
diff --git a/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts b/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
index 4cd705656c01b3..d807de2499c507 100644
--- a/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
+++ b/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
@@ -14,7 +14,7 @@ import { ConfigSchema } from '../plugin';
 import { ObservabilityRuleTypeRegistry } from './create_observability_rule_type_registry';
 import { SLO_BURN_RATE_RULE_TYPE_ID } from '../../common/constants';
 import { validateBurnRateRule } from '../components/burn_rate_rule_editor/validation';
-import { validateMetricThreshold } from '../components/custom_threshold/components/validation';
+import { validateCustomThreshold } from '../components/custom_threshold/components/validation';
 import { formatReason } from '../components/custom_threshold/rule_data_formatters';
 
 const sloBurnRateDefaultActionMessage = i18n.translate(
@@ -112,12 +112,12 @@ export const registerObservabilityRuleTypes = (
       ),
       iconClass: 'bell',
       documentationUrl(docLinks) {
-        return `${docLinks.links.observability.threshold}`;
+        return `${docLinks.links.observability.customThreshold}`;
       },
       ruleParamsExpression: lazy(
         () => import('../components/custom_threshold/custom_threshold_rule_expression')
       ),
-      validate: validateMetricThreshold,
+      validate: validateCustomThreshold,
       defaultActionMessage: thresholdDefaultActionMessage,
       defaultRecoveryMessage: thresholdDefaultRecoveryMessage,
       requiresAppContext: false,
diff --git a/x-pack/plugins/observability/server/assets/component_templates/slo_mappings_template.ts b/x-pack/plugins/observability/server/assets/component_templates/slo_mappings_template.ts
index 71896e2593f0ac..0da5408df6955c 100644
--- a/x-pack/plugins/observability/server/assets/component_templates/slo_mappings_template.ts
+++ b/x-pack/plugins/observability/server/assets/component_templates/slo_mappings_template.ts
@@ -12,6 +12,14 @@ export const getSLOMappingsTemplate = (name: string) => ({
   template: {
     mappings: {
       properties: {
+        event: {
+          properties: {
+            ingested: {
+              type: 'date',
+              format: 'strict_date_optional_time',
+            },
+          },
+        },
         '@timestamp': {
           type: 'date',
           format: 'date_optional_time||epoch_millis',
@@ -50,34 +58,10 @@ export const getSLOMappingsTemplate = (name: string) => ({
             revision: {
               type: 'long',
             },
-            groupBy: {
-              type: 'keyword',
-              ignore_above: 256,
-            },
             instanceId: {
               type: 'keyword',
               ignore_above: 256,
             },
-            name: {
-              type: 'keyword',
-              ignore_above: 256,
-            },
-            description: {
-              type: 'keyword',
-              ignore_above: 256,
-            },
-            tags: {
-              type: 'keyword',
-              ignore_above: 256,
-            },
-            indicator: {
-              properties: {
-                type: {
-                  type: 'keyword',
-                  ignore_above: 256,
-                },
-              },
-            },
             objective: {
               properties: {
                 target: {
diff --git a/x-pack/plugins/observability/server/assets/component_templates/slo_summary_mappings_template.ts b/x-pack/plugins/observability/server/assets/component_templates/slo_summary_mappings_template.ts
index fa8e803631181d..bfdbe3b3311259 100644
--- a/x-pack/plugins/observability/server/assets/component_templates/slo_summary_mappings_template.ts
+++ b/x-pack/plugins/observability/server/assets/component_templates/slo_summary_mappings_template.ts
@@ -55,12 +55,10 @@ export const getSLOSummaryMappingsTemplate = (name: string) => ({
               ignore_above: 256,
             },
             name: {
-              type: 'keyword',
-              ignore_above: 256,
+              type: 'text',
             },
             description: {
-              type: 'keyword',
-              ignore_above: 256,
+              type: 'text',
             },
             tags: {
               type: 'keyword',
@@ -120,6 +118,14 @@ export const getSLOSummaryMappingsTemplate = (name: string) => ({
         isTempDoc: {
           type: 'boolean',
         },
+        latestSliTimestamp: {
+          type: 'date',
+          format: 'date_optional_time||epoch_millis',
+        },
+        summaryUpdatedAt: {
+          type: 'date',
+          format: 'date_optional_time||epoch_millis',
+        },
       },
     },
   },
diff --git a/x-pack/plugins/observability/server/assets/constants.ts b/x-pack/plugins/observability/server/assets/constants.ts
index 0dd9df915eee43..5e1bedac6a6a6f 100644
--- a/x-pack/plugins/observability/server/assets/constants.ts
+++ b/x-pack/plugins/observability/server/assets/constants.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-export const SLO_RESOURCES_VERSION = 2;
-export const SLO_SUMMARY_TRANSFORMS_VERSION = 3;
+export const SLO_MODEL_VERSION = 2;
+export const SLO_RESOURCES_VERSION = 3;
+export const SLO_SUMMARY_TRANSFORMS_VERSION = 4;
 
 export const SLO_COMPONENT_TEMPLATE_MAPPINGS_NAME = '.slo-observability.sli-mappings';
 export const SLO_COMPONENT_TEMPLATE_SETTINGS_NAME = '.slo-observability.sli-settings';
@@ -32,6 +33,7 @@ export const SLO_SUMMARY_TEMP_INDEX_NAME = `.slo-observability.summary-v${SLO_RE
 export const SLO_SUMMARY_DESTINATION_INDEX_PATTERN = `.slo-observability.summary-v${SLO_RESOURCES_VERSION}*`; // include temp and non-temp summary indices
 
 export const SLO_SUMMARY_INGEST_PIPELINE_NAME = `.slo-observability.summary.pipeline`;
+export const SLO_SUMMARY_ENRICH_POLICY_NAME = `slo-observability.summary.enrich_policy`;
 
 export const getSLOTransformId = (sloId: string, sloRevision: number) =>
   `slo-${sloId}-${sloRevision}`;
diff --git a/x-pack/plugins/observability/server/assets/enrich_policies/slo_summary_enrich_policy.ts b/x-pack/plugins/observability/server/assets/enrich_policies/slo_summary_enrich_policy.ts
new file mode 100644
index 00000000000000..fc089f8259f7dc
--- /dev/null
+++ b/x-pack/plugins/observability/server/assets/enrich_policies/slo_summary_enrich_policy.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SO_SLO_TYPE } from '../../saved_objects';
+import { SLO_SUMMARY_ENRICH_POLICY_NAME } from '../constants';
+
+export const getSLOSummaryEnrichPolicy = () => ({
+  name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+  match: {
+    indices: '.kibana',
+    match_field: 'slo.id',
+    enrich_fields: [
+      'slo.name',
+      'slo.description',
+      'slo.tags',
+      'slo.indicator.type',
+      'slo.objective.target',
+      'slo.budgetingMethod',
+      'slo.timeWindow.type',
+      'slo.timeWindow.duration',
+      'slo.groupBy',
+    ],
+    query: {
+      bool: {
+        filter: [
+          {
+            match_phrase: {
+              type: SO_SLO_TYPE,
+            },
+          },
+        ],
+      },
+    },
+  },
+});
diff --git a/x-pack/plugins/observability/server/assets/ingest_templates/slo_pipeline_template.ts b/x-pack/plugins/observability/server/assets/ingest_templates/slo_pipeline_template.ts
index eafa7399a7c359..e803a8011e2eae 100644
--- a/x-pack/plugins/observability/server/assets/ingest_templates/slo_pipeline_template.ts
+++ b/x-pack/plugins/observability/server/assets/ingest_templates/slo_pipeline_template.ts
@@ -5,12 +5,48 @@
  * 2.0.
  */
 
-import { SLO_RESOURCES_VERSION } from '../constants';
+import { SLO_RESOURCES_VERSION, SLO_SUMMARY_ENRICH_POLICY_NAME } from '../constants';
 
 export const getSLOPipelineTemplate = (id: string, indexNamePrefix: string) => ({
   id,
   description: 'Monthly date-time index naming for SLO data',
   processors: [
+    {
+      enrich: {
+        field: 'slo.id',
+        policy_name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+        target_field: '_enrich',
+      },
+    },
+    {
+      set: {
+        field: 'slo.timeWindow',
+        copy_from: '_enrich.slo.timeWindow',
+      },
+    },
+    {
+      set: {
+        field: 'slo.budgetingMethod',
+        copy_from: '_enrich.slo.budgetingMethod',
+      },
+    },
+    {
+      set: {
+        field: 'slo.objective.target',
+        copy_from: '_enrich.slo.objective.target',
+      },
+    },
+    {
+      remove: {
+        field: '_enrich',
+      },
+    },
+    {
+      set: {
+        field: 'event.ingested',
+        value: '{{{_ingest.timestamp}}}',
+      },
+    },
     {
       date_index_name: {
         field: '@timestamp',
diff --git a/x-pack/plugins/observability/server/assets/ingest_templates/slo_summary_pipeline_template.ts b/x-pack/plugins/observability/server/assets/ingest_templates/slo_summary_pipeline_template.ts
index d3c8e04b93730f..ccdcb24e61c13d 100644
--- a/x-pack/plugins/observability/server/assets/ingest_templates/slo_summary_pipeline_template.ts
+++ b/x-pack/plugins/observability/server/assets/ingest_templates/slo_summary_pipeline_template.ts
@@ -5,19 +5,12 @@
  * 2.0.
  */
 
-import { SLO_RESOURCES_VERSION } from '../constants';
+import { SLO_RESOURCES_VERSION, SLO_SUMMARY_ENRICH_POLICY_NAME } from '../constants';
 
 export const getSLOSummaryPipelineTemplate = (id: string) => ({
   id,
   description: 'SLO summary ingest pipeline',
   processors: [
-    {
-      split: {
-        description: 'Split comma separated list of tags into an array',
-        field: 'slo.tags',
-        separator: ',',
-      },
-    },
     {
       set: {
         description: "if 'statusCode == 0', set status to NO_DATA",
@@ -50,6 +43,72 @@ export const getSLOSummaryPipelineTemplate = (id: string) => ({
         value: 'HEALTHY',
       },
     },
+    {
+      enrich: {
+        field: 'slo.id',
+        policy_name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+        target_field: '_enrich',
+      },
+    },
+    {
+      set: {
+        field: 'slo.name',
+        copy_from: '_enrich.slo.name',
+      },
+    },
+    {
+      set: {
+        field: 'slo.description',
+        copy_from: '_enrich.slo.description',
+      },
+    },
+    {
+      set: {
+        field: 'slo.indicator',
+        copy_from: '_enrich.slo.indicator',
+      },
+    },
+    {
+      set: {
+        field: 'slo.timeWindow',
+        copy_from: '_enrich.slo.timeWindow',
+      },
+    },
+    {
+      set: {
+        field: 'slo.groupBy',
+        copy_from: '_enrich.slo.groupBy',
+      },
+    },
+    {
+      set: {
+        field: 'slo.tags',
+        copy_from: '_enrich.slo.tags',
+      },
+    },
+    {
+      set: {
+        field: 'slo.objective',
+        copy_from: '_enrich.slo.objective',
+      },
+    },
+    {
+      set: {
+        field: 'slo.budgetingMethod',
+        copy_from: '_enrich.slo.budgetingMethod',
+      },
+    },
+    {
+      remove: {
+        field: '_enrich',
+      },
+    },
+    {
+      set: {
+        field: 'summaryUpdatedAt',
+        value: '{{{_ingest.timestamp}}}',
+      },
+    },
   ],
   _meta: {
     description: 'SLO summary ingest pipeline',
diff --git a/x-pack/plugins/observability/server/index.ts b/x-pack/plugins/observability/server/index.ts
index 96231115e3fa2a..ce2279db23203f 100644
--- a/x-pack/plugins/observability/server/index.ts
+++ b/x-pack/plugins/observability/server/index.ts
@@ -10,7 +10,7 @@
 
 import { offeringBasedSchema, schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { ObservabilityPlugin, ObservabilityPluginSetup } from './plugin';
+import type { ObservabilityPluginSetup } from './plugin';
 import { createOrUpdateIndex, Mappings } from './utils/create_or_update_index';
 import { createOrUpdateIndexTemplate } from './utils/create_or_update_index_template';
 import { ScopedAnnotationsClient } from './lib/annotations/bootstrap_annotations';
@@ -48,7 +48,7 @@ const configSchema = schema.object({
     }),
     thresholdRule: schema.object({
       enabled: offeringBasedSchema({
-        serverless: schema.boolean({ defaultValue: false }),
+        serverless: schema.boolean({ defaultValue: true }),
         traditional: schema.boolean({ defaultValue: true }),
       }),
     }),
@@ -75,8 +75,10 @@ export const config: PluginConfigDescriptor = {
 
 export type ObservabilityConfig = TypeOf<typeof configSchema>;
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new ObservabilityPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { ObservabilityPlugin } = await import('./plugin');
+  return new ObservabilityPlugin(initContext);
+};
 
 export type { Mappings, ObservabilityPluginSetup, ScopedAnnotationsClient };
 export {
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts
index 73fead1a6f12bf..e5301b8ac8da1f 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts
@@ -21,11 +21,12 @@ import { CustomThresholdAlertContext } from './types';
 import { Evaluation } from './lib/evaluate_rule';
 import type { LogMeta, Logger } from '@kbn/logging';
 import { DEFAULT_FLAPPING_SETTINGS } from '@kbn/alerting-plugin/common';
+import { CUSTOM_AGGREGATOR } from '../../../../common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
-  CountMetricExpressionParams,
-  NonCountMetricExpressionParams,
+  CustomMetricExpressionParams,
+  CustomThresholdExpressionMetric,
 } from '../../../../common/custom_threshold_rule/types';
 
 jest.mock('./lib/evaluate_rule', () => ({ evaluateRule: jest.fn() }));
@@ -147,7 +148,7 @@ describe('The metric threshold alert type', () => {
           sourceId,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold,
             },
@@ -163,10 +164,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator,
             threshold,
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire,
@@ -235,7 +235,7 @@ describe('The metric threshold alert type', () => {
       const { action } = mostRecentAction(instanceID);
       expect(action.group).toBeUndefined();
       expect(action.reason).toBe(
-        'test.metric.1 is 1, above the threshold of 0.75. (duration: 1 min, data view: mockedDataViewName)'
+        'Average test.metric.1 is 1, above the threshold of 0.75. (duration: 1 min, data view: mockedDataViewName)'
       );
     });
   });
@@ -246,7 +246,7 @@ describe('The metric threshold alert type', () => {
       comparator: Comparator,
       threshold: number[],
       groupBy: string[] = ['groupByField'],
-      metric?: string,
+      metrics?: CustomThresholdExpressionMetric[],
       state?: any
     ) =>
       executor({
@@ -257,10 +257,10 @@ describe('The metric threshold alert type', () => {
           groupBy,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold,
-              metric: metric ?? baseNonCountCriterion.metric,
+              metrics: metrics ?? customThresholdNonCountCriterion.metrics,
             },
           ],
         },
@@ -272,10 +272,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -283,10 +282,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -303,10 +301,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT,
             threshold: [1.5],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -314,10 +311,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT,
             threshold: [1.5],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -334,10 +330,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [5],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -345,10 +340,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [5],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -365,10 +359,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -376,10 +369,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -400,10 +392,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -411,10 +409,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -422,10 +426,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'b' },
           },
           c: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -438,16 +448,21 @@ describe('The metric threshold alert type', () => {
         Comparator.GT,
         [0.75],
         ['groupByField'],
-        'test.metric.2'
+        [
+          {
+            aggType: Aggregators.AVERAGE,
+            name: 'A',
+            field: 'test.metric.2',
+          },
+        ]
       );
       expect(stateResult1.missingGroups).toEqual(expect.arrayContaining([]));
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -455,10 +470,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -466,10 +480,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'b' },
           },
           c: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -482,7 +495,13 @@ describe('The metric threshold alert type', () => {
         Comparator.GT,
         [0.75],
         ['groupByField'],
-        'test.metric.1',
+        [
+          {
+            aggType: Aggregators.AVERAGE,
+            name: 'A',
+            field: 'test.metric.1',
+          },
+        ],
         stateResult1
       );
       expect(stateResult2.missingGroups).toEqual(
@@ -491,10 +510,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -502,10 +520,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -518,7 +535,13 @@ describe('The metric threshold alert type', () => {
         Comparator.GT,
         [0.75],
         ['groupByField', 'groupByField-else'],
-        'test.metric.1',
+        [
+          {
+            aggType: Aggregators.AVERAGE,
+            name: 'A',
+            field: 'test.metric.2',
+          },
+        ],
         stateResult2
       );
       expect(stateResult3.missingGroups).toEqual(expect.arrayContaining([]));
@@ -528,7 +551,7 @@ describe('The metric threshold alert type', () => {
       comparator: Comparator,
       threshold: number[],
       filterQuery: string,
-      metric?: string,
+      metrics?: any,
       state?: any
     ) =>
       executor({
@@ -539,10 +562,10 @@ describe('The metric threshold alert type', () => {
           groupBy: ['groupByField'],
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold,
-              metric: metric ?? baseNonCountCriterion.metric,
+              metrics: metrics ?? customThresholdNonCountCriterion.metrics,
             },
           ],
           searchConfiguration: {
@@ -558,10 +581,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -569,10 +598,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -580,10 +615,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'b' },
           },
           c: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -602,10 +643,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -613,10 +653,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -624,10 +663,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'b' },
           },
           c: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -649,10 +687,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -660,10 +697,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -676,7 +712,13 @@ describe('The metric threshold alert type', () => {
         Comparator.GT,
         [0.75],
         JSON.stringify({ query: 'different' }),
-        'test.metric.1',
+        [
+          {
+            aggType: Aggregators.AVERAGE,
+            name: 'A',
+            field: 'test.metric.1',
+          },
+        ],
         stateResult2
       );
       expect(stateResult3.groups).toEqual(expect.arrayContaining([]));
@@ -689,7 +731,7 @@ describe('The metric threshold alert type', () => {
       comparator: Comparator,
       threshold: number[],
       groupBy: string[] = ['host.name'],
-      metric?: string,
+      metrics?: any,
       state?: any
     ) =>
       executor({
@@ -700,10 +742,10 @@ describe('The metric threshold alert type', () => {
           groupBy,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold,
-              metric: metric ?? baseNonCountCriterion.metric,
+              metrics: metrics ?? customThresholdNonCountCriterion.metrics,
             },
           ],
         },
@@ -720,10 +762,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           'host-01': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -734,10 +775,9 @@ describe('The metric threshold alert type', () => {
             },
           },
           'host-02': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -771,7 +811,7 @@ describe('The metric threshold alert type', () => {
       comparator: Comparator,
       threshold: number[],
       groupBy: string = '',
-      metric?: string,
+      metrics?: any,
       state?: any
     ) =>
       executor({
@@ -782,10 +822,10 @@ describe('The metric threshold alert type', () => {
           groupBy,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold,
-              metric: metric ?? baseNonCountCriterion.metric,
+              metrics: metrics ?? customThresholdNonCountCriterion.metrics,
             },
           ],
         },
@@ -800,10 +840,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.75],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -837,15 +876,21 @@ describe('The metric threshold alert type', () => {
           groupBy,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold: thresholdA,
             },
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator,
               threshold: thresholdB,
-              metric: 'test.metric.2',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.2',
+                },
+              ],
             },
           ],
         },
@@ -854,10 +899,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [1.0],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -867,10 +911,9 @@ describe('The metric threshold alert type', () => {
         },
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [3.0],
-            metric: 'test.metric.2',
             currentValue: 3.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -887,10 +930,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT_OR_EQ,
             threshold: [1.0],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -908,10 +950,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [1.0],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -919,10 +960,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [1.0],
-            metric: 'test.metric.1',
             currentValue: 3.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -932,10 +972,16 @@ describe('The metric threshold alert type', () => {
         },
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [3.0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -943,10 +989,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [3.0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -965,10 +1017,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [1.0],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -978,10 +1029,16 @@ describe('The metric threshold alert type', () => {
         },
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT_OR_EQ,
             threshold: [3.0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -995,7 +1052,7 @@ describe('The metric threshold alert type', () => {
       const { action } = mostRecentAction(instanceID);
       const reasons = action.reason;
       expect(reasons).toBe(
-        'test.metric.1 is 1, above the threshold of 1; test.metric.2 is 3, above the threshold of 3. (duration: 1 min, data view: mockedDataViewName)'
+        'Average test.metric.1 is 1, above the threshold of 1; Average test.metric.2 is 3, above the threshold of 3. (duration: 1 min, data view: mockedDataViewName)'
       );
     });
   });
@@ -1011,10 +1068,10 @@ describe('The metric threshold alert type', () => {
           sourceId,
           criteria: [
             {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator,
               threshold,
-            } as CountMetricExpressionParams,
+            },
           ],
         },
       });
@@ -1022,10 +1079,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseCountCriterion,
+            ...customThresholdCountCriterion,
             comparator: Comparator.GT,
             threshold: [0.9],
-            metric: 'count',
             currentValue: 1,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1039,10 +1095,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseCountCriterion,
+            ...customThresholdCountCriterion,
             comparator: Comparator.LT,
             threshold: [0.5],
-            metric: 'count',
             currentValue: 1,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1070,7 +1125,7 @@ describe('The metric threshold alert type', () => {
             groupBy: 'groupByField',
             criteria: [
               {
-                ...baseCountCriterion,
+                ...customThresholdCountCriterion,
                 comparator,
                 threshold,
               },
@@ -1085,10 +1140,9 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             a: {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator: Comparator.LT_OR_EQ,
               threshold: [0],
-              metric: 'count',
               currentValue: 1,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1096,10 +1150,9 @@ describe('The metric threshold alert type', () => {
               bucketKey: { groupBy0: 'a' },
             },
             b: {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator: Comparator.LT_OR_EQ,
               threshold: [0],
-              metric: 'count',
               currentValue: 1,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1114,10 +1167,9 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             a: {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator: Comparator.LT_OR_EQ,
               threshold: [0],
-              metric: 'count',
               currentValue: 0,
               timestamp: new Date().toISOString(),
               shouldFire: true,
@@ -1125,10 +1177,9 @@ describe('The metric threshold alert type', () => {
               bucketKey: { groupBy0: 'a' },
             },
             b: {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator: Comparator.LT_OR_EQ,
               threshold: [0],
-              metric: 'count',
               currentValue: 0,
               timestamp: new Date().toISOString(),
               shouldFire: true,
@@ -1143,121 +1194,6 @@ describe('The metric threshold alert type', () => {
       });
     });
   });
-  describe('querying with the p99 aggregator', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
-    const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
-      executor({
-        ...mockOptions,
-        services,
-        params: {
-          ...mockOptions.params,
-          criteria: [
-            {
-              ...baseNonCountCriterion,
-              comparator,
-              threshold,
-              aggType: Aggregators.P99,
-              metric: 'test.metric.2',
-            },
-          ],
-        },
-      });
-    test('alerts based on the p99 values', async () => {
-      setEvaluationResults([
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT,
-            threshold: [1],
-            metric: 'test.metric.2',
-            currentValue: 3,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-      ]);
-      await execute(Comparator.GT, [1]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
-      setEvaluationResults([
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.LT,
-            threshold: [1],
-            metric: 'test.metric.2',
-            currentValue: 3,
-            timestamp: new Date().toISOString(),
-            shouldFire: false,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-      ]);
-      await execute(Comparator.LT, [1]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-    });
-  });
-  describe('querying with the p95 aggregator', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
-    const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
-      executor({
-        ...mockOptions,
-        services,
-        params: {
-          ...mockOptions.params,
-          sourceId,
-          criteria: [
-            {
-              ...baseNonCountCriterion,
-              comparator,
-              threshold,
-              aggType: Aggregators.P95,
-              metric: 'test.metric.1',
-            },
-          ],
-        },
-      });
-    test('alerts based on the p95 values', async () => {
-      setEvaluationResults([
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT,
-            threshold: [0.25],
-            metric: 'test.metric.1',
-            currentValue: 1.0,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-      ]);
-      await execute(Comparator.GT, [0.25]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
-      setEvaluationResults([
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.LT,
-            threshold: [0.95],
-            metric: 'test.metric.1',
-            currentValue: 1.0,
-            timestamp: new Date().toISOString(),
-            shouldFire: false,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-      ]);
-      await execute(Comparator.LT, [0.95]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-    });
-  });
   describe("querying a metric that hasn't reported data", () => {
     afterAll(() => clearInstances());
     const instanceID = '*';
@@ -1270,10 +1206,16 @@ describe('The metric threshold alert type', () => {
           sourceId,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [1],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
             },
           ],
           alertOnNoData,
@@ -1283,10 +1225,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT,
             threshold: [1],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1297,17 +1245,25 @@ describe('The metric threshold alert type', () => {
       ]);
       await execute(true);
       const recentAction = mostRecentAction(instanceID);
-      expect(recentAction.action.reason).toEqual('test.metric.3 reported no data in the last 1m');
+      expect(recentAction.action.reason).toEqual(
+        'Average test.metric.3 reported no data in the last 1m'
+      );
       expect(recentAction).toBeNoDataAction();
     });
     test('does not send a No Data alert when not configured to do so', async () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT,
             threshold: [1],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1333,13 +1289,19 @@ describe('The metric threshold alert type', () => {
           sourceId,
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [1],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
             },
             {
-              ...baseCountCriterion,
+              ...customThresholdCountCriterion,
               comparator: Comparator.GT,
               threshold: [30],
             },
@@ -1351,10 +1313,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.LT,
             threshold: [1],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: STARTED_AT_MOCK_DATE.toISOString(),
             shouldFire: false,
@@ -1368,9 +1336,9 @@ describe('The metric threshold alert type', () => {
       const recentAction = mostRecentAction(instanceID);
       expect(recentAction.action).toEqual({
         alertDetailsUrl: '',
-        reason: 'test.metric.3 reported no data in the last 1m',
+        reason: 'Average test.metric.3 reported no data in the last 1m',
         timestamp: STARTED_AT_MOCK_DATE.toISOString(),
-        value: ['[NO DATA]', 0],
+        value: ['[NO DATA]', null],
         tags: [],
       });
       expect(recentAction).toBeNoDataAction();
@@ -1383,7 +1351,7 @@ describe('The metric threshold alert type', () => {
     const instanceIdA = 'a';
     const instanceIdB = 'b';
     const instanceIdC = 'c';
-    const execute = (metric: string, alertOnGroupDisappear: boolean = true, state?: any) =>
+    const execute = (metrics: any, alertOnGroupDisappear: boolean = true, state?: any) =>
       executor({
         ...mockOptions,
         services,
@@ -1393,10 +1361,10 @@ describe('The metric threshold alert type', () => {
           sourceId: 'default',
           criteria: [
             {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric,
+              metrics,
             },
           ],
           alertOnNoData: true,
@@ -1418,10 +1386,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1435,10 +1409,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           '*': {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1452,10 +1432,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.1',
             currentValue: 1.0,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1463,10 +1442,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1488,10 +1466,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1499,10 +1483,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.3',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.3',
+              },
+            ],
             currentValue: null,
             timestamp: new Date().toISOString(),
             shouldFire: false,
@@ -1520,10 +1510,16 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1531,10 +1527,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 1,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1542,10 +1544,16 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'b' },
           },
           c: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.2',
+            metrics: [
+              {
+                aggType: Aggregators.AVERAGE,
+                name: 'A',
+                field: 'test.metric.2',
+              },
+            ],
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1562,10 +1570,9 @@ describe('The metric threshold alert type', () => {
       setEvaluationResults([
         {
           a: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.1',
             currentValue: 1,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1573,10 +1580,9 @@ describe('The metric threshold alert type', () => {
             bucketKey: { groupBy0: 'a' },
           },
           b: {
-            ...baseNonCountCriterion,
+            ...customThresholdNonCountCriterion,
             comparator: Comparator.GT,
             threshold: [0],
-            metric: 'test.metric.1',
             currentValue: 3,
             timestamp: new Date().toISOString(),
             shouldFire: true,
@@ -1593,7 +1599,7 @@ describe('The metric threshold alert type', () => {
     });
 
     describe('if alertOnNoData is disabled but alertOnGroupDisappear is enabled', () => {
-      const executeWeirdNoDataConfig = (metric: string, state?: any) =>
+      const executeWeirdNoDataConfig = (metrics: any, state?: any) =>
         executor({
           ...mockOptions,
           services,
@@ -1603,10 +1609,10 @@ describe('The metric threshold alert type', () => {
             sourceId: 'default',
             criteria: [
               {
-                ...baseNonCountCriterion,
+                ...customThresholdNonCountCriterion,
                 comparator: Comparator.GT,
                 threshold: [0],
-                metric,
+                metrics,
               },
             ],
             alertOnNoData: false,
@@ -1624,10 +1630,16 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             '*': {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
               currentValue: null,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1641,10 +1653,16 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             '*': {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
               currentValue: null,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1658,10 +1676,9 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             a: {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.1',
               currentValue: 1,
               timestamp: new Date().toISOString(),
               shouldFire: true,
@@ -1669,10 +1686,9 @@ describe('The metric threshold alert type', () => {
               bucketKey: { groupBy0: 'a' },
             },
             b: {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.1',
               currentValue: 3,
               timestamp: new Date().toISOString(),
               shouldFire: true,
@@ -1692,10 +1708,16 @@ describe('The metric threshold alert type', () => {
         setEvaluationResults([
           {
             a: {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
               currentValue: null,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1703,10 +1725,16 @@ describe('The metric threshold alert type', () => {
               bucketKey: { groupBy0: 'a' },
             },
             b: {
-              ...baseNonCountCriterion,
+              ...customThresholdNonCountCriterion,
               comparator: Comparator.GT,
               threshold: [0],
-              metric: 'test.metric.3',
+              metrics: [
+                {
+                  aggType: Aggregators.AVERAGE,
+                  name: 'A',
+                  field: 'test.metric.3',
+                },
+              ],
               currentValue: null,
               timestamp: new Date().toISOString(),
               shouldFire: false,
@@ -1854,19 +1882,31 @@ declare global {
   }
 }
 
-const baseNonCountCriterion = {
-  aggType: Aggregators.AVERAGE,
-  metric: 'test.metric.1',
+const customThresholdNonCountCriterion: CustomMetricExpressionParams = {
+  aggType: CUSTOM_AGGREGATOR,
+  comparator: Comparator.GT,
+  metrics: [
+    {
+      aggType: Aggregators.AVERAGE,
+      name: 'A',
+      field: 'test.metric.1',
+    },
+  ],
   timeSize: 1,
   timeUnit: 'm',
   threshold: [0],
-  comparator: Comparator.GT,
-} as NonCountMetricExpressionParams;
+};
 
-const baseCountCriterion = {
-  aggType: Aggregators.COUNT,
+const customThresholdCountCriterion: CustomMetricExpressionParams = {
+  aggType: CUSTOM_AGGREGATOR,
+  comparator: Comparator.GT,
+  metrics: [
+    {
+      aggType: Aggregators.COUNT,
+      name: 'A',
+    },
+  ],
   timeSize: 1,
   timeUnit: 'm',
   threshold: [0],
-  comparator: Comparator.GT,
-} as CountMetricExpressionParams;
+};
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts
index c832ecc9144bfc..2e50c33048f516 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts
@@ -43,7 +43,7 @@ import {
   getFormattedGroupBy,
 } from './utils';
 
-import { formatAlertResult } from './lib/format_alert_result';
+import { formatAlertResult, getLabel } from './lib/format_alert_result';
 import { EvaluatedRuleParams, evaluateRule } from './lib/evaluate_rule';
 import { MissingGroupsRecord } from './lib/check_missing_group';
 import { convertStringsToMissingGroupsRecord } from './lib/convert_strings_to_missing_groups_record';
@@ -86,7 +86,6 @@ export const createCustomThresholdExecutor = ({
       executionId,
     });
 
-    // TODO: check if we need to use "savedObjectsClient"=> https://github.com/elastic/kibana/issues/159340
     const {
       alertWithLifecycle,
       getAlertUuid,
@@ -215,7 +214,9 @@ export const createCustomThresholdExecutor = ({
         if (nextState === AlertStates.NO_DATA) {
           reason = alertResults
             .filter((result) => result[group]?.isNoData)
-            .map((result) => buildNoDataAlertReason({ ...result[group], group }))
+            .map((result) =>
+              buildNoDataAlertReason({ ...result[group], label: getLabel(result[group]), group })
+            )
             .join('\n');
         }
       }
@@ -271,9 +272,7 @@ export const createCustomThresholdExecutor = ({
           timestamp,
           value: alertResults.map((result, index) => {
             const evaluation = result[group];
-            if (!evaluation && criteria[index].aggType === 'count') {
-              return 0;
-            } else if (!evaluation) {
+            if (!evaluation) {
               return null;
             }
             return formatAlertResult(evaluation).currentValue;
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts
index 7651130601b6c1..6b8041b448484e 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts
@@ -8,7 +8,7 @@
 import { ElasticsearchClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
 import { isString, get, identity } from 'lodash';
-import { MetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 import type { BucketKey } from './get_data';
 import { calculateCurrentTimeframe, createBaseFilters } from './metric_query';
 
@@ -19,7 +19,7 @@ export interface MissingGroupsRecord {
 
 export const checkMissingGroups = async (
   esClient: ElasticsearchClient,
-  metricParams: MetricExpressionParams,
+  metricParams: CustomMetricExpressionParams,
   indexPattern: string,
   timeFieldName: string,
   groupBy: string | undefined | string[],
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_bucket_selector.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_bucket_selector.ts
index 3066276316921d..9a1dde442983c7 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_bucket_selector.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_bucket_selector.ts
@@ -5,33 +5,19 @@
  * 2.0.
  */
 
-import {
-  Aggregators,
-  MetricExpressionParams,
-} from '../../../../../common/custom_threshold_rule/types';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 import { createConditionScript } from './create_condition_script';
 import { createLastPeriod } from './wrap_in_period';
 
 export const createBucketSelector = (
-  condition: MetricExpressionParams,
+  condition: CustomMetricExpressionParams,
   alertOnGroupDisappear: boolean = false,
   timeFieldName: string,
   groupBy?: string | string[],
   lastPeriodEnd?: number
 ) => {
   const hasGroupBy = !!groupBy;
-  const isPercentile = [Aggregators.P95, Aggregators.P99].includes(condition.aggType);
-  const isCount = condition.aggType === Aggregators.COUNT;
-  const isRate = condition.aggType === Aggregators.RATE;
-  const bucketPath = isCount
-    ? "currentPeriod['all']>_count"
-    : isRate
-    ? `aggregatedValue`
-    : isPercentile
-    ? `currentPeriod[\'all\']>aggregatedValue[${
-        condition.aggType === Aggregators.P95 ? '95' : '99'
-      }]`
-    : "currentPeriod['all']>aggregatedValue";
+  const bucketPath = "currentPeriod['all']>aggregatedValue";
 
   const shouldTrigger = {
     bucket_script: {
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_custom_metrics_aggregations.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_custom_metrics_aggregations.ts
index 770d16c927e232..255475c8d8a5cc 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_custom_metrics_aggregations.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_custom_metrics_aggregations.ts
@@ -8,25 +8,16 @@
 import { fromKueryExpression, toElasticsearchQuery } from '@kbn/es-query';
 import { isEmpty } from 'lodash';
 import { CustomThresholdExpressionMetric } from '../../../../../common/custom_threshold_rule/types';
-import { MetricsExplorerCustomMetric } from './metrics_explorer';
-
-const isMetricExpressionCustomMetric = (
-  subject: MetricsExplorerCustomMetric | CustomThresholdExpressionMetric
-): subject is CustomThresholdExpressionMetric => {
-  return 'aggType' in subject;
-};
 
 export const createCustomMetricsAggregations = (
   id: string,
-  customMetrics: Array<MetricsExplorerCustomMetric | CustomThresholdExpressionMetric>,
+  customMetrics: CustomThresholdExpressionMetric[],
   equation?: string
 ) => {
   const bucketsPath: { [id: string]: string } = {};
   const metricAggregations = customMetrics.reduce((acc, metric) => {
     const key = `${id}_${metric.name}`;
-    const aggregation = isMetricExpressionCustomMetric(metric)
-      ? metric.aggType
-      : metric.aggregation;
+    const aggregation = metric.aggType;
 
     if (aggregation === 'count') {
       bucketsPath[metric.name] = `${key}>_count`;
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_percentile_aggregation.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_percentile_aggregation.ts
deleted file mode 100644
index 73db4a3e747eef..00000000000000
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_percentile_aggregation.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
-
-export const createPercentileAggregation = (
-  type: Aggregators.P95 | Aggregators.P99,
-  field: string
-) => {
-  const value = type === Aggregators.P95 ? 95 : 99;
-  return {
-    aggregatedValue: {
-      percentiles: {
-        field,
-        percents: [value],
-        keyed: true,
-      },
-    },
-  };
-};
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_rate_aggregation.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_rate_aggregation.ts
deleted file mode 100644
index 3017d7bc95dcdc..00000000000000
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_rate_aggregation.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import moment from 'moment';
-import { calculateRateTimeranges } from '../utils';
-
-export const createRateAggsBucketScript = (
-  timeframe: { start: number; end: number },
-  id: string
-) => {
-  const { intervalInSeconds } = calculateRateTimeranges({
-    to: timeframe.end,
-    from: timeframe.start,
-  });
-  return {
-    [id]: {
-      bucket_script: {
-        buckets_path: {
-          first: `currentPeriod['all']>${id}_first_bucket.maxValue`,
-          second: `currentPeriod['all']>${id}_second_bucket.maxValue`,
-        },
-        script: `params.second > 0.0 && params.first > 0.0 && params.second > params.first ? (params.second - params.first) / ${intervalInSeconds}: null`,
-      },
-    },
-  };
-};
-
-export const createRateAggsBuckets = (
-  timeframe: { start: number; end: number; timeFieldName: string },
-  id: string,
-  field: string
-) => {
-  const { firstBucketRange, secondBucketRange } = calculateRateTimeranges({
-    to: timeframe.end,
-    from: timeframe.start,
-  });
-
-  return {
-    [`${id}_first_bucket`]: {
-      filter: {
-        range: {
-          [timeframe.timeFieldName]: {
-            gte: moment(firstBucketRange.from).toISOString(),
-            lt: moment(firstBucketRange.to).toISOString(),
-          },
-        },
-      },
-      aggs: { maxValue: { max: { field } } },
-    },
-    [`${id}_second_bucket`]: {
-      filter: {
-        range: {
-          [timeframe.timeFieldName]: {
-            gte: moment(secondBucketRange.from).toISOString(),
-            lt: moment(secondBucketRange.to).toISOString(),
-          },
-        },
-      },
-      aggs: { maxValue: { max: { field } } },
-    },
-  };
-};
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.test.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.test.ts
index 41109fbeae912a..c82f07594bf838 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.test.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.test.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
 import moment from 'moment';
 
 import { createTimerange } from './create_timerange';
@@ -18,65 +17,37 @@ describe('createTimerange(interval, aggType, timeframe)', () => {
   };
   describe('Basic Metric Aggs', () => {
     it('should return a second range for last 1 second', () => {
-      const subject = createTimerange(1000, Aggregators.COUNT, timeframe);
+      const subject = createTimerange(1000, timeframe);
       expect(subject.end - subject.start).toEqual(1000);
     });
     it('should return a minute range for last 1 minute', () => {
-      const subject = createTimerange(60000, Aggregators.COUNT, timeframe);
+      const subject = createTimerange(60000, timeframe);
       expect(subject.end - subject.start).toEqual(60000);
     });
     it('should return 5 minute range for last 5 minutes', () => {
-      const subject = createTimerange(300000, Aggregators.COUNT, timeframe);
+      const subject = createTimerange(300000, timeframe);
       expect(subject.end - subject.start).toEqual(300000);
     });
     it('should return a hour range for last 1 hour', () => {
-      const subject = createTimerange(3600000, Aggregators.COUNT, timeframe);
+      const subject = createTimerange(3600000, timeframe);
       expect(subject.end - subject.start).toEqual(3600000);
     });
     it('should return a day range for last 1 day', () => {
-      const subject = createTimerange(86400000, Aggregators.COUNT, timeframe);
+      const subject = createTimerange(86400000, timeframe);
       expect(subject.end - subject.start).toEqual(86400000);
     });
   });
-  describe('Rate Aggs', () => {
-    it('should return a 20 second range for last 1 second', () => {
-      const subject = createTimerange(1000, Aggregators.RATE, timeframe);
-      expect(subject.end - subject.start).toEqual(1000 * 2);
-    });
-    it('should return a 5 minute range for last 1 minute', () => {
-      const subject = createTimerange(60000, Aggregators.RATE, timeframe);
-      expect(subject.end - subject.start).toEqual(60000 * 2);
-    });
-    it('should return 25 minute range for last 5 minutes', () => {
-      const subject = createTimerange(300000, Aggregators.RATE, timeframe);
-      expect(subject.end - subject.start).toEqual(300000 * 2);
-    });
-    it('should return 5 hour range for last hour', () => {
-      const subject = createTimerange(3600000, Aggregators.RATE, timeframe);
-      expect(subject.end - subject.start).toEqual(3600000 * 2);
-    });
-    it('should return a 5 day range for last day', () => {
-      const subject = createTimerange(86400000, Aggregators.RATE, timeframe);
-      expect(subject.end - subject.start).toEqual(86400000 * 2);
-    });
-  });
   describe('With lastPeriodEnd', () => {
     it('should return a minute and 1 second range for last 1 second when the lastPeriodEnd is less than the timeframe start', () => {
       const subject = createTimerange(
         1000,
-        Aggregators.COUNT,
         timeframe,
         end.clone().subtract(1, 'minutes').valueOf()
       );
       expect(subject.end - subject.start).toEqual(61000);
     });
     it('should return a second range for last 1 second when the lastPeriodEnd is not less than the timeframe start', () => {
-      const subject = createTimerange(
-        1000,
-        Aggregators.COUNT,
-        timeframe,
-        end.clone().add(2, 'seconds').valueOf()
-      );
+      const subject = createTimerange(1000, timeframe, end.clone().add(2, 'seconds').valueOf());
       expect(subject.end - subject.start).toEqual(1000);
     });
   });
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.ts
index 257318a0bd1092..a6c39adcd3204f 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_timerange.ts
@@ -6,20 +6,16 @@
  */
 
 import moment from 'moment';
-import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
 
 export const createTimerange = (
   interval: number,
-  aggType: Aggregators,
   timeframe: { end: string; start: string },
   lastPeriodEnd?: number
 ) => {
   const end = moment(timeframe.end).valueOf();
   let start = moment(timeframe.start).valueOf();
 
-  // Rate aggregations need 5 buckets worth of data
-  const minimumBuckets = aggType === Aggregators.RATE ? 2 : 1;
-  start = start - interval * minimumBuckets;
+  start = start - interval;
 
   // Use lastPeriodEnd - interval when it's less than start
   if (lastPeriodEnd && lastPeriodEnd - interval < start) {
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts
index 30e3033d167379..b1f790da9d1469 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts
@@ -8,35 +8,20 @@
 import moment from 'moment';
 import { ElasticsearchClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
-import {
-  Aggregators,
-  CustomMetricExpressionParams,
-  MetricExpressionParams,
-} from '../../../../../common/custom_threshold_rule/types';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 import { AdditionalContext, getIntervalInSeconds } from '../utils';
-import {
-  AVERAGE_I18N,
-  CARDINALITY_I18N,
-  CUSTOM_EQUATION_I18N,
-  DOCUMENT_COUNT_I18N,
-  MAX_I18N,
-  MIN_I18N,
-  SUM_I18N,
-} from '../translations';
 import { SearchConfigurationType } from '../types';
 import { createTimerange } from './create_timerange';
 import { getData } from './get_data';
 import { checkMissingGroups, MissingGroupsRecord } from './check_missing_group';
-import { isCustom } from './metric_expression_params';
 
 export interface EvaluatedRuleParams {
-  criteria: MetricExpressionParams[];
+  criteria: CustomMetricExpressionParams[];
   groupBy: string | undefined | string[];
   searchConfiguration: SearchConfigurationType;
 }
 
-export type Evaluation = Omit<MetricExpressionParams, 'metric'> & {
-  metric: string;
+export type Evaluation = CustomMetricExpressionParams & {
   currentValue: number | null;
   timestamp: string;
   shouldFire: boolean;
@@ -45,26 +30,6 @@ export type Evaluation = Omit<MetricExpressionParams, 'metric'> & {
   context?: AdditionalContext;
 };
 
-const getMetric = (criterion: CustomMetricExpressionParams) => {
-  if (!criterion.label && criterion.metrics.length === 1) {
-    switch (criterion.metrics[0].aggType) {
-      case Aggregators.COUNT:
-        return DOCUMENT_COUNT_I18N;
-      case Aggregators.AVERAGE:
-        return AVERAGE_I18N(criterion.metrics[0].field!);
-      case Aggregators.MAX:
-        return MAX_I18N(criterion.metrics[0].field!);
-      case Aggregators.MIN:
-        return MIN_I18N(criterion.metrics[0].field!);
-      case Aggregators.CARDINALITY:
-        return CARDINALITY_I18N(criterion.metrics[0].field!);
-      case Aggregators.SUM:
-        return SUM_I18N(criterion.metrics[0].field!);
-    }
-  }
-  return criterion.label || CUSTOM_EQUATION_I18N;
-};
-
 export const evaluateRule = async <Params extends EvaluatedRuleParams = EvaluatedRuleParams>(
   esClient: ElasticsearchClient,
   params: Params,
@@ -84,12 +49,7 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
       const interval = `${criterion.timeSize}${criterion.timeUnit}`;
       const intervalAsSeconds = getIntervalInSeconds(interval);
       const intervalAsMS = intervalAsSeconds * 1000;
-      const calculatedTimerange = createTimerange(
-        intervalAsMS,
-        criterion.aggType,
-        timeframe,
-        lastPeriodEnd
-      );
+      const calculatedTimerange = createTimerange(intervalAsMS, timeframe, lastPeriodEnd);
 
       const currentValues = await getData(
         esClient,
@@ -133,12 +93,6 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
         if (result.trigger || result.value === null) {
           evaluations[key] = {
             ...criterion,
-            metric:
-              criterion.aggType === 'count'
-                ? DOCUMENT_COUNT_I18N
-                : isCustom(criterion)
-                ? getMetric(criterion)
-                : criterion.metric,
             currentValue: result.value,
             timestamp: moment(calculatedTimerange.end).toISOString(),
             shouldFire: result.trigger,
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/format_alert_result.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/format_alert_result.ts
index 926096fd625850..c0220d89c9d983 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/format_alert_result.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/format_alert_result.ts
@@ -6,7 +6,17 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
 import { createFormatter } from '../../../../../common/custom_threshold_rule/formatters';
+import {
+  AVERAGE_I18N,
+  CARDINALITY_I18N,
+  CUSTOM_EQUATION_I18N,
+  DOCUMENT_COUNT_I18N,
+  MAX_I18N,
+  MIN_I18N,
+  SUM_I18N,
+} from '../translations';
 import { Evaluation } from './evaluate_rule';
 
 export type FormattedEvaluation = Omit<Evaluation, 'currentValue' | 'threshold'> & {
@@ -14,31 +24,45 @@ export type FormattedEvaluation = Omit<Evaluation, 'currentValue' | 'threshold'>
   threshold: string[];
 };
 
+export const getLabel = (criterion: Evaluation) => {
+  if (!criterion.label && criterion.metrics.length === 1) {
+    switch (criterion.metrics[0].aggType) {
+      case Aggregators.COUNT:
+        return DOCUMENT_COUNT_I18N;
+      case Aggregators.AVERAGE:
+        return AVERAGE_I18N(criterion.metrics[0].field!);
+      case Aggregators.MAX:
+        return MAX_I18N(criterion.metrics[0].field!);
+      case Aggregators.MIN:
+        return MIN_I18N(criterion.metrics[0].field!);
+      case Aggregators.CARDINALITY:
+        return CARDINALITY_I18N(criterion.metrics[0].field!);
+      case Aggregators.SUM:
+        return SUM_I18N(criterion.metrics[0].field!);
+    }
+  }
+  return criterion.label || CUSTOM_EQUATION_I18N;
+};
+
 export const formatAlertResult = (evaluationResult: Evaluation): FormattedEvaluation => {
-  const { metric, currentValue, threshold, comparator } = evaluationResult;
+  const { metrics, currentValue, threshold, comparator } = evaluationResult;
   const noDataValue = i18n.translate(
     'xpack.observability.customThreshold.rule.alerting.threshold.noDataFormattedValue',
     { defaultMessage: '[NO DATA]' }
   );
 
-  if (metric.endsWith('.pct')) {
-    const formatter = createFormatter('percent');
-    return {
-      ...evaluationResult,
-      currentValue:
-        currentValue !== null && currentValue !== undefined ? formatter(currentValue) : noDataValue,
-      threshold: Array.isArray(threshold)
-        ? threshold.map((v: number) => formatter(v))
-        : [formatter(threshold)],
-      comparator,
-    };
+  let formatter = createFormatter('highPrecision');
+  const label = getLabel(evaluationResult);
+
+  if (metrics.length === 1 && metrics[0].field && metrics[0].field.endsWith('.pct')) {
+    formatter = createFormatter('percent');
   }
 
-  const formatter = createFormatter('highPrecision');
   return {
     ...evaluationResult,
     currentValue:
       currentValue !== null && currentValue !== undefined ? formatter(currentValue) : noDataValue,
+    label: label || CUSTOM_EQUATION_I18N,
     threshold: Array.isArray(threshold)
       ? threshold.map((v: number) => formatter(v))
       : [formatter(threshold)],
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/get_data.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/get_data.ts
index 7d7a9e2997acc8..9658e0876ca1ea 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/get_data.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/get_data.ts
@@ -9,11 +9,7 @@ import { SearchResponse, AggregationsAggregate } from '@elastic/elasticsearch/li
 import { ElasticsearchClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
 import { EcsFieldsResponse } from '@kbn/rule-registry-plugin/common/search_strategy';
-import {
-  Aggregators,
-  Comparator,
-  MetricExpressionParams,
-} from '../../../../../common/custom_threshold_rule/types';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 
 import { UNGROUPED_FACTORY_KEY } from '../constants';
 import { CONTAINER_ID, AdditionalContext, doFieldsExist, KUBERNETES_POD_UID } from '../utils';
@@ -81,11 +77,6 @@ interface ResponseAggregations extends Partial<Aggs> {
   };
 }
 
-const getValue = (aggregatedValue: AggregatedValue, params: MetricExpressionParams) =>
-  [Aggregators.P95, Aggregators.P99].includes(params.aggType) && aggregatedValue.values != null
-    ? aggregatedValue.values[params.aggType === Aggregators.P95 ? '95.0' : '99.0']
-    : aggregatedValue.value;
-
 const NO_DATA_RESPONSE = {
   [UNGROUPED_FACTORY_KEY]: {
     value: null,
@@ -105,7 +96,7 @@ const createContainerList = (containerContext: ContainerContext) => {
 
 export const getData = async (
   esClient: ElasticsearchClient,
-  params: MetricExpressionParams,
+  params: CustomMetricExpressionParams,
   index: string,
   timeFieldName: string,
   groupBy: string | undefined | string[],
@@ -132,16 +123,10 @@ export const getData = async (
       const nextAfterKey = groupings.after_key;
       for (const bucket of groupings.buckets) {
         const key = Object.values(bucket.key).join(',');
-        const {
-          shouldTrigger,
-          missingGroup,
-          currentPeriod,
-          aggregatedValue: aggregatedValueForRate,
-          additionalContext,
-          containerContext,
-        } = bucket;
+        const { shouldTrigger, missingGroup, currentPeriod, additionalContext, containerContext } =
+          bucket;
 
-        const { aggregatedValue, doc_count: docCount } = currentPeriod.buckets.all;
+        const { aggregatedValue } = currentPeriod.buckets.all;
 
         const containerList = containerContext ? createContainerList(containerContext) : undefined;
 
@@ -156,14 +141,7 @@ export const getData = async (
             bucketKey: bucket.key,
           };
         } else {
-          const value =
-            params.aggType === Aggregators.COUNT
-              ? docCount
-              : params.aggType === Aggregators.RATE && aggregatedValueForRate != null
-              ? aggregatedValueForRate.value
-              : aggregatedValue != null
-              ? getValue(aggregatedValue, params)
-              : null;
+          const value = aggregatedValue ? aggregatedValue.value : null;
 
           previous[key] = {
             trigger: (shouldTrigger && shouldTrigger.value > 0) || false,
@@ -194,36 +172,10 @@ export const getData = async (
       return previous;
     }
     if (aggs.all?.buckets.all) {
-      const {
-        currentPeriod,
-        aggregatedValue: aggregatedValueForRate,
-        shouldTrigger,
-      } = aggs.all.buckets.all;
-
-      const { aggregatedValue, doc_count: docCount } = currentPeriod.buckets.all;
+      const { currentPeriod, shouldTrigger } = aggs.all.buckets.all;
 
-      const value =
-        params.aggType === Aggregators.COUNT
-          ? docCount
-          : params.aggType === Aggregators.RATE && aggregatedValueForRate != null
-          ? aggregatedValueForRate.value
-          : aggregatedValue != null
-          ? getValue(aggregatedValue, params)
-          : null;
-      // There is an edge case where there is no results and the shouldTrigger
-      // bucket scripts will be missing. This is only an issue for document count because
-      // the value will end up being ZERO, for other metrics it will be null. In this case
-      // we need to do the evaluation in Node.js
-      if (aggs.all && params.aggType === Aggregators.COUNT && value === 0) {
-        const trigger = comparatorMap[params.comparator](value, params.threshold);
-        return {
-          [UNGROUPED_FACTORY_KEY]: {
-            value,
-            trigger,
-            bucketKey: { groupBy0: UNGROUPED_FACTORY_KEY },
-          },
-        };
-      }
+      const { aggregatedValue } = currentPeriod.buckets.all;
+      const value = aggregatedValue ? aggregatedValue.value : null;
       return {
         [UNGROUPED_FACTORY_KEY]: {
           value,
@@ -268,15 +220,3 @@ export const getData = async (
   }
   return NO_DATA_RESPONSE;
 };
-
-const comparatorMap = {
-  [Comparator.BETWEEN]: (value: number, [a, b]: number[]) =>
-    value >= Math.min(a, b) && value <= Math.max(a, b),
-  // `threshold` is always an array of numbers in case the BETWEEN comparator is
-  // used; all other compartors will just destructure the first value in the array
-  [Comparator.GT]: (a: number, [b]: number[]) => a > b,
-  [Comparator.LT]: (a: number, [b]: number[]) => a < b,
-  [Comparator.OUTSIDE_RANGE]: (value: number, [a, b]: number[]) => value < a || value > b,
-  [Comparator.GT_OR_EQ]: (a: number, [b]: number[]) => a >= b,
-  [Comparator.LT_OR_EQ]: (a: number, [b]: number[]) => a <= b,
-};
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_expression_params.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_expression_params.ts
deleted file mode 100644
index 278f33dadafe9b..00000000000000
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_expression_params.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  CustomMetricExpressionParams,
-  MetricExpressionParams,
-  NonCountMetricExpressionParams,
-} from '../../../../../common/custom_threshold_rule/types';
-
-export const isNotCountOrCustom = (
-  metricExpressionParams: MetricExpressionParams
-): metricExpressionParams is NonCountMetricExpressionParams => {
-  const { aggType } = metricExpressionParams;
-  return aggType !== 'count' && aggType !== 'custom';
-};
-
-export const isCustom = (
-  metricExpressionParams: MetricExpressionParams
-): metricExpressionParams is CustomMetricExpressionParams => {
-  const { aggType } = metricExpressionParams;
-  return aggType === 'custom';
-};
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts
index cdfe0c66c0ab9c..53a89303fa1717 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts
@@ -5,18 +5,25 @@
  * 2.0.
  */
 
+import moment from 'moment';
+import { CUSTOM_AGGREGATOR } from '../../../../../common/custom_threshold_rule/constants';
 import {
   Comparator,
   Aggregators,
-  MetricExpressionParams,
+  CustomMetricExpressionParams,
 } from '../../../../../common/custom_threshold_rule/types';
-import moment from 'moment';
 import { getElasticsearchMetricQuery } from './metric_query';
 
 describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
-  const expressionParams: MetricExpressionParams = {
-    metric: 'system.is.a.good.puppy.dog',
-    aggType: Aggregators.AVERAGE,
+  const expressionParams: CustomMetricExpressionParams = {
+    metrics: [
+      {
+        name: 'A',
+        aggType: Aggregators.AVERAGE,
+        field: 'system.is.a.good.puppy.dog',
+      },
+    ],
+    aggType: CUSTOM_AGGREGATOR,
     timeUnit: 'm',
     timeSize: 1,
     threshold: [1],
@@ -47,8 +54,28 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
     });
 
     test('includes a metric field filter', () => {
-      expect(searchBody.query.bool.filter).toMatchObject(
-        expect.arrayContaining([{ exists: { field: 'system.is.a.good.puppy.dog' } }])
+      expect(searchBody.aggs.groupings.aggs.currentPeriod).toMatchObject(
+        expect.objectContaining({
+          aggs: {
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            aggregatedValue_A: {
+              avg: {
+                field: 'system.is.a.good.puppy.dog',
+              },
+            },
+            aggregatedValue: {
+              bucket_script: {
+                buckets_path: {
+                  A: 'aggregatedValue_A',
+                },
+                script: {
+                  source: 'params.A',
+                  lang: 'painless',
+                },
+              },
+            },
+          },
+        })
       );
     });
   });
@@ -79,7 +106,6 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       expect(searchBody.query.bool.filter).toMatchObject(
         expect.arrayContaining([
           { range: { mockedTimeFieldName: expect.any(Object) } },
-          { exists: { field: 'system.is.a.good.puppy.dog' } },
           {
             bool: {
               filter: [
@@ -108,6 +134,36 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
           },
         ])
       );
+      expect(searchBody.aggs.groupings.aggs).toMatchObject(
+        expect.objectContaining({
+          currentPeriod: {
+            filters: {
+              filters: {
+                all: { range: { mockedTimeFieldName: expect.any(Object) } },
+              },
+            },
+            aggs: {
+              // eslint-disable-next-line @typescript-eslint/naming-convention
+              aggregatedValue_A: {
+                avg: {
+                  field: 'system.is.a.good.puppy.dog',
+                },
+              },
+              aggregatedValue: {
+                bucket_script: {
+                  buckets_path: {
+                    A: 'aggregatedValue_A',
+                  },
+                  script: {
+                    source: 'params.A',
+                    lang: 'painless',
+                  },
+                },
+              },
+            },
+          },
+        })
+      );
     });
   });
 });
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.ts
index 66868ad97dfc90..6471926522929c 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metric_query.ts
@@ -6,11 +6,7 @@
  */
 
 import moment from 'moment';
-import {
-  Aggregators,
-  MetricExpressionParams,
-} from '../../../../../common/custom_threshold_rule/types';
-import { isCustom, isNotCountOrCustom } from './metric_expression_params';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 import { createCustomMetricsAggregations } from './create_custom_metrics_aggregations';
 import {
   CONTAINER_ID,
@@ -20,26 +16,19 @@ import {
   validGroupByForContext,
 } from '../utils';
 import { createBucketSelector } from './create_bucket_selector';
-import { createPercentileAggregation } from './create_percentile_aggregation';
-import { createRateAggsBuckets, createRateAggsBucketScript } from './create_rate_aggregation';
 import { wrapInCurrentPeriod } from './wrap_in_period';
 import { getParsedFilterQuery } from '../../../../utils/get_parsed_filtered_query';
 
 export const calculateCurrentTimeframe = (
-  metricParams: MetricExpressionParams,
+  metricParams: CustomMetricExpressionParams,
   timeframe: { start: number; end: number }
 ) => ({
   ...timeframe,
-  start: moment(timeframe.end)
-    .subtract(
-      metricParams.aggType === Aggregators.RATE ? metricParams.timeSize * 2 : metricParams.timeSize,
-      metricParams.timeUnit
-    )
-    .valueOf(),
+  start: moment(timeframe.end).subtract(metricParams.timeSize, metricParams.timeUnit).valueOf(),
 });
 
 export const createBaseFilters = (
-  metricParams: MetricExpressionParams,
+  metricParams: CustomMetricExpressionParams,
   timeframe: { start: number; end: number },
   timeFieldName: string,
   filterQuery?: string
@@ -55,24 +44,13 @@ export const createBaseFilters = (
     },
   ];
 
-  const metricFieldFilters =
-    isNotCountOrCustom(metricParams) && metricParams.metric
-      ? [
-          {
-            exists: {
-              field: metricParams.metric,
-            },
-          },
-        ]
-      : [];
-
   const parsedFilterQuery = getParsedFilterQuery(filterQuery);
 
-  return [...rangeFilters, ...metricFieldFilters, ...parsedFilterQuery];
+  return [...rangeFilters, ...parsedFilterQuery];
 };
 
 export const getElasticsearchMetricQuery = (
-  metricParams: MetricExpressionParams,
+  metricParams: CustomMetricExpressionParams,
   timeframe: { start: number; end: number },
   timeFieldName: string,
   compositeSize: number,
@@ -83,13 +61,6 @@ export const getElasticsearchMetricQuery = (
   afterKey?: Record<string, string>,
   fieldsExisted?: Record<string, boolean> | null
 ) => {
-  const { aggType } = metricParams;
-  if (isNotCountOrCustom(metricParams) && !metricParams.metric) {
-    throw new Error(
-      'Can only aggregate without a metric if using the document count or custom aggregator'
-    );
-  }
-
   // We need to make a timeframe that represents the current timeframe as opposed
   // to the total timeframe (which includes the last period).
   const currentTimeframe = {
@@ -97,26 +68,11 @@ export const getElasticsearchMetricQuery = (
     timeFieldName,
   };
 
-  const metricAggregations =
-    aggType === Aggregators.COUNT
-      ? {}
-      : aggType === Aggregators.RATE
-      ? createRateAggsBuckets(currentTimeframe, 'aggregatedValue', metricParams.metric)
-      : aggType === Aggregators.P95 || aggType === Aggregators.P99
-      ? createPercentileAggregation(aggType, metricParams.metric)
-      : isCustom(metricParams)
-      ? createCustomMetricsAggregations(
-          'aggregatedValue',
-          metricParams.metrics,
-          metricParams.equation
-        )
-      : {
-          aggregatedValue: {
-            [aggType]: {
-              field: metricParams.metric,
-            },
-          },
-        };
+  const metricAggregations = createCustomMetricsAggregations(
+    'aggregatedValue',
+    metricParams.metrics,
+    metricParams.equation
+  );
 
   const bucketSelectorAggregations = createBucketSelector(
     metricParams,
@@ -126,11 +82,6 @@ export const getElasticsearchMetricQuery = (
     lastPeriodEnd
   );
 
-  const rateAggBucketScript =
-    metricParams.aggType === Aggregators.RATE
-      ? createRateAggsBucketScript(currentTimeframe, 'aggregatedValue')
-      : {};
-
   const currentPeriod = wrapInCurrentPeriod(currentTimeframe, metricAggregations);
 
   const containerIncludesList = ['container.*'];
@@ -207,7 +158,6 @@ export const getElasticsearchMetricQuery = (
           },
           aggs: {
             ...currentPeriod,
-            ...rateAggBucketScript,
             ...bucketSelectorAggregations,
             ...additionalContextAgg,
             ...containerContextAgg,
@@ -225,7 +175,6 @@ export const getElasticsearchMetricQuery = (
           },
           aggs: {
             ...currentPeriod,
-            ...rateAggBucketScript,
             ...bucketSelectorAggregations,
           },
         },
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metrics_explorer.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metrics_explorer.ts
deleted file mode 100644
index e72974828b0276..00000000000000
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/metrics_explorer.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as rt from 'io-ts';
-import { METRIC_EXPLORER_AGGREGATIONS } from '../../../../../common/custom_threshold_rule/constants';
-import { metricsExplorerCustomMetricAggregationRT } from '../../../../../common/custom_threshold_rule/metrics_explorer';
-
-type MetricExplorerAggregations = typeof METRIC_EXPLORER_AGGREGATIONS[number];
-
-const metricsExplorerAggregationKeys = METRIC_EXPLORER_AGGREGATIONS.reduce<
-  Record<MetricExplorerAggregations, null>
->((acc, agg) => ({ ...acc, [agg]: null }), {} as Record<MetricExplorerAggregations, null>);
-
-export const metricsExplorerAggregationRT = rt.keyof(metricsExplorerAggregationKeys);
-
-export const metricsExplorerMetricRequiredFieldsRT = rt.type({
-  aggregation: metricsExplorerAggregationRT,
-});
-
-export const metricsExplorerCustomMetricRT = rt.intersection([
-  rt.type({
-    name: rt.string,
-    aggregation: metricsExplorerCustomMetricAggregationRT,
-  }),
-  rt.partial({
-    field: rt.string,
-    filter: rt.string,
-  }),
-]);
-
-export type MetricsExplorerCustomMetric = rt.TypeOf<typeof metricsExplorerCustomMetricRT>;
-
-export const metricsExplorerMetricOptionalFieldsRT = rt.partial({
-  field: rt.union([rt.string, rt.undefined]),
-  custom_metrics: rt.array(metricsExplorerCustomMetricRT),
-  equation: rt.string,
-});
-
-export const metricsExplorerMetricRT = rt.intersection([
-  metricsExplorerMetricRequiredFieldsRT,
-  metricsExplorerMetricOptionalFieldsRT,
-]);
-
-export const timeRangeRT = rt.type({
-  from: rt.number,
-  to: rt.number,
-  interval: rt.string,
-});
-
-export const metricsExplorerRequestBodyRequiredFieldsRT = rt.type({
-  timerange: timeRangeRT,
-  indexPattern: rt.string,
-  metrics: rt.array(metricsExplorerMetricRT),
-});
-
-const groupByRT = rt.union([rt.string, rt.null, rt.undefined]);
-export const afterKeyObjectRT = rt.record(rt.string, rt.union([rt.string, rt.null]));
-
-export const metricsExplorerRequestBodyOptionalFieldsRT = rt.partial({
-  groupBy: rt.union([groupByRT, rt.array(groupByRT)]),
-  afterKey: rt.union([rt.string, rt.null, rt.undefined, afterKeyObjectRT]),
-  limit: rt.union([rt.number, rt.null, rt.undefined]),
-  filterQuery: rt.union([rt.string, rt.null, rt.undefined]),
-  forceInterval: rt.boolean,
-  dropLastBucket: rt.boolean,
-});
-
-export const metricsExplorerRequestBodyRT = rt.intersection([
-  metricsExplorerRequestBodyRequiredFieldsRT,
-  metricsExplorerRequestBodyOptionalFieldsRT,
-]);
-
-export const metricsExplorerPageInfoRT = rt.type({
-  total: rt.number,
-  afterKey: rt.union([rt.string, rt.null, afterKeyObjectRT]),
-});
-
-export const metricsExplorerColumnTypeRT = rt.keyof({
-  date: null,
-  number: null,
-  string: null,
-});
-
-export const metricsExplorerColumnRT = rt.type({
-  name: rt.string,
-  type: metricsExplorerColumnTypeRT,
-});
-
-export const metricsExplorerRowRT = rt.intersection([
-  rt.type({
-    timestamp: rt.number,
-  }),
-  rt.record(
-    rt.string,
-    rt.union([rt.string, rt.number, rt.null, rt.undefined, rt.array(rt.object)])
-  ),
-]);
-
-export const metricsExplorerSeriesRT = rt.intersection([
-  rt.type({
-    id: rt.string,
-    columns: rt.array(metricsExplorerColumnRT),
-    rows: rt.array(metricsExplorerRowRT),
-  }),
-  rt.partial({
-    keys: rt.array(rt.string),
-  }),
-]);
-
-export const metricsExplorerResponseRT = rt.type({
-  series: rt.array(metricsExplorerSeriesRT),
-  pageInfo: metricsExplorerPageInfoRT,
-});
-
-export type AfterKey = rt.TypeOf<typeof afterKeyObjectRT>;
-
-export type MetricsExplorerColumnType = rt.TypeOf<typeof metricsExplorerColumnTypeRT>;
-
-export type MetricsExplorerPageInfo = rt.TypeOf<typeof metricsExplorerPageInfoRT>;
-
-export type MetricsExplorerColumn = rt.TypeOf<typeof metricsExplorerColumnRT>;
-
-export type MetricsExplorerRow = rt.TypeOf<typeof metricsExplorerRowRT>;
-
-export type MetricsExplorerRequestBody = rt.TypeOf<typeof metricsExplorerRequestBodyRT>;
-
-export type MetricsExplorerResponse = rt.TypeOf<typeof metricsExplorerResponseRT>;
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/wrap_in_period.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/wrap_in_period.ts
index a76c45e4e45832..2e23ba5ae45dd3 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/wrap_in_period.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/wrap_in_period.ts
@@ -6,11 +6,11 @@
  */
 
 import moment from 'moment';
-import { MetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
+import { CustomMetricExpressionParams } from '../../../../../common/custom_threshold_rule/types';
 
 export const createLastPeriod = (
   lastPeriodEnd: number,
-  { timeUnit, timeSize }: MetricExpressionParams,
+  { timeUnit, timeSize }: CustomMetricExpressionParams,
   timeFieldName: string
 ) => {
   const start = moment(lastPeriodEnd).subtract(timeSize, timeUnit).toISOString();
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/messages.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/messages.ts
index 4a8d7a2c2dc8a2..973ce8f57093ab 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/messages.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/messages.ts
@@ -10,7 +10,13 @@ import { Comparator } from '../../../../common/custom_threshold_rule/types';
 import { formatDurationFromTimeUnitChar } from '../../../../common';
 import { Evaluation } from './lib/evaluate_rule';
 import { formatAlertResult, FormattedEvaluation } from './lib/format_alert_result';
-import { BELOW_TEXT, ABOVE_TEXT, BETWEEN_TEXT, NOT_BETWEEN_TEXT } from './translations';
+import {
+  BELOW_TEXT,
+  ABOVE_TEXT,
+  BETWEEN_TEXT,
+  NOT_BETWEEN_TEXT,
+  CUSTOM_EQUATION_I18N,
+} from './translations';
 import { UNGROUPED_FACTORY_KEY } from './constants';
 
 const toNumber = (value: number | string) =>
@@ -103,17 +109,15 @@ export const buildFiredAlertReason: (
 };
 
 const buildAggregationReason: (evaluation: FormattedEvaluation) => string = ({
-  metric,
+  label,
   comparator,
   threshold,
   currentValue,
-  timeSize,
-  timeUnit,
 }) =>
   i18n.translate('xpack.observability.customThreshold.rule.threshold.firedAlertReason', {
-    defaultMessage: '{metric} is {currentValue}, {comparator} the threshold of {threshold}',
+    defaultMessage: '{label} is {currentValue}, {comparator} the threshold of {threshold}',
     values: {
-      metric,
+      label,
       comparator: alertComparatorToI18n(comparator),
       threshold: thresholdToI18n(threshold),
       currentValue,
@@ -123,16 +127,16 @@ const buildAggregationReason: (evaluation: FormattedEvaluation) => string = ({
 // Once recovered reason messages are re-enabled, checkout this issue https://github.com/elastic/kibana/issues/121272 regarding latest reason format
 export const buildRecoveredAlertReason: (alertResult: {
   group: string;
-  metric: string;
+  label?: string;
   comparator: Comparator;
   threshold: Array<number | string>;
   currentValue: number | string;
-}) => string = ({ group, metric, comparator, threshold, currentValue }) =>
+}) => string = ({ group, label = CUSTOM_EQUATION_I18N, comparator, threshold, currentValue }) =>
   i18n.translate('xpack.observability.customThreshold.rule.threshold.recoveredAlertReason', {
     defaultMessage:
-      '{metric} is now {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
+      '{label} is now {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
     values: {
-      metric,
+      label,
       comparator: recoveredComparatorToI18n(
         comparator,
         threshold.map(toNumber),
@@ -144,16 +148,16 @@ export const buildRecoveredAlertReason: (alertResult: {
     },
   });
 
-export const buildNoDataAlertReason: (alertResult: {
-  group: string;
-  metric: string;
-  timeSize: number;
-  timeUnit: string;
-}) => string = ({ group, metric, timeSize, timeUnit }) =>
+export const buildNoDataAlertReason: (alertResult: Evaluation & { group: string }) => string = ({
+  group,
+  label = CUSTOM_EQUATION_I18N,
+  timeSize,
+  timeUnit,
+}) =>
   i18n.translate('xpack.observability.customThreshold.rule.threshold.noDataAlertReason', {
-    defaultMessage: '{metric} reported no data in the last {interval}{group}',
+    defaultMessage: '{label} reported no data in the last {interval}{group}',
     values: {
-      metric,
+      label,
       interval: `${timeSize}${timeUnit}`,
       group: formatGroup(group),
     },
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts
index f3d2b1f6c9c944..2166c21db86093 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts
@@ -8,6 +8,7 @@
 import { DEFAULT_APP_CATEGORIES } from '@kbn/core/server';
 import { schema } from '@kbn/config-schema';
 import { extractReferences, injectReferences } from '@kbn/data-plugin/common';
+import { dataViewSpecSchema } from '@kbn/data-views-plugin/server/rest_api_routes/schema';
 import { i18n } from '@kbn/i18n';
 import { IRuleTypeAlerts, GetViewInAppRelativeUrlFnOpts } from '@kbn/alerting-plugin/server';
 import { IBasePath, Logger } from '@kbn/core/server';
@@ -52,7 +53,7 @@ export const MetricsRulesTypeAlertDefinition: IRuleTypeAlerts = {
 };
 
 export const searchConfigurationSchema = schema.object({
-  index: schema.string(),
+  index: schema.oneOf([schema.string(), dataViewSpecSchema]),
   query: schema.object({
     language: schema.string({
       validate: validateKQLStringFilter,
diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/types.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/types.ts
index 693277bd3af2af..97881f55d8d32a 100644
--- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/types.ts
+++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/types.ts
@@ -18,8 +18,6 @@ import { FIRED_ACTIONS_ID, NO_DATA_ACTIONS_ID, FIRED_ACTION, NO_DATA_ACTION } fr
 import { MissingGroupsRecord } from './lib/check_missing_group';
 import { AdditionalContext } from './utils';
 import { searchConfigurationSchema } from './register_custom_threshold_rule_type';
-import { Aggregators, Comparator } from '../../../../common/custom_threshold_rule/types';
-import { TimeUnitChar } from '../../../../common';
 
 export enum AlertStates {
   OK,
@@ -75,27 +73,6 @@ type CustomThresholdAlert = Alert<
   CustomThresholdSpecificActionGroups
 >;
 
-interface BaseMetricExpressionParams {
-  timeSize: number;
-  timeUnit: TimeUnitChar;
-  threshold: number[];
-  comparator: Comparator;
-}
-
-export interface NonCountMetricExpressionParams extends BaseMetricExpressionParams {
-  aggType: Exclude<Aggregators, [Aggregators.COUNT, Aggregators.CUSTOM]>;
-  metric: string;
-}
-
-export interface CountMetricExpressionParams extends BaseMetricExpressionParams {
-  aggType: Aggregators.COUNT;
-}
-
-export type CustomMetricAggTypes = Exclude<
-  Aggregators,
-  Aggregators.CUSTOM | Aggregators.RATE | Aggregators.P95 | Aggregators.P99
->;
-
 export interface AlertExecutionDetails {
   alertId: string;
   executionId: string;
diff --git a/x-pack/plugins/observability/server/routes/slo/route.ts b/x-pack/plugins/observability/server/routes/slo/route.ts
index ade3f1714ddfba..d3bab20c436c3f 100644
--- a/x-pack/plugins/observability/server/routes/slo/route.ts
+++ b/x-pack/plugins/observability/server/routes/slo/route.ts
@@ -19,6 +19,7 @@ import {
   getSLOInstancesParamsSchema,
   getSLOParamsSchema,
   manageSLOParamsSchema,
+  resetSLOParamsSchema,
   updateSLOParamsSchema,
 } from '@kbn/slo-schema';
 import type { IndicatorTypes } from '../../domain/models';
@@ -41,6 +42,7 @@ import { GetPreviewData } from '../../services/slo/get_preview_data';
 import { GetSLOInstances } from '../../services/slo/get_slo_instances';
 import { DefaultHistoricalSummaryClient } from '../../services/slo/historical_summary_client';
 import { ManageSLO } from '../../services/slo/manage_slo';
+import { ResetSLO } from '../../services/slo/reset_slo';
 import { DefaultSummarySearchClient } from '../../services/slo/summary_search_client';
 import {
   ApmTransactionDurationTransformGenerator,
@@ -48,8 +50,8 @@ import {
   HistogramTransformGenerator,
   KQLCustomTransformGenerator,
   MetricCustomTransformGenerator,
-  TransformGenerator,
   TimesliceMetricTransformGenerator,
+  TransformGenerator,
 } from '../../services/slo/transform_generators';
 import type { ObservabilityRequestHandlerContext } from '../../types';
 import { createObservabilityServerRoute } from '../create_observability_server_route';
@@ -83,10 +85,11 @@ const createSLORoute = createObservabilityServerRoute({
     await assertPlatinumLicense(context);
 
     const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+    const systemEsClient = (await context.core).elasticsearch.client.asInternalUser;
     const soClient = (await context.core).savedObjects.client;
     const repository = new KibanaSavedObjectsSLORepository(soClient);
     const transformManager = new DefaultTransformManager(transformGenerators, esClient, logger);
-    const createSLO = new CreateSLO(esClient, repository, transformManager);
+    const createSLO = new CreateSLO(esClient, systemEsClient, repository, transformManager);
 
     const response = await createSLO.execute(params.body);
 
@@ -105,11 +108,12 @@ const updateSLORoute = createObservabilityServerRoute({
     await assertPlatinumLicense(context);
 
     const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+    const systemEsClient = (await context.core).elasticsearch.client.asInternalUser;
     const soClient = (await context.core).savedObjects.client;
 
     const repository = new KibanaSavedObjectsSLORepository(soClient);
     const transformManager = new DefaultTransformManager(transformGenerators, esClient, logger);
-    const updateSLO = new UpdateSLO(repository, transformManager, esClient);
+    const updateSLO = new UpdateSLO(repository, transformManager, esClient, systemEsClient);
 
     const response = await updateSLO.execute(params.path.id, params.body);
 
@@ -134,13 +138,20 @@ const deleteSLORoute = createObservabilityServerRoute({
     await assertPlatinumLicense(context);
 
     const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+    const systemEsClient = (await context.core).elasticsearch.client.asInternalUser;
     const soClient = (await context.core).savedObjects.client;
     const rulesClient = getRulesClientWithRequest(request);
 
     const repository = new KibanaSavedObjectsSLORepository(soClient);
     const transformManager = new DefaultTransformManager(transformGenerators, esClient, logger);
 
-    const deleteSLO = new DeleteSLO(repository, transformManager, esClient, rulesClient);
+    const deleteSLO = new DeleteSLO(
+      repository,
+      transformManager,
+      esClient,
+      rulesClient,
+      systemEsClient
+    );
 
     await deleteSLO.execute(params.path.id);
   },
@@ -214,6 +225,29 @@ const disableSLORoute = createObservabilityServerRoute({
   },
 });
 
+const resetSLORoute = createObservabilityServerRoute({
+  endpoint: 'POST /api/observability/slos/{id}/_reset 2023-10-31',
+  options: {
+    tags: ['access:slo_write'],
+    access: 'public',
+  },
+  params: resetSLOParamsSchema,
+  handler: async ({ context, params, logger }) => {
+    await assertPlatinumLicense(context);
+
+    const soClient = (await context.core).savedObjects.client;
+    const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+
+    const repository = new KibanaSavedObjectsSLORepository(soClient);
+    const transformManager = new DefaultTransformManager(transformGenerators, esClient, logger);
+    const resetSLO = new ResetSLO(esClient, repository, transformManager);
+
+    const response = await resetSLO.execute(params.path.id);
+
+    return response;
+  },
+});
+
 const findSLORoute = createObservabilityServerRoute({
   endpoint: 'GET /api/observability/slos 2023-10-31',
   options: {
@@ -253,10 +287,9 @@ const deleteSloInstancesRoute = createObservabilityServerRoute({
 });
 
 const findSloDefinitionsRoute = createObservabilityServerRoute({
-  endpoint: 'GET /internal/observability/slos/_definitions',
+  endpoint: 'GET /api/observability/slos/_definitions 2023-10-31',
   options: {
     tags: ['access:slo_read'],
-    access: 'internal',
   },
   params: findSloDefinitionsParamsSchema,
   handler: async ({ context, params }) => {
@@ -266,7 +299,7 @@ const findSloDefinitionsRoute = createObservabilityServerRoute({
     const repository = new KibanaSavedObjectsSLORepository(soClient);
     const findSloDefinitions = new FindSLODefinitions(repository);
 
-    const response = await findSloDefinitions.execute(params.query.search);
+    const response = await findSloDefinitions.execute(params?.query ?? {});
 
     return response;
   },
@@ -395,4 +428,5 @@ export const sloRouteRepository = {
   ...getSloBurnRates,
   ...getPreviewData,
   ...getSLOInstancesRoute,
+  ...resetSLORoute,
 };
diff --git a/x-pack/plugins/observability/server/saved_objects/slo.ts b/x-pack/plugins/observability/server/saved_objects/slo.ts
index 41cb509d837556..058596e160fd71 100644
--- a/x-pack/plugins/observability/server/saved_objects/slo.ts
+++ b/x-pack/plugins/observability/server/saved_objects/slo.ts
@@ -17,7 +17,6 @@ type StoredSLOBefore890 = StoredSLO & {
     isCalendar?: boolean;
   };
 };
-
 const migrateSlo890: SavedObjectMigrationFn<StoredSLOBefore890, StoredSLO> = (doc) => {
   const { timeWindow, ...other } = doc.attributes;
   return {
@@ -38,6 +37,21 @@ export const slo: SavedObjectsType = {
   name: SO_SLO_TYPE,
   hidden: false,
   namespaceType: 'multiple-isolated',
+  switchToModelVersionAt: '8.10.0',
+  modelVersions: {
+    1: {
+      changes: [
+        { type: 'mappings_addition', addedMappings: { version: { type: 'long' } } },
+        {
+          type: 'data_backfill',
+          backfillFn: (doc) => {
+            // we explicitely set the version to 1, so we know which SLOs requires a migration to the following version.
+            return { attributes: { version: doc.attributes.version ?? 1 } };
+          },
+        },
+      ],
+    },
+  },
   mappings: {
     dynamic: false,
     properties: {
@@ -53,6 +67,7 @@ export const slo: SavedObjectsType = {
       budgetingMethod: { type: 'keyword' },
       enabled: { type: 'boolean' },
       tags: { type: 'keyword' },
+      version: { type: 'long' },
     },
   },
   management: {
diff --git a/x-pack/plugins/observability/server/services/slo/__snapshots__/create_slo.test.ts.snap b/x-pack/plugins/observability/server/services/slo/__snapshots__/create_slo.test.ts.snap
index e66f1f8124a11f..c9e32e24f698c9 100644
--- a/x-pack/plugins/observability/server/services/slo/__snapshots__/create_slo.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/__snapshots__/create_slo.test.ts.snap
@@ -41,8 +41,16 @@ Array [
       },
     },
     "id": "slo-unique-id",
-    "index": ".slo-observability.summary-v2.temp",
+    "index": ".slo-observability.summary-v3.temp",
     "refresh": true,
   },
 ]
 `;
+
+exports[`CreateSLO happy path calls the expected services 2`] = `
+Array [
+  Object {
+    "name": "slo-observability.summary.enrich_policy",
+  },
+]
+`;
diff --git a/x-pack/plugins/observability/server/services/slo/__snapshots__/get_slo_instances.test.ts.snap b/x-pack/plugins/observability/server/services/slo/__snapshots__/get_slo_instances.test.ts.snap
index be3b681db0af8f..8ad9792a22b243 100644
--- a/x-pack/plugins/observability/server/services/slo/__snapshots__/get_slo_instances.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/__snapshots__/get_slo_instances.test.ts.snap
@@ -11,7 +11,7 @@ Array [
         },
       },
     },
-    "index": ".slo-observability.sli-v2*",
+    "index": ".slo-observability.sli-v3*",
     "query": Object {
       "bool": Object {
         "filter": Array [
diff --git a/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_search_client.test.ts.snap b/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_search_client.test.ts.snap
index ea94e840aac0e0..daf5e47a0a66cb 100644
--- a/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_search_client.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_search_client.test.ts.snap
@@ -3,7 +3,7 @@
 exports[`Summary Search Client returns the summary documents without duplicate temporary summary documents 1`] = `
 Array [
   Object {
-    "index": ".slo-observability.summary-v2*",
+    "index": ".slo-observability.summary-v3*",
     "query": Object {
       "bool": Object {
         "filter": Array [
diff --git a/x-pack/plugins/observability/server/services/slo/__snapshots__/update_slo.test.ts.snap b/x-pack/plugins/observability/server/services/slo/__snapshots__/update_slo.test.ts.snap
index ae7a966951f7c3..79e676bc13f519 100644
--- a/x-pack/plugins/observability/server/services/slo/__snapshots__/update_slo.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/__snapshots__/update_slo.test.ts.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`UpdateSLO index a temporary summary document 1`] = `
+exports[`UpdateSLO when the revision bumps indexes a temporary summary document 1`] = `
 Array [
   Object {
     "document": Object {
@@ -44,7 +44,7 @@ Array [
       },
     },
     "id": "slo-unique-id",
-    "index": ".slo-observability.summary-v2.temp",
+    "index": ".slo-observability.summary-v3.temp",
     "refresh": true,
   },
 ]
diff --git a/x-pack/plugins/observability/server/services/slo/create_slo.test.ts b/x-pack/plugins/observability/server/services/slo/create_slo.test.ts
index bd34d652e5fa4b..504fa85b82aa1c 100644
--- a/x-pack/plugins/observability/server/services/slo/create_slo.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/create_slo.test.ts
@@ -15,15 +15,22 @@ import { TransformManager } from './transform_manager';
 
 describe('CreateSLO', () => {
   let esClientMock: ElasticsearchClientMock;
+  let esSystemClientMock: ElasticsearchClientMock;
   let mockRepository: jest.Mocked<SLORepository>;
   let mockTransformManager: jest.Mocked<TransformManager>;
   let createSLO: CreateSLO;
 
   beforeEach(() => {
     esClientMock = elasticsearchServiceMock.createElasticsearchClient();
+    esSystemClientMock = elasticsearchServiceMock.createElasticsearchClient();
     mockRepository = createSLORepositoryMock();
     mockTransformManager = createTransformManagerMock();
-    createSLO = new CreateSLO(esClientMock, mockRepository, mockTransformManager);
+    createSLO = new CreateSLO(
+      esClientMock,
+      esSystemClientMock,
+      mockRepository,
+      mockTransformManager
+    );
   });
 
   describe('happy path', () => {
@@ -59,6 +66,7 @@ describe('CreateSLO', () => {
       expect(mockTransformManager.start).toHaveBeenCalledWith('slo-transform-id');
       expect(response).toEqual(expect.objectContaining({ id: 'unique-id' }));
       expect(esClientMock.index.mock.calls[0]).toMatchSnapshot();
+      expect(esSystemClientMock.enrich.executePolicy.mock.calls[0]).toMatchSnapshot();
     });
 
     it('overrides the default values when provided', async () => {
diff --git a/x-pack/plugins/observability/server/services/slo/create_slo.ts b/x-pack/plugins/observability/server/services/slo/create_slo.ts
index 51c3fbec71dc8e..659b04adb5629c 100644
--- a/x-pack/plugins/observability/server/services/slo/create_slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/create_slo.ts
@@ -8,7 +8,11 @@
 import { ElasticsearchClient } from '@kbn/core/server';
 import { ALL_VALUE, CreateSLOParams, CreateSLOResponse } from '@kbn/slo-schema';
 import { v4 as uuidv4 } from 'uuid';
-import { SLO_SUMMARY_TEMP_INDEX_NAME } from '../../assets/constants';
+import {
+  SLO_MODEL_VERSION,
+  SLO_SUMMARY_ENRICH_POLICY_NAME,
+  SLO_SUMMARY_TEMP_INDEX_NAME,
+} from '../../assets/constants';
 import { Duration, DurationUnit, SLO } from '../../domain/models';
 import { validateSLO } from '../../domain/services';
 import { SLORepository } from './slo_repository';
@@ -18,6 +22,7 @@ import { TransformManager } from './transform_manager';
 export class CreateSLO {
   constructor(
     private esClient: ElasticsearchClient,
+    private systemClient: ElasticsearchClient,
     private repository: SLORepository,
     private transformManager: TransformManager
   ) {}
@@ -54,6 +59,8 @@ export class CreateSLO {
       refresh: true,
     });
 
+    await this.systemClient.enrich.executePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME });
+
     return this.toResponse(slo);
   }
 
@@ -72,6 +79,7 @@ export class CreateSLO {
       createdAt: now,
       updatedAt: now,
       groupBy: !!params.groupBy ? params.groupBy : ALL_VALUE,
+      version: SLO_MODEL_VERSION,
     };
   }
 
diff --git a/x-pack/plugins/observability/server/services/slo/delete_slo.test.ts b/x-pack/plugins/observability/server/services/slo/delete_slo.test.ts
index a136945edcd2c9..d1f9342c32ba6e 100644
--- a/x-pack/plugins/observability/server/services/slo/delete_slo.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/delete_slo.test.ts
@@ -24,6 +24,7 @@ describe('DeleteSLO', () => {
   let mockRepository: jest.Mocked<SLORepository>;
   let mockTransformManager: jest.Mocked<TransformManager>;
   let mockEsClient: jest.Mocked<ElasticsearchClient>;
+  let mockSystemEsClient: jest.Mocked<ElasticsearchClient>;
   let mockRulesClient: jest.Mocked<RulesClientApi>;
   let deleteSLO: DeleteSLO;
 
@@ -31,8 +32,15 @@ describe('DeleteSLO', () => {
     mockRepository = createSLORepositoryMock();
     mockTransformManager = createTransformManagerMock();
     mockEsClient = elasticsearchServiceMock.createElasticsearchClient();
+    mockSystemEsClient = elasticsearchServiceMock.createElasticsearchClient();
     mockRulesClient = rulesClientMock.create();
-    deleteSLO = new DeleteSLO(mockRepository, mockTransformManager, mockEsClient, mockRulesClient);
+    deleteSLO = new DeleteSLO(
+      mockRepository,
+      mockTransformManager,
+      mockEsClient,
+      mockRulesClient,
+      mockSystemEsClient
+    );
   });
 
   describe('happy path', () => {
@@ -72,6 +80,7 @@ describe('DeleteSLO', () => {
           },
         })
       );
+      expect(mockSystemEsClient.enrich.executePolicy).toHaveBeenCalled();
       expect(mockRulesClient.bulkDeleteRules).toHaveBeenCalledWith({
         filter: `alert.attributes.params.sloId:${slo.id}`,
       });
diff --git a/x-pack/plugins/observability/server/services/slo/delete_slo.ts b/x-pack/plugins/observability/server/services/slo/delete_slo.ts
index de908ceac7842d..6df784cd19f4c6 100644
--- a/x-pack/plugins/observability/server/services/slo/delete_slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/delete_slo.ts
@@ -11,6 +11,7 @@ import {
   getSLOTransformId,
   SLO_DESTINATION_INDEX_PATTERN,
   SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+  SLO_SUMMARY_ENRICH_POLICY_NAME,
 } from '../../assets/constants';
 import { SLORepository } from './slo_repository';
 import { TransformManager } from './transform_manager';
@@ -20,7 +21,8 @@ export class DeleteSLO {
     private repository: SLORepository,
     private transformManager: TransformManager,
     private esClient: ElasticsearchClient,
-    private rulesClient: RulesClientApi
+    private rulesClient: RulesClientApi,
+    private systemClient: ElasticsearchClient
   ) {}
 
   public async execute(sloId: string): Promise<void> {
@@ -34,6 +36,7 @@ export class DeleteSLO {
     await this.deleteSummaryData(slo.id);
     await this.deleteAssociatedRules(slo.id);
     await this.repository.deleteById(slo.id);
+    await this.systemClient.enrich.executePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME });
   }
 
   private async deleteRollupData(sloId: string): Promise<void> {
diff --git a/x-pack/plugins/observability/server/services/slo/delete_slo_instances.test.ts b/x-pack/plugins/observability/server/services/slo/delete_slo_instances.test.ts
index 8a9c64a6b441cf..ca4eac790bd04f 100644
--- a/x-pack/plugins/observability/server/services/slo/delete_slo_instances.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/delete_slo_instances.test.ts
@@ -43,7 +43,7 @@ describe('DeleteSLOInstances', () => {
     expect(mockEsClient.deleteByQuery).toHaveBeenCalledTimes(2);
     expect(mockEsClient.deleteByQuery.mock.calls[0][0]).toMatchInlineSnapshot(`
       Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "should": Array [
@@ -103,7 +103,7 @@ describe('DeleteSLOInstances', () => {
     `);
     expect(mockEsClient.deleteByQuery.mock.calls[1][0]).toMatchInlineSnapshot(`
       Object {
-        "index": ".slo-observability.summary-v2*",
+        "index": ".slo-observability.summary-v3*",
         "query": Object {
           "bool": Object {
             "should": Array [
diff --git a/x-pack/plugins/observability/server/services/slo/find_slo.test.ts b/x-pack/plugins/observability/server/services/slo/find_slo.test.ts
index 10436bc0fad541..93319e4e53fd11 100644
--- a/x-pack/plugins/observability/server/services/slo/find_slo.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/find_slo.test.ts
@@ -5,13 +5,14 @@
  * 2.0.
  */
 
-import { ALL_VALUE } from '@kbn/slo-schema';
+import { ALL_VALUE, Paginated } from '@kbn/slo-schema';
+import { SLO_MODEL_VERSION } from '../../assets/constants';
 import { SLO } from '../../domain/models';
 import { FindSLO } from './find_slo';
 import { createSLO } from './fixtures/slo';
 import { createSLORepositoryMock, createSummarySearchClientMock } from './mocks';
 import { SLORepository } from './slo_repository';
-import { Paginated, SLOSummary, SummarySearchClient } from './summary_search_client';
+import { SLOSummary, SummarySearchClient } from './summary_search_client';
 
 describe('FindSLO', () => {
   let mockRepository: jest.Mocked<SLORepository>;
@@ -95,6 +96,7 @@ describe('FindSLO', () => {
             revision: slo.revision,
             groupBy: slo.groupBy,
             instanceId: ALL_VALUE,
+            version: SLO_MODEL_VERSION,
           },
         ],
       });
diff --git a/x-pack/plugins/observability/server/services/slo/find_slo.ts b/x-pack/plugins/observability/server/services/slo/find_slo.ts
index cf8150db3e627a..6237b6e48832b3 100644
--- a/x-pack/plugins/observability/server/services/slo/find_slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/find_slo.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { FindSLOParams, FindSLOResponse, findSLOResponseSchema } from '@kbn/slo-schema';
+import { FindSLOParams, FindSLOResponse, findSLOResponseSchema, Pagination } from '@kbn/slo-schema';
 import { SLO, SLOWithSummary } from '../../domain/models';
 import { IllegalArgumentError } from '../../errors';
 import { SLORepository } from './slo_repository';
-import { Pagination, SLOSummary, Sort, SummarySearchClient } from './summary_search_client';
+import { SLOSummary, Sort, SummarySearchClient } from './summary_search_client';
 
 const DEFAULT_PAGE = 1;
 const DEFAULT_PER_PAGE = 25;
@@ -55,7 +55,7 @@ function toPagination(params: FindSLOParams): Pagination {
   const perPage = Number(params.perPage);
 
   if (!isNaN(perPage) && perPage > MAX_PER_PAGE) {
-    throw new IllegalArgumentError('perPage limit to 5000');
+    throw new IllegalArgumentError(`perPage limit to ${MAX_PER_PAGE}`);
   }
 
   return {
diff --git a/x-pack/plugins/observability/server/services/slo/find_slo_definitions.ts b/x-pack/plugins/observability/server/services/slo/find_slo_definitions.ts
index 157e5b4be5696d..a9a4b8bf61752e 100644
--- a/x-pack/plugins/observability/server/services/slo/find_slo_definitions.ts
+++ b/x-pack/plugins/observability/server/services/slo/find_slo_definitions.ts
@@ -5,14 +5,40 @@
  * 2.0.
  */
 
-import { FindSloDefinitionsResponse, findSloDefinitionsResponseSchema } from '@kbn/slo-schema';
+import {
+  FindSLODefinitionsParams,
+  FindSLODefinitionsResponse,
+  findSloDefinitionsResponseSchema,
+  Pagination,
+} from '@kbn/slo-schema';
+import { IllegalArgumentError } from '../../errors';
 import { SLORepository } from './slo_repository';
 
+const MAX_PER_PAGE = 1000;
+const DEFAULT_PER_PAGE = 100;
+const DEFAULT_PAGE = 1;
+
 export class FindSLODefinitions {
   constructor(private repository: SLORepository) {}
 
-  public async execute(search: string): Promise<FindSloDefinitionsResponse> {
-    const sloList = await this.repository.search(search);
-    return findSloDefinitionsResponseSchema.encode(sloList);
+  public async execute(params: FindSLODefinitionsParams): Promise<FindSLODefinitionsResponse> {
+    const result = await this.repository.search(params.search ?? '', toPagination(params), {
+      includeOutdatedOnly: params.includeOutdatedOnly === true ? true : false,
+    });
+    return findSloDefinitionsResponseSchema.encode(result);
+  }
+}
+
+function toPagination(params: FindSLODefinitionsParams): Pagination {
+  const page = Number(params.page);
+  const perPage = Number(params.perPage);
+
+  if (!isNaN(perPage) && perPage > MAX_PER_PAGE) {
+    throw new IllegalArgumentError(`perPage limit to ${MAX_PER_PAGE}`);
   }
+
+  return {
+    page: !isNaN(page) && page >= 1 ? page : DEFAULT_PAGE,
+    perPage: !isNaN(perPage) && perPage >= 1 ? perPage : DEFAULT_PER_PAGE,
+  };
 }
diff --git a/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts b/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
index 2bd320cbb8d659..146900f6467913 100644
--- a/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
@@ -15,6 +15,7 @@ import {
 } from '@kbn/slo-schema';
 import { cloneDeep } from 'lodash';
 import { v4 as uuidv4 } from 'uuid';
+import { SLO_MODEL_VERSION } from '../../../assets/constants';
 import {
   APMTransactionDurationIndicator,
   APMTransactionErrorRateIndicator,
@@ -139,7 +140,7 @@ export const createHistogramIndicator = (
   },
 });
 
-const defaultSLO: Omit<SLO, 'id' | 'revision' | 'createdAt' | 'updatedAt'> = {
+const defaultSLO: Omit<SLO, 'id' | 'revision' | 'createdAt' | 'updatedAt' | 'version'> = {
   name: 'irrelevant',
   description: 'irrelevant',
   timeWindow: sevenDaysRolling(),
@@ -190,6 +191,7 @@ export const createSLO = (params: Partial<SLO> = {}): SLO => {
     revision: 1,
     createdAt: now,
     updatedAt: now,
+    version: SLO_MODEL_VERSION,
     ...params,
   });
 };
diff --git a/x-pack/plugins/observability/server/services/slo/get_slo.test.ts b/x-pack/plugins/observability/server/services/slo/get_slo.test.ts
index 1a5efccc9eb2af..148db2479970e6 100644
--- a/x-pack/plugins/observability/server/services/slo/get_slo.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/get_slo.test.ts
@@ -6,6 +6,7 @@
  */
 
 import { ALL_VALUE } from '@kbn/slo-schema';
+import { SLO_MODEL_VERSION } from '../../assets/constants';
 import { createAPMTransactionErrorRateIndicator, createSLO } from './fixtures/slo';
 import { GetSLO } from './get_slo';
 import { createSummaryClientMock, createSLORepositoryMock } from './mocks';
@@ -84,6 +85,7 @@ describe('GetSLO', () => {
         revision: slo.revision,
         groupBy: slo.groupBy,
         instanceId: ALL_VALUE,
+        version: SLO_MODEL_VERSION,
       });
     });
   });
diff --git a/x-pack/plugins/observability/server/services/slo/reset_slo.test.ts b/x-pack/plugins/observability/server/services/slo/reset_slo.test.ts
new file mode 100644
index 00000000000000..9b10bd944666ba
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/reset_slo.test.ts
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from '@kbn/core/server';
+import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
+
+import {
+  getSLOTransformId,
+  SLO_DESTINATION_INDEX_PATTERN,
+  SLO_MODEL_VERSION,
+  SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+} from '../../assets/constants';
+import { createSLO } from './fixtures/slo';
+import { createSLORepositoryMock, createTransformManagerMock } from './mocks';
+import { ResetSLO } from './reset_slo';
+import { SLORepository } from './slo_repository';
+import { TransformManager } from './transform_manager';
+
+describe('ResetSLO', () => {
+  let mockRepository: jest.Mocked<SLORepository>;
+  let mockTransformManager: jest.Mocked<TransformManager>;
+  let mockEsClient: jest.Mocked<ElasticsearchClient>;
+  let resetSLO: ResetSLO;
+
+  beforeEach(() => {
+    mockRepository = createSLORepositoryMock();
+    mockTransformManager = createTransformManagerMock();
+    mockEsClient = elasticsearchServiceMock.createElasticsearchClient();
+    resetSLO = new ResetSLO(mockEsClient, mockRepository, mockTransformManager);
+  });
+
+  it('resets the SLO', async () => {
+    const slo = createSLO({ version: 1 });
+    mockRepository.findById.mockResolvedValueOnce(slo);
+    mockRepository.save.mockImplementation((v) => Promise.resolve(v));
+
+    await resetSLO.execute(slo.id);
+
+    const transformId = getSLOTransformId(slo.id, slo.revision);
+    expect(mockTransformManager.stop).toBeCalledWith(transformId);
+    expect(mockTransformManager.uninstall).toBeCalledWith(transformId);
+
+    expect(mockEsClient.deleteByQuery).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        index: SLO_DESTINATION_INDEX_PATTERN,
+        query: {
+          bool: {
+            filter: [{ term: { 'slo.id': slo.id } }],
+          },
+        },
+      })
+    );
+    expect(mockEsClient.deleteByQuery).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        index: SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+        query: {
+          bool: {
+            filter: [{ term: { 'slo.id': slo.id } }],
+          },
+        },
+      })
+    );
+
+    expect(mockTransformManager.install).toBeCalledWith(slo);
+    expect(mockTransformManager.preview).toBeCalledWith(transformId);
+    expect(mockTransformManager.start).toBeCalledWith(transformId);
+
+    expect(mockRepository.save).toHaveBeenCalledWith({
+      ...slo,
+      version: SLO_MODEL_VERSION,
+      updatedAt: expect.anything(),
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/server/services/slo/reset_slo.ts b/x-pack/plugins/observability/server/services/slo/reset_slo.ts
new file mode 100644
index 00000000000000..e91bd68e8aa9ed
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/reset_slo.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from '@kbn/core/server';
+import { resetSLOResponseSchema } from '@kbn/slo-schema';
+import {
+  getSLOTransformId,
+  SLO_DESTINATION_INDEX_PATTERN,
+  SLO_MODEL_VERSION,
+  SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+  SLO_SUMMARY_TEMP_INDEX_NAME,
+} from '../../assets/constants';
+import { SLORepository } from './slo_repository';
+import { createTempSummaryDocument } from './summary_transform/helpers/create_temp_summary';
+import { TransformManager } from './transform_manager';
+
+export class ResetSLO {
+  constructor(
+    private esClient: ElasticsearchClient,
+    private repository: SLORepository,
+    private transformManager: TransformManager
+  ) {}
+
+  public async execute(sloId: string) {
+    const slo = await this.repository.findById(sloId);
+
+    const transformId = getSLOTransformId(slo.id, slo.revision);
+    await this.transformManager.stop(transformId);
+    await this.transformManager.uninstall(transformId);
+
+    await Promise.all([this.deleteRollupData(slo.id), this.deleteSummaryData(slo.id)]);
+
+    await this.transformManager.install(slo);
+
+    try {
+      await this.transformManager.preview(transformId);
+      await this.transformManager.start(transformId);
+    } catch (err) {
+      await this.transformManager.uninstall(transformId);
+      throw err;
+    }
+
+    await this.esClient.index({
+      index: SLO_SUMMARY_TEMP_INDEX_NAME,
+      id: `slo-${slo.id}`,
+      document: createTempSummaryDocument(slo),
+      refresh: true,
+    });
+
+    const updatedSlo = await this.repository.save(
+      Object.assign({ ...slo, version: SLO_MODEL_VERSION, updatedAt: new Date() })
+    );
+
+    return resetSLOResponseSchema.encode(updatedSlo);
+  }
+
+  /**
+   * Deleting all SLI rollup data matching the sloId. All revision will be deleted in case of
+   * residual documents.
+   *
+   * @param sloId
+   */
+  private async deleteRollupData(sloId: string): Promise<void> {
+    await this.esClient.deleteByQuery({
+      index: SLO_DESTINATION_INDEX_PATTERN,
+      refresh: true,
+      query: {
+        bool: {
+          filter: [{ term: { 'slo.id': sloId } }],
+        },
+      },
+    });
+  }
+
+  /**
+   * Deleting the summary documents matching the sloId. All revision will be deleted in case of
+   * residual documents.
+   *
+   * @param sloId
+   */
+  private async deleteSummaryData(sloId: string): Promise<void> {
+    await this.esClient.deleteByQuery({
+      index: SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+      refresh: true,
+      query: {
+        bool: {
+          filter: [{ term: { 'slo.id': sloId } }],
+        },
+      },
+    });
+  }
+}
diff --git a/x-pack/plugins/observability/server/services/slo/resource_installer.test.ts b/x-pack/plugins/observability/server/services/slo/resource_installer.test.ts
index 8337c85b5f156e..4182c0ee9b6830 100644
--- a/x-pack/plugins/observability/server/services/slo/resource_installer.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/resource_installer.test.ts
@@ -14,15 +14,20 @@ import {
   SLO_INGEST_PIPELINE_NAME,
   SLO_SUMMARY_COMPONENT_TEMPLATE_MAPPINGS_NAME,
   SLO_SUMMARY_COMPONENT_TEMPLATE_SETTINGS_NAME,
+  SLO_SUMMARY_ENRICH_POLICY_NAME,
   SLO_SUMMARY_INDEX_TEMPLATE_NAME,
   SLO_SUMMARY_INGEST_PIPELINE_NAME,
 } from '../../assets/constants';
+import { getSLOSummaryEnrichPolicy } from '../../assets/enrich_policies/slo_summary_enrich_policy';
 import { DefaultResourceInstaller } from './resource_installer';
 
 describe('resourceInstaller', () => {
   it('installs the common resources', async () => {
     const mockClusterClient = elasticsearchServiceMock.createElasticsearchClient();
     mockClusterClient.indices.getIndexTemplate.mockResponseOnce({ index_templates: [] });
+    mockClusterClient.enrich.getPolicy.mockResponseOnce({
+      policies: [],
+    });
     const installer = new DefaultResourceInstaller(mockClusterClient, loggerMock.create());
 
     await installer.ensureCommonResourcesInstalled();
@@ -54,6 +59,21 @@ describe('resourceInstaller', () => {
       expect.objectContaining({ name: SLO_SUMMARY_INDEX_TEMPLATE_NAME })
     );
 
+    expect(mockClusterClient.enrich.getPolicy).toHaveBeenCalledTimes(1);
+    expect(mockClusterClient.enrich.getPolicy).toHaveBeenNthCalledWith(1, {
+      name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+    });
+
+    expect(mockClusterClient.enrich.putPolicy).toHaveBeenCalledTimes(1);
+    expect(mockClusterClient.enrich.putPolicy).toHaveBeenNthCalledWith(
+      1,
+      getSLOSummaryEnrichPolicy()
+    );
+    expect(mockClusterClient.enrich.executePolicy).toHaveBeenCalledTimes(1);
+    expect(mockClusterClient.enrich.executePolicy).toHaveBeenNthCalledWith(1, {
+      name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+    });
+
     expect(mockClusterClient.ingest.putPipeline).toHaveBeenCalledTimes(2);
     expect(mockClusterClient.ingest.putPipeline).toHaveBeenNthCalledWith(
       1,
@@ -64,4 +84,34 @@ describe('resourceInstaller', () => {
       expect.objectContaining({ id: SLO_SUMMARY_INGEST_PIPELINE_NAME })
     );
   });
+  it('skips installing the enrich policy if it exists', async () => {
+    const mockClusterClient = elasticsearchServiceMock.createElasticsearchClient();
+    mockClusterClient.indices.getIndexTemplate.mockResponseOnce({ index_templates: [] });
+    mockClusterClient.enrich.getPolicy.mockResponseOnce({
+      policies: [
+        {
+          config: {
+            // Sigh.... the Elasticsarch type for an enrich policy has defined the
+            // query as a string which is completely wrong, it's a QueryDSLContainer!
+            //
+            // See: https://github.com/elastic/elasticsearch-js/issues/2074
+            match: {
+              ...getSLOSummaryEnrichPolicy().match,
+              name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+            } as any,
+          },
+        },
+      ],
+    });
+    const installer = new DefaultResourceInstaller(mockClusterClient, loggerMock.create());
+
+    await installer.ensureCommonResourcesInstalled();
+
+    expect(mockClusterClient.enrich.getPolicy).toHaveBeenCalledTimes(1);
+    expect(mockClusterClient.enrich.getPolicy).toHaveBeenNthCalledWith(1, {
+      name: SLO_SUMMARY_ENRICH_POLICY_NAME,
+    });
+    expect(mockClusterClient.enrich.putPolicy).not.toHaveBeenCalled();
+    expect(mockClusterClient.enrich.executePolicy).not.toHaveBeenCalled();
+  });
 });
diff --git a/x-pack/plugins/observability/server/services/slo/resource_installer.ts b/x-pack/plugins/observability/server/services/slo/resource_installer.ts
index 4fc77ea2399c78..dfc0960dc7b907 100644
--- a/x-pack/plugins/observability/server/services/slo/resource_installer.ts
+++ b/x-pack/plugins/observability/server/services/slo/resource_installer.ts
@@ -7,6 +7,7 @@
 
 import type {
   ClusterPutComponentTemplateRequest,
+  EnrichPutPolicyRequest,
   IndicesPutIndexTemplateRequest,
   IngestPutPipelineRequest,
 } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
@@ -31,6 +32,7 @@ import {
   SLO_SUMMARY_INGEST_PIPELINE_NAME,
   SLO_SUMMARY_TEMP_INDEX_NAME,
 } from '../../assets/constants';
+import { getSLOSummaryEnrichPolicy } from '../../assets/enrich_policies/slo_summary_enrich_policy';
 import { getSLOIndexTemplate } from '../../assets/index_templates/slo_index_templates';
 import { getSLOSummaryIndexTemplate } from '../../assets/index_templates/slo_summary_index_templates';
 import { getSLOPipelineTemplate } from '../../assets/ingest_templates/slo_pipeline_template';
@@ -84,6 +86,8 @@ export class DefaultResourceInstaller implements ResourceInstaller {
       await this.createIndex(SLO_SUMMARY_DESTINATION_INDEX_NAME);
       await this.createIndex(SLO_SUMMARY_TEMP_INDEX_NAME);
 
+      await this.createOrUpdateEnrichPolicy(getSLOSummaryEnrichPolicy());
+
       await this.createOrUpdateIngestPipelineTemplate(
         getSLOPipelineTemplate(SLO_INGEST_PIPELINE_NAME, SLO_INGEST_PIPELINE_INDEX_NAME_PREFIX)
       );
@@ -112,6 +116,20 @@ export class DefaultResourceInstaller implements ResourceInstaller {
     return this.execute(() => this.esClient.ingest.putPipeline(template));
   }
 
+  private async createOrUpdateEnrichPolicy(policy: EnrichPutPolicyRequest) {
+    return this.execute(async () => {
+      const existingPolicy = await this.esClient.enrich.getPolicy({ name: policy.name });
+      if (existingPolicy.policies.some(({ config }) => config.match?.name === policy.name)) {
+        this.logger.info(`SLO summary erich policy [${policy.name}] already exists.`);
+        return;
+      }
+      this.logger.info(`Installing SLO summary erich policy [${policy.name}]`);
+      return this.esClient.enrich
+        .putPolicy(policy)
+        .then(() => this.esClient.enrich.executePolicy({ name: policy.name }));
+    });
+  }
+
   private async createIndex(indexName: string) {
     try {
       await this.execute(() => this.esClient.indices.create({ index: indexName }));
diff --git a/x-pack/plugins/observability/server/services/slo/slo_repository.test.ts b/x-pack/plugins/observability/server/services/slo/slo_repository.test.ts
index 4b61bff04ea6f6..6956867b31c18e 100644
--- a/x-pack/plugins/observability/server/services/slo/slo_repository.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/slo_repository.test.ts
@@ -8,6 +8,7 @@
 import { SavedObjectsClientContract, SavedObjectsFindResponse } from '@kbn/core/server';
 import { savedObjectsClientMock } from '@kbn/core/server/mocks';
 import { sloSchema } from '@kbn/slo-schema';
+import { SLO_MODEL_VERSION } from '../../assets/constants';
 import { SLO, StoredSLO } from '../../domain/models';
 import { SLOIdConflict, SLONotFound } from '../../errors';
 import { SO_SLO_TYPE } from '../../saved_objects';
@@ -164,19 +165,42 @@ describe('KibanaSavedObjectsSLORepository', () => {
     expect(soClientMock.delete).toHaveBeenCalledWith(SO_SLO_TYPE, SOME_SLO.id);
   });
 
-  it('searches by name', async () => {
-    const repository = new KibanaSavedObjectsSLORepository(soClientMock);
-    soClientMock.find.mockResolvedValueOnce(soFindResponse([SOME_SLO, ANOTHER_SLO]));
+  describe('search', () => {
+    it('searches by name', async () => {
+      const repository = new KibanaSavedObjectsSLORepository(soClientMock);
+      soClientMock.find.mockResolvedValueOnce(soFindResponse([SOME_SLO, ANOTHER_SLO]));
 
-    const results = await repository.search(SOME_SLO.name);
+      const results = await repository.search(SOME_SLO.name, { page: 1, perPage: 100 });
 
-    expect(results).toEqual([SOME_SLO, ANOTHER_SLO]);
-    expect(soClientMock.find).toHaveBeenCalledWith({
-      type: SO_SLO_TYPE,
-      page: 1,
-      perPage: 25,
-      search: SOME_SLO.name,
-      searchFields: ['name'],
+      expect(results.results).toEqual([SOME_SLO, ANOTHER_SLO]);
+      expect(soClientMock.find).toHaveBeenCalledWith({
+        type: SO_SLO_TYPE,
+        page: 1,
+        perPage: 100,
+        search: SOME_SLO.name,
+        searchFields: ['name'],
+      });
+    });
+
+    it('searches only the outdated ones', async () => {
+      const repository = new KibanaSavedObjectsSLORepository(soClientMock);
+      soClientMock.find.mockResolvedValueOnce(soFindResponse([SOME_SLO, ANOTHER_SLO]));
+
+      const results = await repository.search(
+        SOME_SLO.name,
+        { page: 1, perPage: 100 },
+        { includeOutdatedOnly: true }
+      );
+
+      expect(results.results).toEqual([SOME_SLO, ANOTHER_SLO]);
+      expect(soClientMock.find).toHaveBeenCalledWith({
+        type: SO_SLO_TYPE,
+        page: 1,
+        perPage: 100,
+        search: SOME_SLO.name,
+        searchFields: ['name'],
+        filter: `slo.attributes.version < ${SLO_MODEL_VERSION}`,
+      });
     });
   });
 });
diff --git a/x-pack/plugins/observability/server/services/slo/slo_repository.ts b/x-pack/plugins/observability/server/services/slo/slo_repository.ts
index cc595ed0b00993..80d0e6368b4c7a 100644
--- a/x-pack/plugins/observability/server/services/slo/slo_repository.ts
+++ b/x-pack/plugins/observability/server/services/slo/slo_repository.ts
@@ -7,10 +7,11 @@
 
 import { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
 import { SavedObjectsErrorHelpers } from '@kbn/core-saved-objects-server';
-import { sloSchema } from '@kbn/slo-schema';
+import { Paginated, Pagination, sloSchema } from '@kbn/slo-schema';
 import { fold } from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/pipeable';
 import * as t from 'io-ts';
+import { SLO_MODEL_VERSION } from '../../assets/constants';
 import { SLO, StoredSLO } from '../../domain/models';
 import { SLOIdConflict, SLONotFound } from '../../errors';
 import { SO_SLO_TYPE } from '../../saved_objects';
@@ -20,7 +21,11 @@ export interface SLORepository {
   findAllByIds(ids: string[]): Promise<SLO[]>;
   findById(id: string): Promise<SLO>;
   deleteById(id: string): Promise<void>;
-  search(search: string): Promise<SLO[]>;
+  search(
+    search: string,
+    pagination: Pagination,
+    options?: { includeOutdatedOnly?: boolean }
+  ): Promise<Paginated<SLO>>;
 }
 
 export class KibanaSavedObjectsSLORepository implements SLORepository {
@@ -99,19 +104,28 @@ export class KibanaSavedObjectsSLORepository implements SLORepository {
     }
   }
 
-  async search(search: string): Promise<SLO[]> {
-    try {
-      const response = await this.soClient.find<StoredSLO>({
-        type: SO_SLO_TYPE,
-        page: 1,
-        perPage: 25,
-        search,
-        searchFields: ['name'],
-      });
-      return response.saved_objects.map((slo) => toSLO(slo.attributes));
-    } catch (err) {
-      throw err;
-    }
+  async search(
+    search: string,
+    pagination: Pagination,
+    options: { includeOutdatedOnly?: boolean } = { includeOutdatedOnly: false }
+  ): Promise<Paginated<SLO>> {
+    const response = await this.soClient.find<StoredSLO>({
+      type: SO_SLO_TYPE,
+      page: pagination.page,
+      perPage: pagination.perPage,
+      search,
+      searchFields: ['name'],
+      ...(!!options.includeOutdatedOnly && {
+        filter: `slo.attributes.version < ${SLO_MODEL_VERSION}`,
+      }),
+    });
+
+    return {
+      total: response.total,
+      perPage: response.per_page,
+      page: response.page,
+      results: response.saved_objects.map((slo) => toSLO(slo.attributes)),
+    };
   }
 }
 
@@ -121,7 +135,13 @@ function toStoredSLO(slo: SLO): StoredSLO {
 
 function toSLO(storedSLO: StoredSLO): SLO {
   return pipe(
-    sloSchema.decode(storedSLO),
+    sloSchema.decode({
+      ...storedSLO,
+      // version was added in 8.12.0. This is a safeguard against SO migration issue.
+      // if not present, we considered the version to be 1, e.g. not migrated.
+      // We would need to call the _reset api on this SLO.
+      version: storedSLO.version ?? 1,
+    }),
     fold(() => {
       throw new Error('Invalid Stored SLO');
     }, t.identity)
diff --git a/x-pack/plugins/observability/server/services/slo/summary_search_client.test.ts b/x-pack/plugins/observability/server/services/slo/summary_search_client.test.ts
index fc53bf1e7181bf..9036611b1fedaa 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_search_client.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_search_client.test.ts
@@ -7,17 +7,13 @@
 
 import { ElasticsearchClientMock, elasticsearchServiceMock } from '@kbn/core/server/mocks';
 import { loggerMock } from '@kbn/logging-mocks';
+import { Pagination } from '@kbn/slo-schema/src/models/pagination';
 import {
   aHitFromSummaryIndex,
   aHitFromTempSummaryIndex,
   aSummaryDocument,
 } from './fixtures/summary_search_document';
-import {
-  DefaultSummarySearchClient,
-  Pagination,
-  Sort,
-  SummarySearchClient,
-} from './summary_search_client';
+import { DefaultSummarySearchClient, Sort, SummarySearchClient } from './summary_search_client';
 
 const defaultSort: Sort = {
   field: 'sli_value',
diff --git a/x-pack/plugins/observability/server/services/slo/summary_search_client.ts b/x-pack/plugins/observability/server/services/slo/summary_search_client.ts
index f2bfa1ed29df38..7412e1e6e0f8a4 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_search_client.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_search_client.ts
@@ -6,7 +6,7 @@
  */
 
 import { ElasticsearchClient, Logger } from '@kbn/core/server';
-import { ALL_VALUE } from '@kbn/slo-schema';
+import { ALL_VALUE, Paginated, Pagination } from '@kbn/slo-schema';
 import { assertNever } from '@kbn/std';
 import _ from 'lodash';
 import { SLO_SUMMARY_DESTINATION_INDEX_PATTERN } from '../../assets/constants';
@@ -30,13 +30,6 @@ interface EsSummaryDocument {
   isTempDoc: boolean;
 }
 
-export interface Paginated<T> {
-  total: number;
-  page: number;
-  perPage: number;
-  results: T[];
-}
-
 export interface SLOSummary {
   id: SLOId;
   instanceId: string;
@@ -49,11 +42,6 @@ export interface Sort {
   direction: 'asc' | 'desc';
 }
 
-export interface Pagination {
-  page: number;
-  perPage: number;
-}
-
 export interface SummarySearchClient {
   search(kqlQuery: string, sort: Sort, pagination: Pagination): Promise<Paginated<SLOSummary>>;
 }
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/__snapshots__/summary_transform_installer.test.ts.snap b/x-pack/plugins/observability/server/services/slo/summary_transform/__snapshots__/summary_transform_installer.test.ts.snap
index 5161c5e5cb51b8..4dba4a5b89880d 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/__snapshots__/summary_transform_installer.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/__snapshots__/summary_transform_installer.test.ts.snap
@@ -7,11 +7,11 @@ Array [
       "_meta": Object {
         "managed": true,
         "managed_by": "observability",
-        "version": 3,
+        "version": 4,
       },
       "description": "Summarize every SLO with timeslices budgeting method and a 7 days rolling time window",
       "dest": Object {
-        "index": ".slo-observability.summary-v2",
+        "index": ".slo-observability.summary-v3",
         "pipeline": ".slo-observability.summary.pipeline",
       },
       "frequency": "1m",
@@ -52,6 +52,11 @@ Array [
               "field": "slo.isGoodSlice",
             },
           },
+          "latestSliTimestamp": Object {
+            "max": Object {
+              "field": "@timestamp",
+            },
+          },
           "sliValue": Object {
             "bucket_script": Object {
               "buckets_path": Object {
@@ -107,46 +112,21 @@ Array [
               "field": "slo.budgetingMethod",
             },
           },
-          "slo.description": Object {
-            "terms": Object {
-              "field": "slo.description",
-            },
-          },
-          "slo.groupBy": Object {
-            "terms": Object {
-              "field": "slo.groupBy",
-            },
-          },
           "slo.id": Object {
             "terms": Object {
               "field": "slo.id",
             },
           },
-          "slo.indicator.type": Object {
-            "terms": Object {
-              "field": "slo.indicator.type",
-            },
-          },
           "slo.instanceId": Object {
             "terms": Object {
               "field": "slo.instanceId",
             },
           },
-          "slo.name": Object {
-            "terms": Object {
-              "field": "slo.name",
-            },
-          },
           "slo.revision": Object {
             "terms": Object {
               "field": "slo.revision",
             },
           },
-          "slo.tags": Object {
-            "terms": Object {
-              "field": "slo.tags",
-            },
-          },
           "slo.timeWindow.duration": Object {
             "terms": Object {
               "field": "slo.timeWindow.duration",
@@ -176,7 +156,7 @@ Array [
         "unattended": true,
       },
       "source": Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "filter": Array [
@@ -219,8 +199,8 @@ Array [
       },
       "sync": Object {
         "time": Object {
-          "delay": "125s",
-          "field": "@timestamp",
+          "delay": "65s",
+          "field": "event.ingested",
         },
       },
       "transform_id": "slo-summary-timeslices-7d-rolling",
@@ -236,11 +216,11 @@ Array [
       "_meta": Object {
         "managed": true,
         "managed_by": "observability",
-        "version": 3,
+        "version": 4,
       },
       "description": "Summarize every SLO with timeslices budgeting method and a 30 days rolling time window",
       "dest": Object {
-        "index": ".slo-observability.summary-v2",
+        "index": ".slo-observability.summary-v3",
         "pipeline": ".slo-observability.summary.pipeline",
       },
       "frequency": "1m",
@@ -281,6 +261,11 @@ Array [
               "field": "slo.isGoodSlice",
             },
           },
+          "latestSliTimestamp": Object {
+            "max": Object {
+              "field": "@timestamp",
+            },
+          },
           "sliValue": Object {
             "bucket_script": Object {
               "buckets_path": Object {
@@ -336,46 +321,21 @@ Array [
               "field": "slo.budgetingMethod",
             },
           },
-          "slo.description": Object {
-            "terms": Object {
-              "field": "slo.description",
-            },
-          },
-          "slo.groupBy": Object {
-            "terms": Object {
-              "field": "slo.groupBy",
-            },
-          },
           "slo.id": Object {
             "terms": Object {
               "field": "slo.id",
             },
           },
-          "slo.indicator.type": Object {
-            "terms": Object {
-              "field": "slo.indicator.type",
-            },
-          },
           "slo.instanceId": Object {
             "terms": Object {
               "field": "slo.instanceId",
             },
           },
-          "slo.name": Object {
-            "terms": Object {
-              "field": "slo.name",
-            },
-          },
           "slo.revision": Object {
             "terms": Object {
               "field": "slo.revision",
             },
           },
-          "slo.tags": Object {
-            "terms": Object {
-              "field": "slo.tags",
-            },
-          },
           "slo.timeWindow.duration": Object {
             "terms": Object {
               "field": "slo.timeWindow.duration",
@@ -405,7 +365,7 @@ Array [
         "unattended": true,
       },
       "source": Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "filter": Array [
@@ -448,8 +408,8 @@ Array [
       },
       "sync": Object {
         "time": Object {
-          "delay": "125s",
-          "field": "@timestamp",
+          "delay": "65s",
+          "field": "event.ingested",
         },
       },
       "transform_id": "slo-summary-timeslices-30d-rolling",
@@ -465,11 +425,11 @@ Array [
       "_meta": Object {
         "managed": true,
         "managed_by": "observability",
-        "version": 3,
+        "version": 4,
       },
       "description": "Summarize every SLO with timeslices budgeting method and a 90 days rolling time window",
       "dest": Object {
-        "index": ".slo-observability.summary-v2",
+        "index": ".slo-observability.summary-v3",
         "pipeline": ".slo-observability.summary.pipeline",
       },
       "frequency": "1m",
@@ -510,6 +470,11 @@ Array [
               "field": "slo.isGoodSlice",
             },
           },
+          "latestSliTimestamp": Object {
+            "max": Object {
+              "field": "@timestamp",
+            },
+          },
           "sliValue": Object {
             "bucket_script": Object {
               "buckets_path": Object {
@@ -565,46 +530,21 @@ Array [
               "field": "slo.budgetingMethod",
             },
           },
-          "slo.description": Object {
-            "terms": Object {
-              "field": "slo.description",
-            },
-          },
-          "slo.groupBy": Object {
-            "terms": Object {
-              "field": "slo.groupBy",
-            },
-          },
           "slo.id": Object {
             "terms": Object {
               "field": "slo.id",
             },
           },
-          "slo.indicator.type": Object {
-            "terms": Object {
-              "field": "slo.indicator.type",
-            },
-          },
           "slo.instanceId": Object {
             "terms": Object {
               "field": "slo.instanceId",
             },
           },
-          "slo.name": Object {
-            "terms": Object {
-              "field": "slo.name",
-            },
-          },
           "slo.revision": Object {
             "terms": Object {
               "field": "slo.revision",
             },
           },
-          "slo.tags": Object {
-            "terms": Object {
-              "field": "slo.tags",
-            },
-          },
           "slo.timeWindow.duration": Object {
             "terms": Object {
               "field": "slo.timeWindow.duration",
@@ -634,7 +574,7 @@ Array [
         "unattended": true,
       },
       "source": Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "filter": Array [
@@ -677,8 +617,8 @@ Array [
       },
       "sync": Object {
         "time": Object {
-          "delay": "125s",
-          "field": "@timestamp",
+          "delay": "65s",
+          "field": "event.ingested",
         },
       },
       "transform_id": "slo-summary-timeslices-90d-rolling",
@@ -694,11 +634,11 @@ Array [
       "_meta": Object {
         "managed": true,
         "managed_by": "observability",
-        "version": 3,
+        "version": 4,
       },
       "description": "Summarize every SLO with timeslices budgeting method and a weekly calendar aligned time window",
       "dest": Object {
-        "index": ".slo-observability.summary-v2",
+        "index": ".slo-observability.summary-v3",
         "pipeline": ".slo-observability.summary.pipeline",
       },
       "frequency": "1m",
@@ -754,6 +694,11 @@ Array [
               "field": "slo.isGoodSlice",
             },
           },
+          "latestSliTimestamp": Object {
+            "max": Object {
+              "field": "@timestamp",
+            },
+          },
           "sliValue": Object {
             "bucket_script": Object {
               "buckets_path": Object {
@@ -807,46 +752,21 @@ Array [
               "field": "slo.budgetingMethod",
             },
           },
-          "slo.description": Object {
-            "terms": Object {
-              "field": "slo.description",
-            },
-          },
-          "slo.groupBy": Object {
-            "terms": Object {
-              "field": "slo.groupBy",
-            },
-          },
           "slo.id": Object {
             "terms": Object {
               "field": "slo.id",
             },
           },
-          "slo.indicator.type": Object {
-            "terms": Object {
-              "field": "slo.indicator.type",
-            },
-          },
           "slo.instanceId": Object {
             "terms": Object {
               "field": "slo.instanceId",
             },
           },
-          "slo.name": Object {
-            "terms": Object {
-              "field": "slo.name",
-            },
-          },
           "slo.revision": Object {
             "terms": Object {
               "field": "slo.revision",
             },
           },
-          "slo.tags": Object {
-            "terms": Object {
-              "field": "slo.tags",
-            },
-          },
           "slo.timeWindow.duration": Object {
             "terms": Object {
               "field": "slo.timeWindow.duration",
@@ -876,7 +796,7 @@ Array [
         "unattended": true,
       },
       "source": Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "filter": Array [
@@ -919,8 +839,8 @@ Array [
       },
       "sync": Object {
         "time": Object {
-          "delay": "125s",
-          "field": "@timestamp",
+          "delay": "65s",
+          "field": "event.ingested",
         },
       },
       "transform_id": "slo-summary-timeslices-weekly-aligned",
@@ -936,11 +856,11 @@ Array [
       "_meta": Object {
         "managed": true,
         "managed_by": "observability",
-        "version": 3,
+        "version": 4,
       },
       "description": "Summarize every SLO with timeslices budgeting method and a monthly calendar aligned time window",
       "dest": Object {
-        "index": ".slo-observability.summary-v2",
+        "index": ".slo-observability.summary-v3",
         "pipeline": ".slo-observability.summary.pipeline",
       },
       "frequency": "1m",
@@ -963,7 +883,7 @@ Array [
               },
               "script": Object {
                 "source": "
-              Date d = new Date(); 
+              Date d = new Date();
               Instant instant = Instant.ofEpochMilli(d.getTime());
               LocalDateTime now = LocalDateTime.ofInstant(instant, ZoneOffset.UTC);
               LocalDateTime startOfMonth = now
@@ -973,7 +893,7 @@ Array [
                 .withSecond(0);
               LocalDateTime startOfNextMonth = startOfMonth.plusMonths(1);
               double sliceDurationInMinutes = params.sliceDurationInSeconds / 60;
-              
+
               return Math.ceil(Duration.between(startOfMonth, startOfNextMonth).toMinutes() / sliceDurationInMinutes);
             ",
               },
@@ -1011,6 +931,11 @@ Array [
               "field": "slo.isGoodSlice",
             },
           },
+          "latestSliTimestamp": Object {
+            "max": Object {
+              "field": "@timestamp",
+            },
+          },
           "sliValue": Object {
             "bucket_script": Object {
               "buckets_path": Object {
@@ -1064,46 +989,21 @@ Array [
               "field": "slo.budgetingMethod",
             },
           },
-          "slo.description": Object {
-            "terms": Object {
-              "field": "slo.description",
-            },
-          },
-          "slo.groupBy": Object {
-            "terms": Object {
-              "field": "slo.groupBy",
-            },
-          },
           "slo.id": Object {
             "terms": Object {
               "field": "slo.id",
             },
           },
-          "slo.indicator.type": Object {
-            "terms": Object {
-              "field": "slo.indicator.type",
-            },
-          },
           "slo.instanceId": Object {
             "terms": Object {
               "field": "slo.instanceId",
             },
           },
-          "slo.name": Object {
-            "terms": Object {
-              "field": "slo.name",
-            },
-          },
           "slo.revision": Object {
             "terms": Object {
               "field": "slo.revision",
             },
           },
-          "slo.tags": Object {
-            "terms": Object {
-              "field": "slo.tags",
-            },
-          },
           "slo.timeWindow.duration": Object {
             "terms": Object {
               "field": "slo.timeWindow.duration",
@@ -1133,7 +1033,7 @@ Array [
         "unattended": true,
       },
       "source": Object {
-        "index": ".slo-observability.sli-v2*",
+        "index": ".slo-observability.sli-v3*",
         "query": Object {
           "bool": Object {
             "filter": Array [
@@ -1176,8 +1076,8 @@ Array [
       },
       "sync": Object {
         "time": Object {
-          "delay": "125s",
-          "field": "@timestamp",
+          "delay": "65s",
+          "field": "event.ingested",
         },
       },
       "transform_id": "slo-summary-timeslices-monthly-aligned",
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/common.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/common.ts
index c99a6c2be9d3cd..9ae627b4cf202d 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/common.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/common.ts
@@ -16,36 +16,11 @@ export const groupBy = {
       field: 'slo.revision',
     },
   },
-  'slo.groupBy': {
-    terms: {
-      field: 'slo.groupBy',
-    },
-  },
   'slo.instanceId': {
     terms: {
       field: 'slo.instanceId',
     },
   },
-  'slo.name': {
-    terms: {
-      field: 'slo.name',
-    },
-  },
-  'slo.description': {
-    terms: {
-      field: 'slo.description',
-    },
-  },
-  'slo.tags': {
-    terms: {
-      field: 'slo.tags',
-    },
-  },
-  'slo.indicator.type': {
-    terms: {
-      field: 'slo.indicator.type',
-    },
-  },
   'slo.budgetingMethod': {
     terms: {
       field: 'slo.budgetingMethod',
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_30d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_30d_rolling.ts
index 4fea113a54233b..b3ee6d1d9e51fe 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_30d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_30d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_OCCURRENCES_30D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_OCCURRENCES_30D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_7d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_7d_rolling.ts
index 629f7b234843c5..18fd235bfe11c6 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_7d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_7d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_OCCURRENCES_7D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_OCCURRENCES_7D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_90d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_90d_rolling.ts
index dfd77783ef3d23..7dcf080beefbb3 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_90d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_90d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_OCCURRENCES_90D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_OCCURRENCES_90D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_monthly_aligned.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_monthly_aligned.ts
index 9d07bcf9cd5afb..172758eae83394 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_monthly_aligned.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_monthly_aligned.ts
@@ -128,6 +128,11 @@ export const SUMMARY_OCCURRENCES_MONTHLY_ALIGNED: TransformPutTransformRequest =
             'if (params.sliValue == -1) { return 0 } else if (params.sliValue >= params.objective) { return 4 } else if (params.errorBudgetRemaining > 0) { return 2 } else { return 1 }',
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -135,8 +140,8 @@ export const SUMMARY_OCCURRENCES_MONTHLY_ALIGNED: TransformPutTransformRequest =
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_weekly_aligned.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_weekly_aligned.ts
index 0fc3ec19d3cf22..923959a7db6e69 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_weekly_aligned.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_occurrences_weekly_aligned.ts
@@ -128,6 +128,11 @@ export const SUMMARY_OCCURRENCES_WEEKLY_ALIGNED: TransformPutTransformRequest =
             'if (params.sliValue == -1) { return 0 } else if (params.sliValue >= params.objective) { return 4 } else if (params.errorBudgetRemaining > 0) { return 2 } else { return 1 }',
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -135,8 +140,8 @@ export const SUMMARY_OCCURRENCES_WEEKLY_ALIGNED: TransformPutTransformRequest =
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_30d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_30d_rolling.ts
index 5f48a86d0bca8b..facaab299f5eea 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_30d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_30d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_TIMESLICES_30D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_TIMESLICES_30D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_7d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_7d_rolling.ts
index 7a491337fba650..9edb2998dc1d2b 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_7d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_7d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_TIMESLICES_7D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_TIMESLICES_7D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_90d_rolling.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_90d_rolling.ts
index c26c9f84e554f7..38473989dcd215 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_90d_rolling.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_90d_rolling.ts
@@ -130,6 +130,11 @@ export const SUMMARY_TIMESLICES_90D_ROLLING: TransformPutTransformRequest = {
           },
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -137,8 +142,8 @@ export const SUMMARY_TIMESLICES_90D_ROLLING: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_monthly_aligned.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_monthly_aligned.ts
index 18fd40a7294037..370daa6e7b6ec3 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_monthly_aligned.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_monthly_aligned.ts
@@ -78,7 +78,7 @@ export const SUMMARY_TIMESLICES_MONTHLY_ALIGNED: TransformPutTransformRequest =
           },
           script: {
             source: `
-              Date d = new Date(); 
+              Date d = new Date();
               Instant instant = Instant.ofEpochMilli(d.getTime());
               LocalDateTime now = LocalDateTime.ofInstant(instant, ZoneOffset.UTC);
               LocalDateTime startOfMonth = now
@@ -88,7 +88,7 @@ export const SUMMARY_TIMESLICES_MONTHLY_ALIGNED: TransformPutTransformRequest =
                 .withSecond(0);
               LocalDateTime startOfNextMonth = startOfMonth.plusMonths(1);
               double sliceDurationInMinutes = params.sliceDurationInSeconds / 60;
-              
+
               return Math.ceil(Duration.between(startOfMonth, startOfNextMonth).toMinutes() / sliceDurationInMinutes);
             `,
           },
@@ -158,6 +158,11 @@ export const SUMMARY_TIMESLICES_MONTHLY_ALIGNED: TransformPutTransformRequest =
             'if (params.sliValue == -1) { return 0 } else if (params.sliValue >= params.objective) { return 4 } else if (params.errorBudgetRemaining > 0) { return 2 } else { return 1 }',
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -165,8 +170,8 @@ export const SUMMARY_TIMESLICES_MONTHLY_ALIGNED: TransformPutTransformRequest =
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_weekly_aligned.ts b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_weekly_aligned.ts
index af062b7b6abe6b..e85a298a376190 100644
--- a/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_weekly_aligned.ts
+++ b/x-pack/plugins/observability/server/services/slo/summary_transform/templates/summary_timeslices_weekly_aligned.ts
@@ -143,6 +143,11 @@ export const SUMMARY_TIMESLICES_WEEKLY_ALIGNED: TransformPutTransformRequest = {
             'if (params.sliValue == -1) { return 0 } else if (params.sliValue >= params.objective) { return 4 } else if (params.errorBudgetRemaining > 0) { return 2 } else { return 1 }',
         },
       },
+      latestSliTimestamp: {
+        max: {
+          field: '@timestamp',
+        },
+      },
     },
   },
   description:
@@ -150,8 +155,8 @@ export const SUMMARY_TIMESLICES_WEEKLY_ALIGNED: TransformPutTransformRequest = {
   frequency: '1m',
   sync: {
     time: {
-      field: '@timestamp',
-      delay: '125s',
+      field: 'event.ingested',
+      delay: '65s',
     },
   },
   settings: {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_duration.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_duration.test.ts.snap
index d5ac57c80e40d2..6b0214eee954e5 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_duration.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_duration.test.ts.snap
@@ -190,66 +190,21 @@ Object {
       "field": "service.environment",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
 }
 `;
 
@@ -304,66 +259,21 @@ Object {
       "field": "service.name",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
 }
 `;
 
@@ -413,66 +323,21 @@ Object {
       "fixed_interval": "1m",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
   "transaction.name": Object {
     "terms": Object {
       "field": "transaction.name",
@@ -527,66 +392,21 @@ Object {
       "fixed_interval": "1m",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
   "transaction.type": Object {
     "terms": Object {
       "field": "transaction.type",
@@ -600,11 +420,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -660,71 +480,26 @@ Object {
           "field": "service.name",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
       "transaction.name": Object {
         "terms": Object {
           "field": "transaction.name",
@@ -794,84 +569,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.apm.transactionDuration')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -889,11 +610,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -940,66 +661,21 @@ Object {
           "field": "service.name",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
       "transaction.name": Object {
         "terms": Object {
           "field": "transaction.name",
@@ -1069,78 +745,24 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('occurrences')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.apm.transactionDuration')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.999)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_error_rate.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_error_rate.test.ts.snap
index c8d687383b5139..d84eb813c5e129 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_error_rate.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/apm_transaction_error_rate.test.ts.snap
@@ -178,66 +178,21 @@ Object {
       "field": "service.environment",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
 }
 `;
 
@@ -288,66 +243,21 @@ Object {
       "field": "service.name",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
 }
 `;
 
@@ -393,66 +303,21 @@ Object {
       "fixed_interval": "1m",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
   "transaction.name": Object {
     "terms": Object {
       "field": "transaction.name",
@@ -503,66 +368,21 @@ Object {
       "fixed_interval": "1m",
     },
   },
-  "slo.budgetingMethod": Object {
-    "terms": Object {
-      "field": "slo.budgetingMethod",
-    },
-  },
-  "slo.description": Object {
-    "terms": Object {
-      "field": "slo.description",
-    },
-  },
-  "slo.groupBy": Object {
-    "terms": Object {
-      "field": "slo.groupBy",
-    },
-  },
   "slo.id": Object {
     "terms": Object {
       "field": "slo.id",
     },
   },
-  "slo.indicator.type": Object {
-    "terms": Object {
-      "field": "slo.indicator.type",
-    },
-  },
   "slo.instanceId": Object {
     "terms": Object {
       "field": "slo.instanceId",
     },
   },
-  "slo.name": Object {
-    "terms": Object {
-      "field": "slo.name",
-    },
-  },
-  "slo.objective.target": Object {
-    "terms": Object {
-      "field": "slo.objective.target",
-    },
-  },
   "slo.revision": Object {
     "terms": Object {
       "field": "slo.revision",
     },
   },
-  "slo.tags": Object {
-    "terms": Object {
-      "field": "slo.tags",
-    },
-  },
-  "slo.timeWindow.duration": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.duration",
-    },
-  },
-  "slo.timeWindow.type": Object {
-    "terms": Object {
-      "field": "slo.timeWindow.type",
-    },
-  },
   "transaction.type": Object {
     "terms": Object {
       "field": "transaction.type",
@@ -576,11 +396,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -629,71 +449,26 @@ Object {
           "field": "service.name",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
       "transaction.name": Object {
         "terms": Object {
           "field": "transaction.name",
@@ -759,84 +534,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.apm.transactionErrorRate')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -854,11 +575,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -898,66 +619,21 @@ Object {
           "field": "service.name",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
       "transaction.name": Object {
         "terms": Object {
           "field": "transaction.name",
@@ -1023,78 +699,24 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('occurrences')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.apm.transactionErrorRate')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.999)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/histogram.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/histogram.test.ts.snap
index cdbdd8c5270432..900093be8f78ee 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/histogram.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/histogram.test.ts.snap
@@ -77,11 +77,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -151,71 +151,26 @@ Object {
           "fixed_interval": "2m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -253,84 +208,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.histogram.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -348,11 +249,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -413,66 +314,21 @@ Object {
           "fixed_interval": "1m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -510,78 +366,24 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('occurrences')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.histogram.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.999)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/kql_custom.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/kql_custom.test.ts.snap
index 27da87629465d2..c207f1c21c2a94 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/kql_custom.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/kql_custom.test.ts.snap
@@ -118,11 +118,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -166,71 +166,26 @@ Object {
           "fixed_interval": "2m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -268,84 +223,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.kql.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -363,11 +264,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -402,66 +303,21 @@ Object {
           "fixed_interval": "1m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -499,78 +355,24 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('occurrences')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.kql.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.999)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/metric_custom.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/metric_custom.test.ts.snap
index 55ed414bd2ec7e..6e633758bb3d68 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/metric_custom.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/metric_custom.test.ts.snap
@@ -117,11 +117,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -203,71 +203,26 @@ Object {
           "fixed_interval": "2m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -305,84 +260,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.metric.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -400,11 +301,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -477,66 +378,21 @@ Object {
           "fixed_interval": "1m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -574,78 +430,24 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('occurrences')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.metric.custom')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.999)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap
index e2698ba3e17936..eaba259a5992b8 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap
@@ -33,11 +33,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -173,71 +173,26 @@ Object {
           "fixed_interval": "2m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -272,84 +227,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.metric.timeslice')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
@@ -367,11 +268,11 @@ Object {
   "_meta": Object {
     "managed": true,
     "managed_by": "observability",
-    "version": 2,
+    "version": 3,
   },
   "description": "Rolled-up SLI data for SLO: irrelevant",
   "dest": Object {
-    "index": ".slo-observability.sli-v2",
+    "index": ".slo-observability.sli-v3",
     "pipeline": ".slo-observability.sli.pipeline",
   },
   "frequency": "1m",
@@ -507,71 +408,26 @@ Object {
           "fixed_interval": "2m",
         },
       },
-      "slo.budgetingMethod": Object {
-        "terms": Object {
-          "field": "slo.budgetingMethod",
-        },
-      },
-      "slo.description": Object {
-        "terms": Object {
-          "field": "slo.description",
-        },
-      },
-      "slo.groupBy": Object {
-        "terms": Object {
-          "field": "slo.groupBy",
-        },
-      },
       "slo.id": Object {
         "terms": Object {
           "field": "slo.id",
         },
       },
-      "slo.indicator.type": Object {
-        "terms": Object {
-          "field": "slo.indicator.type",
-        },
-      },
       "slo.instanceId": Object {
         "terms": Object {
           "field": "slo.instanceId",
         },
       },
-      "slo.name": Object {
-        "terms": Object {
-          "field": "slo.name",
-        },
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "terms": Object {
           "field": "slo.objective.sliceDurationInSeconds",
         },
       },
-      "slo.objective.target": Object {
-        "terms": Object {
-          "field": "slo.objective.target",
-        },
-      },
       "slo.revision": Object {
         "terms": Object {
           "field": "slo.revision",
         },
       },
-      "slo.tags": Object {
-        "terms": Object {
-          "field": "slo.tags",
-        },
-      },
-      "slo.timeWindow.duration": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.duration",
-        },
-      },
-      "slo.timeWindow.type": Object {
-        "terms": Object {
-          "field": "slo.timeWindow.type",
-        },
-      },
     },
   },
   "settings": Object {
@@ -606,84 +462,30 @@ Object {
       },
     },
     "runtime_mappings": Object {
-      "slo.budgetingMethod": Object {
-        "script": Object {
-          "source": "emit('timeslices')",
-        },
-        "type": "keyword",
-      },
-      "slo.description": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
-      "slo.groupBy": Object {
-        "script": Object {
-          "source": "emit('*')",
-        },
-        "type": "keyword",
-      },
       "slo.id": Object {
         "script": Object {
           "source": Any<String>,
         },
         "type": "keyword",
       },
-      "slo.indicator.type": Object {
-        "script": Object {
-          "source": "emit('sli.metric.timeslice')",
-        },
-        "type": "keyword",
-      },
       "slo.instanceId": Object {
         "script": Object {
           "source": "emit('*')",
         },
         "type": "keyword",
       },
-      "slo.name": Object {
-        "script": Object {
-          "source": "emit('irrelevant')",
-        },
-        "type": "keyword",
-      },
       "slo.objective.sliceDurationInSeconds": Object {
         "script": Object {
           "source": "emit(120)",
         },
         "type": "long",
       },
-      "slo.objective.target": Object {
-        "script": Object {
-          "source": "emit(0.98)",
-        },
-        "type": "double",
-      },
       "slo.revision": Object {
         "script": Object {
           "source": "emit(1)",
         },
         "type": "long",
       },
-      "slo.tags": Object {
-        "script": Object {
-          "source": "emit('critical,k8s')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.duration": Object {
-        "script": Object {
-          "source": "emit('7d')",
-        },
-        "type": "keyword",
-      },
-      "slo.timeWindow.type": Object {
-        "script": Object {
-          "source": "emit('rolling')",
-        },
-        "type": "keyword",
-      },
     },
   },
   "sync": Object {
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/transform_generator.ts b/x-pack/plugins/observability/server/services/slo/transform_generators/transform_generator.ts
index 42572e61b38abb..66d75467836e12 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/transform_generator.ts
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/transform_generator.ts
@@ -32,12 +32,6 @@ export abstract class TransformGenerator {
           source: `emit(${slo.revision})`,
         },
       },
-      'slo.groupBy': {
-        type: 'keyword',
-        script: {
-          source: `emit('${!!slo.groupBy ? slo.groupBy : ALL_VALUE}')`,
-        },
-      },
       ...(mustIncludeAllInstanceId && {
         'slo.instanceId': {
           type: 'keyword',
@@ -46,36 +40,6 @@ export abstract class TransformGenerator {
           },
         },
       }),
-      'slo.name': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.name}')`,
-        },
-      },
-      'slo.description': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.description}')`,
-        },
-      },
-      'slo.tags': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.tags}')`,
-        },
-      },
-      'slo.indicator.type': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.indicator.type}')`,
-        },
-      },
-      'slo.objective.target': {
-        type: 'double',
-        script: {
-          source: `emit(${slo.objective.target})`,
-        },
-      },
       ...(slo.objective.timesliceWindow && {
         'slo.objective.sliceDurationInSeconds': {
           type: 'long',
@@ -84,24 +48,6 @@ export abstract class TransformGenerator {
           },
         },
       }),
-      'slo.budgetingMethod': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.budgetingMethod}')`,
-        },
-      },
-      'slo.timeWindow.duration': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.timeWindow.duration.format()}')`,
-        },
-      },
-      'slo.timeWindow.type': {
-        type: 'keyword',
-        script: {
-          source: `emit('${slo.timeWindow.type}')`,
-        },
-      },
     };
   }
 
@@ -125,21 +71,12 @@ export abstract class TransformGenerator {
     return {
       'slo.id': { terms: { field: 'slo.id' } },
       'slo.revision': { terms: { field: 'slo.revision' } },
-      'slo.groupBy': { terms: { field: 'slo.groupBy' } },
       'slo.instanceId': { terms: { field: instanceIdField } },
-      'slo.name': { terms: { field: 'slo.name' } },
-      'slo.description': { terms: { field: 'slo.description' } },
-      'slo.tags': { terms: { field: 'slo.tags' } },
-      'slo.indicator.type': { terms: { field: 'slo.indicator.type' } },
-      'slo.objective.target': { terms: { field: 'slo.objective.target' } },
       ...(slo.objective.timesliceWindow && {
         'slo.objective.sliceDurationInSeconds': {
           terms: { field: 'slo.objective.sliceDurationInSeconds' },
         },
       }),
-      'slo.budgetingMethod': { terms: { field: 'slo.budgetingMethod' } },
-      'slo.timeWindow.duration': { terms: { field: 'slo.timeWindow.duration' } },
-      'slo.timeWindow.type': { terms: { field: 'slo.timeWindow.type' } },
       ...extraGroupByFields,
       // @timestamp field defined in the destination index
       '@timestamp': {
diff --git a/x-pack/plugins/observability/server/services/slo/update_slo.test.ts b/x-pack/plugins/observability/server/services/slo/update_slo.test.ts
index 797f6eb2218ee0..2d1b588f215f37 100644
--- a/x-pack/plugins/observability/server/services/slo/update_slo.test.ts
+++ b/x-pack/plugins/observability/server/services/slo/update_slo.test.ts
@@ -8,7 +8,7 @@
 import { ElasticsearchClient } from '@kbn/core/server';
 import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
 import { UpdateSLOParams } from '@kbn/slo-schema';
-import { cloneDeep, pick, omit } from 'lodash';
+import { cloneDeep, omit, pick } from 'lodash';
 
 import {
   getSLOTransformId,
@@ -16,12 +16,14 @@ import {
   SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
 } from '../../assets/constants';
 import { SLO } from '../../domain/models';
-import { fiveMinute, oneMinute } from './fixtures/duration';
+import { fiveMinute, oneMinute, twoMinute } from './fixtures/duration';
 import {
   createAPMTransactionErrorRateIndicator,
   createSLO,
   createSLOWithTimeslicesBudgetingMethod,
+  createMetricCustomIndicator,
 } from './fixtures/slo';
+import { thirtyDaysRolling } from './fixtures/time_window';
 import { createSLORepositoryMock, createTransformManagerMock } from './mocks';
 import { SLORepository } from './slo_repository';
 import { TransformManager } from './transform_manager';
@@ -31,25 +33,23 @@ describe('UpdateSLO', () => {
   let mockRepository: jest.Mocked<SLORepository>;
   let mockTransformManager: jest.Mocked<TransformManager>;
   let mockEsClient: jest.Mocked<ElasticsearchClient>;
+  let mockSystemEsClient: jest.Mocked<ElasticsearchClient>;
   let updateSLO: UpdateSLO;
 
   beforeEach(() => {
     mockRepository = createSLORepositoryMock();
     mockTransformManager = createTransformManagerMock();
     mockEsClient = elasticsearchServiceMock.createElasticsearchClient();
-    updateSLO = new UpdateSLO(mockRepository, mockTransformManager, mockEsClient);
+    mockSystemEsClient = elasticsearchServiceMock.createElasticsearchClient();
+    updateSLO = new UpdateSLO(
+      mockRepository,
+      mockTransformManager,
+      mockEsClient,
+      mockSystemEsClient
+    );
   });
 
   describe('when the update payload does not change the original SLO', () => {
-    function expectNoCallsToAnyMocks() {
-      expect(mockTransformManager.stop).not.toBeCalled();
-      expect(mockTransformManager.uninstall).not.toBeCalled();
-      expect(mockTransformManager.install).not.toBeCalled();
-      expect(mockTransformManager.preview).not.toBeCalled();
-      expect(mockTransformManager.start).not.toBeCalled();
-      expect(mockEsClient.deleteByQuery).not.toBeCalled();
-    }
-
     it('returns early with a full identical SLO payload', async () => {
       const slo = createSLO();
       mockRepository.findById.mockResolvedValueOnce(slo);
@@ -157,11 +157,14 @@ describe('UpdateSLO', () => {
     });
   });
 
-  it('updates the settings correctly', async () => {
+  it("bumps the revision when changing 'settings'", async () => {
     const slo = createSLO();
     mockRepository.findById.mockResolvedValueOnce(slo);
+    const newSettings = {
+      syncDelay: twoMinute(),
+      frequency: fiveMinute(),
+    };
 
-    const newSettings = { ...slo.settings, timestamp_field: 'newField' };
     await updateSLO.execute(slo.id, { settings: newSettings });
 
     expectDeletionOfOriginalSLO(slo);
@@ -169,14 +172,14 @@ describe('UpdateSLO', () => {
       expect.objectContaining({
         ...slo,
         settings: newSettings,
-        revision: 2,
+        revision: slo.revision + 1,
         updatedAt: expect.anything(),
       })
     );
     expectInstallationOfNewSLOTransform();
   });
 
-  it('updates the budgeting method correctly', async () => {
+  it("bumps the revision when changing 'budgetingMethod'", async () => {
     const slo = createSLO({ budgetingMethod: 'occurrences' });
     mockRepository.findById.mockResolvedValueOnce(slo);
 
@@ -190,10 +193,23 @@ describe('UpdateSLO', () => {
     });
 
     expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        budgetingMethod: 'timeslices',
+        objective: {
+          target: slo.objective.target,
+          timesliceTarget: 0.9,
+          timesliceWindow: oneMinute(),
+        },
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
     expectInstallationOfNewSLOTransform();
   });
 
-  it('updates the timeslice target correctly', async () => {
+  it("bumps the revision when changing 'objective.timesliceTarget'", async () => {
     const slo = createSLOWithTimeslicesBudgetingMethod();
     mockRepository.findById.mockResolvedValueOnce(slo);
 
@@ -206,10 +222,22 @@ describe('UpdateSLO', () => {
     });
 
     expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        objective: {
+          target: slo.objective.target,
+          timesliceTarget: 0.1,
+          timesliceWindow: slo.objective.timesliceWindow,
+        },
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
     expectInstallationOfNewSLOTransform();
   });
 
-  it('consideres a timeslice window change as a breaking change', async () => {
+  it("bumps the revision when changing 'objective.timesliceWindow'", async () => {
     const slo = createSLOWithTimeslicesBudgetingMethod();
     mockRepository.findById.mockResolvedValueOnce(slo);
 
@@ -222,41 +250,165 @@ describe('UpdateSLO', () => {
     });
 
     expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        objective: {
+          target: slo.objective.target,
+          timesliceTarget: slo.objective.timesliceTarget,
+          timesliceWindow: fiveMinute(),
+        },
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
     expectInstallationOfNewSLOTransform();
   });
 
-  it('index a temporary summary document', async () => {
-    const slo = createSLO({
-      id: 'unique-id',
-      indicator: createAPMTransactionErrorRateIndicator({ environment: 'development' }),
-    });
+  it("bumps the revision when changing 'objective'", async () => {
+    const slo = createSLO();
     mockRepository.findById.mockResolvedValueOnce(slo);
 
-    const newIndicator = createAPMTransactionErrorRateIndicator({ environment: 'production' });
-    await updateSLO.execute(slo.id, { indicator: newIndicator });
+    await updateSLO.execute(slo.id, {
+      objective: {
+        target: 0.5,
+      },
+    });
 
-    expect(mockEsClient.index.mock.calls[0]).toMatchSnapshot();
+    expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        objective: {
+          target: 0.5,
+        },
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
+    expectInstallationOfNewSLOTransform();
   });
 
-  it('removes the original data from the original SLO', async () => {
-    const slo = createSLO({
-      indicator: createAPMTransactionErrorRateIndicator({ environment: 'development' }),
+  it("bumps the revision when changing 'timeWindow'", async () => {
+    const slo = createSLO();
+    mockRepository.findById.mockResolvedValueOnce(slo);
+
+    await updateSLO.execute(slo.id, {
+      timeWindow: thirtyDaysRolling(),
     });
+
+    expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        timeWindow: thirtyDaysRolling(),
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
+    expectInstallationOfNewSLOTransform();
+  });
+
+  it("bumps the revision when changing 'groupBy'", async () => {
+    const slo = createSLO({ groupBy: 'labels.projectId' });
     mockRepository.findById.mockResolvedValueOnce(slo);
 
-    const newIndicator = createAPMTransactionErrorRateIndicator({ environment: 'production' });
-    await updateSLO.execute(slo.id, { indicator: newIndicator });
+    await updateSLO.execute(slo.id, {
+      groupBy: '*',
+    });
 
+    expectDeletionOfOriginalSLO(slo);
     expect(mockRepository.save).toBeCalledWith(
       expect.objectContaining({
         ...slo,
-        indicator: newIndicator,
-        revision: 2,
+        groupBy: '*',
+        revision: slo.revision + 1,
         updatedAt: expect.anything(),
       })
     );
     expectInstallationOfNewSLOTransform();
+  });
+
+  it("bumps the revision when changing 'indicator'", async () => {
+    const slo = createSLO();
+    mockRepository.findById.mockResolvedValueOnce(slo);
+
+    await updateSLO.execute(slo.id, {
+      indicator: createMetricCustomIndicator(),
+    });
+
     expectDeletionOfOriginalSLO(slo);
+    expect(mockRepository.save).toBeCalledWith(
+      expect.objectContaining({
+        ...slo,
+        indicator: createMetricCustomIndicator(),
+        revision: slo.revision + 1,
+        updatedAt: expect.anything(),
+      })
+    );
+    expectInstallationOfNewSLOTransform();
+  });
+
+  describe('when the revision does not bump', () => {
+    it('stores the updated SLO', async () => {
+      const slo = createSLO();
+      mockRepository.findById.mockResolvedValueOnce(slo);
+
+      await updateSLO.execute(slo.id, {
+        name: 'a new name',
+        description: 'a new description',
+        tags: ['some', 'new tags'],
+      });
+
+      expect(mockRepository.save).toBeCalledWith(
+        expect.objectContaining({
+          ...slo,
+          name: 'a new name',
+          description: 'a new description',
+          tags: ['some', 'new tags'],
+          revision: slo.revision,
+          updatedAt: expect.anything(),
+        })
+      );
+      expectNoCallsToAnyMocks();
+    });
+  });
+
+  describe('when the revision bumps', () => {
+    it('indexes a temporary summary document', async () => {
+      const slo = createSLO({
+        id: 'unique-id',
+        indicator: createAPMTransactionErrorRateIndicator({ environment: 'development' }),
+      });
+      mockRepository.findById.mockResolvedValueOnce(slo);
+
+      const newIndicator = createAPMTransactionErrorRateIndicator({ environment: 'production' });
+      await updateSLO.execute(slo.id, { indicator: newIndicator });
+
+      expect(mockEsClient.index.mock.calls[0]).toMatchSnapshot();
+      expect(mockSystemEsClient.enrich.executePolicy).toBeCalled();
+    });
+
+    it('removes the original data from the original SLO', async () => {
+      const slo = createSLO({
+        indicator: createAPMTransactionErrorRateIndicator({ environment: 'development' }),
+      });
+      mockRepository.findById.mockResolvedValueOnce(slo);
+
+      const newIndicator = createAPMTransactionErrorRateIndicator({ environment: 'production' });
+      await updateSLO.execute(slo.id, { indicator: newIndicator });
+
+      expect(mockRepository.save).toBeCalledWith(
+        expect.objectContaining({
+          ...slo,
+          indicator: newIndicator,
+          revision: 2,
+          updatedAt: expect.anything(),
+        })
+      );
+      expectInstallationOfNewSLOTransform();
+      expectDeletionOfOriginalSLO(slo);
+    });
   });
 
   describe('when error happens during the transform installation step', () => {
@@ -274,6 +426,7 @@ describe('UpdateSLO', () => {
       );
 
       expect(mockRepository.save).toHaveBeenCalledWith(slo);
+      expect(mockSystemEsClient.enrich.executePolicy).toHaveBeenCalled();
       expect(mockTransformManager.preview).not.toHaveBeenCalled();
       expect(mockTransformManager.start).not.toHaveBeenCalled();
       expect(mockTransformManager.stop).not.toHaveBeenCalled();
@@ -300,11 +453,21 @@ describe('UpdateSLO', () => {
         getSLOTransformId(slo.id, slo.revision + 1)
       );
       expect(mockRepository.save).toHaveBeenCalledWith(slo);
+      expect(mockSystemEsClient.enrich.executePolicy).toHaveBeenCalled();
       expect(mockTransformManager.stop).not.toHaveBeenCalled();
       expect(mockEsClient.deleteByQuery).not.toHaveBeenCalled();
     });
   });
 
+  function expectNoCallsToAnyMocks() {
+    expect(mockTransformManager.stop).not.toBeCalled();
+    expect(mockTransformManager.uninstall).not.toBeCalled();
+    expect(mockTransformManager.install).not.toBeCalled();
+    expect(mockTransformManager.preview).not.toBeCalled();
+    expect(mockTransformManager.start).not.toBeCalled();
+    expect(mockEsClient.deleteByQuery).not.toBeCalled();
+  }
+
   function expectInstallationOfNewSLOTransform() {
     expect(mockTransformManager.install).toBeCalled();
     expect(mockTransformManager.preview).toBeCalled();
diff --git a/x-pack/plugins/observability/server/services/slo/update_slo.ts b/x-pack/plugins/observability/server/services/slo/update_slo.ts
index 97f6ed2e7bba3b..addf86584e47a8 100644
--- a/x-pack/plugins/observability/server/services/slo/update_slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/update_slo.ts
@@ -7,11 +7,12 @@
 
 import { ElasticsearchClient } from '@kbn/core/server';
 import { UpdateSLOParams, UpdateSLOResponse, updateSLOResponseSchema } from '@kbn/slo-schema';
-import { isEqual } from 'lodash';
+import { isEqual, pick } from 'lodash';
 import {
   getSLOTransformId,
   SLO_DESTINATION_INDEX_PATTERN,
   SLO_SUMMARY_DESTINATION_INDEX_PATTERN,
+  SLO_SUMMARY_ENRICH_POLICY_NAME,
   SLO_SUMMARY_TEMP_INDEX_NAME,
 } from '../../assets/constants';
 import { SLO } from '../../domain/models';
@@ -24,7 +25,8 @@ export class UpdateSLO {
   constructor(
     private repository: SLORepository,
     private transformManager: TransformManager,
-    private esClient: ElasticsearchClient
+    private esClient: ElasticsearchClient,
+    private systemClient: ElasticsearchClient
   ) {}
 
   public async execute(sloId: string, params: UpdateSLOParams): Promise<UpdateSLOResponse> {
@@ -37,23 +39,38 @@ export class UpdateSLO {
       return this.toResponse(originalSlo);
     }
 
+    const fields = [
+      'indicator',
+      'groupBy',
+      'timeWindow',
+      'objective',
+      'budgetingMethod',
+      'settings',
+    ];
+    const requireRevisionBump = !isEqual(pick(originalSlo, fields), pick(updatedSlo, fields));
+
     updatedSlo = Object.assign(updatedSlo, {
       updatedAt: new Date(),
-      revision: originalSlo.revision + 1,
+      revision: requireRevisionBump ? originalSlo.revision + 1 : originalSlo.revision,
     });
 
     validateSLO(updatedSlo);
-
-    const updatedSloTransformId = getSLOTransformId(updatedSlo.id, updatedSlo.revision);
     await this.repository.save(updatedSlo);
+    await this.systemClient.enrich.executePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME });
+
+    if (!requireRevisionBump) {
+      return this.toResponse(updatedSlo);
+    }
 
     try {
       await this.transformManager.install(updatedSlo);
     } catch (err) {
       await this.repository.save(originalSlo);
+      await this.systemClient.enrich.executePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME });
       throw err;
     }
 
+    const updatedSloTransformId = getSLOTransformId(updatedSlo.id, updatedSlo.revision);
     try {
       await this.transformManager.preview(updatedSloTransformId);
       await this.transformManager.start(updatedSloTransformId);
@@ -61,6 +78,7 @@ export class UpdateSLO {
       await Promise.all([
         this.transformManager.uninstall(updatedSloTransformId),
         this.repository.save(originalSlo),
+        this.systemClient.enrich.executePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME }),
       ]);
 
       throw err;
diff --git a/x-pack/plugins/observability/tsconfig.json b/x-pack/plugins/observability/tsconfig.json
index 4e2f8ef70482c5..57a1deb071337d 100644
--- a/x-pack/plugins/observability/tsconfig.json
+++ b/x-pack/plugins/observability/tsconfig.json
@@ -70,7 +70,6 @@
     "@kbn/exploratory-view-plugin",
     "@kbn/rison",
     "@kbn/io-ts-utils",
-    "@kbn/ml-anomaly-utils",
     "@kbn/observability-alert-details",
     "@kbn/ui-actions-plugin",
     "@kbn/field-types",
@@ -93,6 +92,7 @@
     "@kbn/react-kibana-context-theme",
     "@kbn/shared-ux-link-redirect-app",
     "@kbn/core-chrome-browser",
+    "@kbn/lens-embeddable-utils",
     "@kbn/serverless",
     "@kbn/dashboard-plugin"
   ],
diff --git a/x-pack/plugins/observability_ai_assistant/server/index.ts b/x-pack/plugins/observability_ai_assistant/server/index.ts
index a6747758268b01..8660446357e34b 100644
--- a/x-pack/plugins/observability_ai_assistant/server/index.ts
+++ b/x-pack/plugins/observability_ai_assistant/server/index.ts
@@ -7,7 +7,6 @@
 
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import type { ObservabilityAIAssistantConfig } from './config';
-import { ObservabilityAIAssistantPlugin } from './plugin';
 
 export type { ObservabilityAIAssistantServerRouteRepository } from './routes/get_global_observability_ai_assistant_route_repository';
 
@@ -38,5 +37,7 @@ export const config: PluginConfigDescriptor<ObservabilityAIAssistantConfig> = {
   schema: configSchema,
 };
 
-export const plugin = (ctx: PluginInitializerContext<ObservabilityAIAssistantConfig>) =>
-  new ObservabilityAIAssistantPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext<ObservabilityAIAssistantConfig>) => {
+  const { ObservabilityAIAssistantPlugin } = await import('./plugin');
+  return new ObservabilityAIAssistantPlugin(ctx);
+};
diff --git a/x-pack/plugins/observability_log_explorer/README.md b/x-pack/plugins/observability_log_explorer/README.md
index 604b33dd2b2886..8e6f910f2da4e2 100644
--- a/x-pack/plugins/observability_log_explorer/README.md
+++ b/x-pack/plugins/observability_log_explorer/README.md
@@ -1,3 +1,71 @@
 # Observability Log Explorer
 
 This plugin provides an app based on the `LogExplorer` component from the `log_explorer` plugin, but adds observability-specific affordances.
+
+## Testing
+
+### Stateful
+
+#### FTR Server
+```
+yarn test:ftr:server --config ./x-pack/test/functional/apps/observability_log_explorer/config.ts
+```
+
+#### FTR Runner
+```
+yarn test:ftr:runner --config ./x-pack/test/functional/apps/observability_log_explorer/config.ts --include ./x-pack/test/functional/apps/observability_log_explorer/index.ts
+```
+
+#### Running Individual Tests
+```
+yarn test:ftr:runner --config ./x-pack/test/functional/apps/observability_log_explorer/config.ts --include ./x-pack/test/functional/apps/observability_log_explorer/$1
+```
+
+### Serverless
+
+#### Server
+```
+yarn test:ftr:server --config ./x-pack/test_serverless/functional/test_suites/observability/config.ts
+```
+
+#### Runner
+```
+yarn test:ftr:runner --config ./x-pack/test_serverless/functional/test_suites/observability/config.ts --include ./x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/index.ts
+```
+#### Running Individual Tests
+```
+yarn test:ftr:runner --config ./x-pack/test_serverless/functional/test_suites/observability/config.ts --include ./x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/$1
+```
+
+## Checktypes
+
+#### Log Explorer
+```
+node scripts/type_check.js --project x-pack/plugins/log_explorer/tsconfig.json
+```
+#### Observability Log Explorer
+```
+node scripts/type_check.js --project x-pack/plugins/observability_log_explorer/tsconfig.json
+```
+
+### Generating Data using Synthtrace
+
+#### Logs Data only
+```
+node scripts/synthtrace simple_logs.ts --clean [--live]
+```
+
+#### Logs and Metrics Data
+```
+node scripts/synthtrace logs_and_metrics.ts --clean [--live]
+```
+
+### General Issues
+
+#### Kibana CI broken due to `kbn/optimiser` issue ?
+
+The limit is done to protect us in case we add some dependency that heavily impacts the bundle size, so this is not to be intended as a fix, but as a conscious update after double-checking the bundle size increase and see if it can be reduced
+
+```
+node scripts/build_kibana_platform_plugins --focus logExplorer --update-limits
+```
\ No newline at end of file
diff --git a/x-pack/plugins/observability_log_explorer/server/index.ts b/x-pack/plugins/observability_log_explorer/server/index.ts
index a487aefc8fd146..4d270d33f2e41a 100644
--- a/x-pack/plugins/observability_log_explorer/server/index.ts
+++ b/x-pack/plugins/observability_log_explorer/server/index.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-import { ObservabilityLogExplorerServerPlugin } from './plugin';
-
 export { config } from './config';
 
-export const plugin = () => new ObservabilityLogExplorerServerPlugin();
+export const plugin = async () => {
+  const { ObservabilityLogExplorerServerPlugin } = await import('./plugin');
+  return new ObservabilityLogExplorerServerPlugin();
+};
diff --git a/x-pack/plugins/observability_onboarding/public/application/app.tsx b/x-pack/plugins/observability_onboarding/public/application/app.tsx
index fc791436e38879..6142f7acd45cb3 100644
--- a/x-pack/plugins/observability_onboarding/public/application/app.tsx
+++ b/x-pack/plugins/observability_onboarding/public/application/app.tsx
@@ -16,9 +16,9 @@ import { i18n } from '@kbn/i18n';
 import {
   KibanaContextProvider,
   KibanaThemeProvider,
-  RedirectAppLinks,
   useUiSetting$,
 } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { HeaderMenuPortal } from '@kbn/observability-shared-plugin/public';
 import { Router, Routes, Route } from '@kbn/shared-ux-router';
 import { euiDarkVars, euiLightVars } from '@kbn/ui-theme';
@@ -149,46 +149,49 @@ export function ObservabilityOnboardingAppRoot({
   const renderFeedbackLinkAsPortal = !config.serverless.enabled;
 
   return (
-    <RedirectAppLinks
-      className={APP_WRAPPER_CLASS}
-      application={core.application}
-    >
-      <KibanaContextProvider
-        services={{
-          ...core,
-          ...plugins,
-          observability,
-          data,
-          config,
+    <div className={APP_WRAPPER_CLASS}>
+      <RedirectAppLinks
+        coreStart={{
+          application: core.application,
         }}
       >
-        <KibanaThemeProvider
-          theme$={theme$}
-          modify={{
-            breakpoint: {
-              xxl: 1600,
-              xxxl: 2000,
-            },
+        <KibanaContextProvider
+          services={{
+            ...core,
+            ...plugins,
+            observability,
+            data,
+            config,
           }}
         >
-          <i18nCore.Context>
-            <Router history={history}>
-              <EuiErrorBoundary>
-                {renderFeedbackLinkAsPortal && (
-                  <HeaderMenuPortal
-                    setHeaderActionMenu={setHeaderActionMenu}
-                    theme$={theme$}
-                  >
-                    <ObservabilityOnboardingHeaderActionMenu />
-                  </HeaderMenuPortal>
-                )}
-                <ObservabilityOnboardingApp />
-              </EuiErrorBoundary>
-            </Router>
-          </i18nCore.Context>
-        </KibanaThemeProvider>
-      </KibanaContextProvider>
-    </RedirectAppLinks>
+          <KibanaThemeProvider
+            theme$={theme$}
+            modify={{
+              breakpoint: {
+                xxl: 1600,
+                xxxl: 2000,
+              },
+            }}
+          >
+            <i18nCore.Context>
+              <Router history={history}>
+                <EuiErrorBoundary>
+                  {renderFeedbackLinkAsPortal && (
+                    <HeaderMenuPortal
+                      setHeaderActionMenu={setHeaderActionMenu}
+                      theme$={theme$}
+                    >
+                      <ObservabilityOnboardingHeaderActionMenu />
+                    </HeaderMenuPortal>
+                  )}
+                  <ObservabilityOnboardingApp />
+                </EuiErrorBoundary>
+              </Router>
+            </i18nCore.Context>
+          </KibanaThemeProvider>
+        </KibanaContextProvider>
+      </RedirectAppLinks>
+    </div>
   );
 }
 
diff --git a/x-pack/plugins/observability_onboarding/server/index.ts b/x-pack/plugins/observability_onboarding/server/index.ts
index ddc1c0ac79842f..c22e7e92efdb93 100644
--- a/x-pack/plugins/observability_onboarding/server/index.ts
+++ b/x-pack/plugins/observability_onboarding/server/index.ts
@@ -10,7 +10,6 @@ import {
   PluginConfigDescriptor,
   PluginInitializerContext,
 } from '@kbn/core/server';
-import { ObservabilityOnboardingPlugin } from './plugin';
 
 const configSchema = schema.object({
   ui: schema.object({
@@ -35,7 +34,8 @@ export const config: PluginConfigDescriptor<ObservabilityOnboardingConfig> = {
   schema: configSchema,
 };
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ObservabilityOnboardingPlugin } = await import('./plugin');
   return new ObservabilityOnboardingPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/observability_onboarding/tsconfig.json b/x-pack/plugins/observability_onboarding/tsconfig.json
index 4730fbe2560090..08ede6f201fc29 100644
--- a/x-pack/plugins/observability_onboarding/tsconfig.json
+++ b/x-pack/plugins/observability_onboarding/tsconfig.json
@@ -34,6 +34,7 @@
     "@kbn/share-plugin",
     "@kbn/deeplinks-observability",
     "@kbn/fleet-plugin",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/osquery/common/api/live_query/create_live_query_route.ts b/x-pack/plugins/osquery/common/api/live_query/create_live_query_route.ts
index 462490fdbae965..bd2187ec9494ed 100644
--- a/x-pack/plugins/osquery/common/api/live_query/create_live_query_route.ts
+++ b/x-pack/plugins/osquery/common/api/live_query/create_live_query_route.ts
@@ -13,6 +13,7 @@ import {
   packIdOrUndefined,
   queryOrUndefined,
   arrayQueries,
+  timeoutOrUndefined,
 } from '@kbn/osquery-io-ts-types';
 
 export const createLiveQueryRequestBodySchema = t.partial({
@@ -23,6 +24,7 @@ export const createLiveQueryRequestBodySchema = t.partial({
   query: queryOrUndefined,
   queries: arrayQueries,
   saved_query_id: savedQueryIdOrUndefined,
+  timeout: timeoutOrUndefined,
   ecs_mapping: ecsMappingOrUndefined,
   pack_id: packIdOrUndefined,
   alert_ids: t.array(t.string),
diff --git a/x-pack/plugins/osquery/common/api/saved_query/create_saved_query_route.ts b/x-pack/plugins/osquery/common/api/saved_query/create_saved_query_route.ts
index b55f9b62c02edc..22d70b6d284b03 100644
--- a/x-pack/plugins/osquery/common/api/saved_query/create_saved_query_route.ts
+++ b/x-pack/plugins/osquery/common/api/saved_query/create_saved_query_route.ts
@@ -18,6 +18,7 @@ import {
   snapshotOrUndefined,
   removedOrUndefined,
   ecsMappingOrUndefined,
+  timeoutOrUndefined,
 } from '@kbn/osquery-io-ts-types';
 
 export const createSavedQueryRequestSchema = t.type({
@@ -27,6 +28,7 @@ export const createSavedQueryRequestSchema = t.type({
   query,
   version: versionOrUndefined,
   interval,
+  timeout: timeoutOrUndefined,
   snapshot: snapshotOrUndefined,
   removed: removedOrUndefined,
   ecs_mapping: ecsMappingOrUndefined,
diff --git a/x-pack/plugins/osquery/common/api/saved_query/update_saved_query_route.ts b/x-pack/plugins/osquery/common/api/saved_query/update_saved_query_route.ts
index 274b52094b1b4a..e13014c28bb0de 100644
--- a/x-pack/plugins/osquery/common/api/saved_query/update_saved_query_route.ts
+++ b/x-pack/plugins/osquery/common/api/saved_query/update_saved_query_route.ts
@@ -7,12 +7,14 @@
 
 import * as t from 'io-ts';
 import { toNumberRt } from '@kbn/io-ts-utils';
+import { timeoutOrUndefined } from '@kbn/osquery-io-ts-types';
 
 export const updateSavedQueryRequestBodySchema = t.type({
   id: t.string,
   query: t.string,
   description: t.union([t.string, t.undefined]),
   interval: t.union([toNumberRt, t.undefined]),
+  timeout: timeoutOrUndefined,
   snapshot: t.union([t.boolean, t.undefined]),
   removed: t.union([t.boolean, t.undefined]),
   platform: t.union([t.string, t.undefined]),
diff --git a/x-pack/plugins/osquery/common/constants.ts b/x-pack/plugins/osquery/common/constants.ts
index fe3454090277a3..5887d783d4ce48 100644
--- a/x-pack/plugins/osquery/common/constants.ts
+++ b/x-pack/plugins/osquery/common/constants.ts
@@ -29,3 +29,8 @@ export const API_VERSIONS = {
     v1: '1',
   },
 };
+
+export enum QUERY_TIMEOUT {
+  DEFAULT = 60, // 60 seconds
+  MAX = 60 * 15,
+}
diff --git a/x-pack/plugins/osquery/common/search_strategy/osquery/actions/index.ts b/x-pack/plugins/osquery/common/search_strategy/osquery/actions/index.ts
index 283ae462694221..7fd4ea5d31b2c2 100644
--- a/x-pack/plugins/osquery/common/search_strategy/osquery/actions/index.ts
+++ b/x-pack/plugins/osquery/common/search_strategy/osquery/actions/index.ts
@@ -82,4 +82,5 @@ export interface ActionResultsStrategyResponse
 
 export interface ActionResultsRequestOptions extends RequestOptionsPaginated {
   actionId: string;
+  startDate?: string;
 }
diff --git a/x-pack/plugins/osquery/common/search_strategy/osquery/index.ts b/x-pack/plugins/osquery/common/search_strategy/osquery/index.ts
index 53508c17208b29..4ce3e0463696c8 100644
--- a/x-pack/plugins/osquery/common/search_strategy/osquery/index.ts
+++ b/x-pack/plugins/osquery/common/search_strategy/osquery/index.ts
@@ -14,20 +14,17 @@ import type {
   ActionResultsStrategyResponse,
   ActionResultsRequestOptions,
 } from './actions';
-import type { AgentsStrategyResponse, AgentsRequestOptions } from './agents';
 import type { ResultsStrategyResponse, ResultsRequestOptions } from './results';
 
 import type { SortField, PaginationInputPaginated } from '../common';
 
 export * from './actions';
-export * from './agents';
 export * from './results';
 
 export enum OsqueryQueries {
   actions = 'actions',
   actionDetails = 'actionDetails',
   actionResults = 'actionResults',
-  agents = 'agents',
   results = 'results',
 }
 
@@ -54,8 +51,6 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends Osquer
   ? ActionDetailsStrategyResponse
   : T extends OsqueryQueries.actionResults
   ? ActionResultsStrategyResponse
-  : T extends OsqueryQueries.agents
-  ? AgentsStrategyResponse
   : T extends OsqueryQueries.results
   ? ResultsStrategyResponse
   : never;
@@ -66,8 +61,6 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends Osquery
   ? ActionDetailsRequestOptions
   : T extends OsqueryQueries.actionResults
   ? ActionResultsRequestOptions
-  : T extends OsqueryQueries.agents
-  ? AgentsRequestOptions
   : T extends OsqueryQueries.results
   ? ResultsRequestOptions
   : never;
diff --git a/x-pack/plugins/osquery/common/search_strategy/osquery/results/index.ts b/x-pack/plugins/osquery/common/search_strategy/osquery/results/index.ts
index d7777e389dde84..c55577fb27354e 100644
--- a/x-pack/plugins/osquery/common/search_strategy/osquery/results/index.ts
+++ b/x-pack/plugins/osquery/common/search_strategy/osquery/results/index.ts
@@ -21,5 +21,6 @@ export interface ResultsStrategyResponse extends IEsSearchResponse {
 export interface ResultsRequestOptions extends Omit<RequestOptionsPaginated, 'sort'> {
   actionId: string;
   agentId?: string;
+  startDate?: string;
   sort: SortField[];
 }
diff --git a/x-pack/plugins/osquery/common/utils/aggregations.ts b/x-pack/plugins/osquery/common/utils/aggregations.ts
new file mode 100644
index 00000000000000..c4afef4025ce5d
--- /dev/null
+++ b/x-pack/plugins/osquery/common/utils/aggregations.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+interface BaseDataPoint {
+  key: string;
+  doc_count: number;
+}
+
+interface AggDataPoint extends estypes.AggregationsTermsAggregateBase {
+  buckets: AggregationDataPoint[];
+}
+
+type AggregationDataPoint = BaseDataPoint & {
+  [key: string]: AggDataPoint;
+};
+
+interface Aggs extends estypes.AggregationsTermsAggregateBase {
+  buckets: AggregationDataPoint[];
+}
+
+interface Group {
+  id: string;
+  name: string;
+  size: number;
+}
+
+interface Overlap {
+  [platform: string]: { [policy: string]: number };
+}
+
+export const processAggregations = (
+  aggs: Record<string, estypes.AggregationsAggregate> | undefined
+) => {
+  if (!aggs) {
+    return {
+      platforms: [],
+      overlap: {},
+      policies: [],
+    };
+  }
+
+  const platforms: Group[] = [];
+  const overlap: Overlap = {};
+  const platformTerms = aggs.platforms as Aggs;
+  const policyTerms = aggs.policies as Aggs;
+
+  const policies =
+    policyTerms?.buckets.map((o) => ({ name: o.key, id: o.key, size: o.doc_count })) ?? [];
+
+  if (platformTerms?.buckets) {
+    for (const { key, doc_count: size, policies: platformPolicies } of platformTerms.buckets) {
+      platforms.push({ name: key, id: key, size });
+      if (platformPolicies?.buckets && policies.length > 0) {
+        overlap[key] = platformPolicies.buckets.reduce((acc: { [key: string]: number }, pol) => {
+          acc[pol.key] = pol.doc_count;
+
+          return acc;
+        }, {} as { [key: string]: number });
+      }
+    }
+  }
+
+  return {
+    platforms,
+    overlap,
+    policies,
+  };
+};
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
index 6eae4381cf34be..90875bebc8384d 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
+import { LIVE_QUERY_EDITOR } from '../../screens/live_query';
 import {
   ADD_PACK_HEADER_BUTTON,
   ADD_QUERY_BUTTON,
   formFieldInputSelector,
+  SAVED_QUERY_DROPDOWN_SELECT,
   TABLE_ROWS,
 } from '../../screens/packs';
 import {
@@ -178,11 +180,15 @@ describe('ALL - Add Integration', { tags: ['@ess', '@serverless'] }, () => {
 
       navigateTo('app/osquery/packs');
       cy.getBySel(ADD_PACK_HEADER_BUTTON).click();
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+
       cy.get(formFieldInputSelector('name')).type(`${packName}{downArrow}{enter}`);
       cy.getBySel('policyIdsComboBox').type(`${policyName} {downArrow}{enter}`);
 
       cy.getBySel(ADD_QUERY_BUTTON).click();
-      cy.getBySel('savedQuerySelect').click().type('{downArrow}{enter}');
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel(LIVE_QUERY_EDITOR).should('exist');
+      cy.getBySel(SAVED_QUERY_DROPDOWN_SELECT).click().type('{downArrow}{enter}');
       cy.contains(/^Save$/).click();
       cy.contains(/^Save pack$/).click();
       cy.contains(`Successfully created "${packName}" pack`).click();
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
index 3c93bef865b96c..7f6f0a006e05b2 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
@@ -71,6 +71,7 @@ describe('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] }, () =>
       cy.contains(/^\d+ agen(t|ts) selected/);
       cy.contains('Run a set of queries in a pack').click();
       cy.get(OSQUERY_FLYOUT_BODY_EDITOR).should('not.exist');
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
       cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
       submitQuery();
       cy.get('[aria-label="Add to Case"]').first().click();
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
index a5f9fdab66a999..e43dbf4b5d4873 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
@@ -8,6 +8,7 @@
 import { navigateTo } from '../../tasks/navigation';
 import {
   checkResults,
+  fillInQueryTimeout,
   inputQuery,
   selectAllAgents,
   submitQuery,
@@ -36,13 +37,26 @@ describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
     cy.contains('Query is a required field').should('not.exist');
     checkResults();
     getAdvancedButton().click();
+    fillInQueryTimeout('91');
+    submitQuery();
+    cy.contains('Timeout value must be lower than 900 seconds.');
+    fillInQueryTimeout('89');
+    submitQuery();
+    cy.contains('Timeout value must be lower than 900 seconds.').should('not.exist');
     typeInOsqueryFieldInput('days{downArrow}{enter}');
     submitQuery();
     cy.contains('ECS field is required.');
     typeInECSFieldInput('message{downArrow}{enter}');
+
+    cy.intercept('POST', '/api/osquery/live_queries').as('postQuery');
     submitQuery();
     cy.contains('ECS field is required.').should('not.exist');
-
+    cy.wait('@postQuery').then((interception) => {
+      expect(interception.request.body).to.have.property('query', 'select * from uptime;');
+      expect(interception.request.body).to.have.property('timeout', 890);
+      expect(interception.response?.statusCode).to.eq(200);
+      expect(interception.response?.body.data.queries[0]).to.have.property('timeout', 890);
+    });
     checkResults();
     cy.get('[data-gridcell-column-index="0"][data-gridcell-row-index="0"]').should('exist').click();
     cy.url().should('include', 'app/fleet/agents/');
@@ -67,22 +81,22 @@ describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
       "where pos.remote_port !='0' {shift+enter}" +
       'limit 1000;';
     cy.contains('New live query').click();
-    cy.get(LIVE_QUERY_EDITOR).invoke('height').and('be.gt', 99).and('be.lt', 110);
-    cy.get(LIVE_QUERY_EDITOR).click().invoke('val', multilineQuery);
+    cy.getBySel(LIVE_QUERY_EDITOR).invoke('height').and('be.gt', 99).and('be.lt', 110);
+    cy.getBySel(LIVE_QUERY_EDITOR).click().invoke('val', multilineQuery);
 
     inputQuery(multilineQuery);
-    cy.get(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 220).and('be.lt', 300);
+    cy.getBySel(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 220).and('be.lt', 300);
     selectAllAgents();
     submitQuery();
     cy.getBySel('osqueryResultsPanel');
 
     // check if it get's bigger when we add more lines
-    cy.get(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 220).and('be.lt', 300);
+    cy.getBySel(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 220).and('be.lt', 300);
     inputQuery(multilineQuery);
-    cy.get(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 350).and('be.lt', 600);
+    cy.getBySel(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 350).and('be.lt', 600);
 
     inputQuery('{selectall}{backspace}{selectall}{backspace}');
     // not sure if this is how it used to work when I implemented the functionality, but let's leave it like this for now
-    cy.get(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 200).and('be.lt', 400);
+    cy.getBySel(LIVE_QUERY_EDITOR).invoke('height').should('be.gt', 200).and('be.lt', 400);
   });
 });
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/live_query_packs.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/live_query_packs.cy.ts
index 4269d0e3d79010..85ae94dd3266d3 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/live_query_packs.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/live_query_packs.cy.ts
@@ -29,18 +29,21 @@ describe('ALL - Live Query Packs', { tags: ['@ess', '@serverless'] }, () => {
         system_memory_linux_elastic: {
           ecs_mapping: {},
           interval: 3600,
+          timeout: 700,
           platform: 'linux',
           query: 'SELECT * FROM memory_info;',
         },
         system_info_elastic: {
           ecs_mapping: {},
           interval: 3600,
+          timeout: 200,
           platform: 'linux,windows,darwin',
           query: 'SELECT * FROM system_info;',
         },
         failingQuery: {
           ecs_mapping: {},
           interval: 10,
+          timeout: 90,
           query: 'select opera_extensions.* from users join opera_extensions using (uid);',
         },
       },
@@ -67,7 +70,7 @@ describe('ALL - Live Query Packs', { tags: ['@ess', '@serverless'] }, () => {
   it('should run live pack', () => {
     cy.contains('New live query').click();
     cy.contains('Run a set of queries in a pack.').click();
-    cy.get(LIVE_QUERY_EDITOR).should('not.exist');
+    cy.getBySel(LIVE_QUERY_EDITOR).should('not.exist');
     cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
     cy.contains('This table contains 3 rows.');
     cy.contains('system_memory_linux_elastic');
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/live_query_run.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/live_query_run.cy.ts
index 1200e3e6f610dc..035c228623fdae 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/live_query_run.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/live_query_run.cy.ts
@@ -99,7 +99,7 @@ describe('ALL - Live Query run custom and saved', { tags: ['@ess', '@serverless'
     navigateTo('/app/osquery');
     cy.get('[aria-label="Run query"]').first().should('be.visible').click();
 
-    cy.get(LIVE_QUERY_EDITOR).contains('select * from users;');
+    cy.getBySel(LIVE_QUERY_EDITOR).contains('select * from users;');
   });
 
   it('should open query details by clicking the details icon', () => {
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
index 64cb28d93d22c3..ca83482cea37b5 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
@@ -33,7 +33,7 @@ import {
   interceptPackId,
 } from '../../tasks/integrations';
 import { DEFAULT_POLICY } from '../../screens/fleet';
-import { getIdFormField } from '../../screens/live_query';
+import { getIdFormField, LIVE_QUERY_EDITOR } from '../../screens/live_query';
 import { loadSavedQuery, cleanupSavedQuery, cleanupPack, loadPack } from '../../tasks/api_fixtures';
 import { request } from '../../tasks/common';
 import { ServerlessRoleName } from '../../support/roles';
@@ -197,18 +197,21 @@ describe('Packs - Create and Edit', { tags: ['@ess', '@serverless'] }, () => {
       const queries = {
         Query1: {
           interval: 3600,
+          timeout: 60,
           query: 'select * from uptime;',
           removed: true,
           snapshot: false,
         },
         Query2: {
           interval: 3600,
+          timeout: 60,
           query: 'select * from uptime;',
           removed: false,
           snapshot: false,
         },
         Query3: {
           interval: 3600,
+          timeout: 60,
           query: 'select * from uptime;',
         },
       };
@@ -254,6 +257,8 @@ describe('Packs - Create and Edit', { tags: ['@ess', '@serverless'] }, () => {
       cy.getBySel(ADD_QUERY_BUTTON).click();
 
       cy.contains('Attach next query');
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel(LIVE_QUERY_EDITOR).should('exist');
       cy.getBySel(SAVED_QUERY_DROPDOWN_SELECT).type(`${savedQueryName}{downArrow}{enter}`);
       cy.getBySel('osquery-interval-field').click().clear().type('5');
       cy.getBySel(FLYOUT_SAVED_QUERY_SAVE_BUTTON).click();
@@ -367,6 +372,8 @@ describe('Packs - Create and Edit', { tags: ['@ess', '@serverless'] }, () => {
         cy.getBySel(ADD_QUERY_BUTTON).click();
 
         cy.contains('Attach next query');
+        cy.getBySel('globalLoadingIndicator').should('not.exist');
+        cy.getBySel(LIVE_QUERY_EDITOR).should('exist');
         cy.contains('ID must be unique').should('not.exist');
         cy.getBySel(SAVED_QUERY_DROPDOWN_SELECT).type(`${savedQueryName}{downArrow}{enter}`);
         cy.getBySel(FLYOUT_SAVED_QUERY_SAVE_BUTTON).click();
@@ -671,6 +678,8 @@ describe('Packs - Create and Edit', { tags: ['@ess', '@serverless'] }, () => {
 
         cy.getBySel(ADD_QUERY_BUTTON).click();
 
+        cy.getBySel('globalLoadingIndicator').should('not.exist');
+        cy.getBySel(LIVE_QUERY_EDITOR).should('exist');
         cy.getBySel(SAVED_QUERY_DROPDOWN_SELECT).type(
           `${multipleMappingsSavedQueryName} {downArrow} {enter}`
         );
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/packs_integration.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/packs_integration.cy.ts
index 73dc45837e2b37..9e10e1eb0d889e 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/packs_integration.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/packs_integration.cy.ts
@@ -162,7 +162,7 @@ describe('ALL - Packs', { tags: ['@ess', '@serverless'] }, () => {
         navigateTo('/app/osquery/live_queries');
         cy.contains('New live query').click();
         cy.contains('Run a set of queries in a pack.').click();
-        cy.get(LIVE_QUERY_EDITOR).should('not.exist');
+        cy.getBySel(LIVE_QUERY_EDITOR).should('not.exist');
         cy.getBySel('select-live-pack').click().type('osquery-monitoring{downArrow}{enter}');
         selectAllAgents();
         submitQuery();
@@ -224,6 +224,7 @@ describe('ALL - Packs', { tags: ['@ess', '@serverless'] }, () => {
         cy.getBySel('createAgentPolicyNameField').type(agentPolicy);
         cy.getBySel('createAgentPolicyFlyoutBtn').click();
         cy.contains(`Agent policy '${agentPolicy}' created`).click();
+        closeToastIfVisible();
         cy.contains(agentPolicy).click();
         cy.contains('Add integration').click();
         cy.getBySel('epmList.searchBar').type('osquery');
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/saved_queries.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/saved_queries.cy.ts
index 1319d4e173ec4a..6638567a926256 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/saved_queries.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/saved_queries.cy.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { LIVE_QUERY_EDITOR } from '../../screens/live_query';
 import {
   ADD_QUERY_BUTTON,
   customActionEditSavedQuerySelector,
@@ -142,7 +143,8 @@ describe('ALL - Saved queries', { tags: ['@ess', '@serverless'] }, () => {
       cy.getBySel(ADD_QUERY_BUTTON).click();
 
       cy.contains('Attach next query');
-
+      cy.getBySel('globalLoadingIndicator').should('not.exist');
+      cy.getBySel(LIVE_QUERY_EDITOR).should('exist');
       cy.getBySel(SAVED_QUERY_DROPDOWN_SELECT).click().type('users_elastic{downArrow} {enter}');
       inputQuery('where name=1');
       cy.getBySel('resultsTypeField').click();
diff --git a/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts b/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
index 470c8445304521..d512f5d5df5bb8 100644
--- a/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
@@ -113,7 +113,7 @@ describe(`T1 and T2 analysts`, { tags: ['@ess', '@serverless'] }, () => {
 
         cy.contains('New live query').click();
         selectAllAgents();
-        cy.get(LIVE_QUERY_EDITOR).should('not.exist');
+        cy.getBySel(LIVE_QUERY_EDITOR).should('not.exist');
         submitQuery();
         cy.contains('Query is a required field');
       });
diff --git a/x-pack/plugins/osquery/cypress/screens/live_query.ts b/x-pack/plugins/osquery/cypress/screens/live_query.ts
index 9dc543072fe074..04c56fbce44c7b 100644
--- a/x-pack/plugins/osquery/cypress/screens/live_query.ts
+++ b/x-pack/plugins/osquery/cypress/screens/live_query.ts
@@ -7,7 +7,7 @@
 
 export const AGENT_FIELD = '[data-test-subj="comboBoxInput"]';
 export const ALL_AGENTS_OPTION = '[title="All agents"]';
-export const LIVE_QUERY_EDITOR = '.kibanaCodeEditor';
+export const LIVE_QUERY_EDITOR = 'kibanaCodeEditor';
 export const OSQUERY_FLYOUT_BODY_EDITOR =
   '[data-test-subj="flyout-body-osquery"] .kibanaCodeEditor';
 export const SUBMIT_BUTTON = '#submit-button';
diff --git a/x-pack/plugins/osquery/cypress/tasks/live_query.ts b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
index 6a342246517ac0..cc9319633befcd 100644
--- a/x-pack/plugins/osquery/cypress/tasks/live_query.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
@@ -25,10 +25,10 @@ export const selectAllAgents = () => {
 };
 
 export const clearInputQuery = () =>
-  cy.get(LIVE_QUERY_EDITOR).click().type(`{selectall}{backspace}`);
+  cy.getBySel(LIVE_QUERY_EDITOR).click().type(`{selectall}{backspace}`);
 
 export const inputQuery = (query: string, options?: { parseSpecialCharSequences: boolean }) =>
-  cy.get(LIVE_QUERY_EDITOR).type(query, options);
+  cy.getBySel(LIVE_QUERY_EDITOR).type(query, options);
 
 export const inputQueryInFlyout = (
   query: string,
@@ -40,6 +40,12 @@ export const submitQuery = () => {
   cy.contains('Submit').click();
 };
 
+export const fillInQueryTimeout = (timeout: string) => {
+  cy.getBySel('advanced-accordion-content').within(() => {
+    cy.getBySel('timeout-input').clear().type(timeout);
+  });
+};
+
 // sometimes the results get stuck in the tests, this is a workaround
 export const checkResults = () => {
   cy.getBySel('osqueryResultsTable').then(($table) => {
diff --git a/x-pack/plugins/osquery/package.json b/x-pack/plugins/osquery/package.json
index 4e9070d780d281..a708e9a3830313 100644
--- a/x-pack/plugins/osquery/package.json
+++ b/x-pack/plugins/osquery/package.json
@@ -12,7 +12,7 @@
     "cypress:run": "yarn cypress run",
     "cypress:serverless": "NODE_OPTIONS=--openssl-legacy-provider node ../security_solution/scripts/start_cypress_parallel --config-file ../osquery/cypress/serverless_cypress.config.ts --ftr-config-file ../../../x-pack/test/osquery_cypress/serverless_cli_config",
     "cypress:serverless:open": "yarn cypress:serverless open",
-    "cypress:serverless:run": "yarn cypress:serverless run",
+    "cypress:serverless:run": "yarn cypress:serverless run --spec ./cypress/e2e/all/packs_integration.cy.ts",
     "nyc": "../../../node_modules/.bin/nyc report --reporter=text-summary",
     "junit:merge": "../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-osquery/cypress/results/mochawesome*.json > ../../../target/kibana-osquery/cypress/results/output.json && ../../../node_modules/.bin/marge ../../../target/kibana-osquery/cypress/results/output.json --reportDir ../../../target/kibana-osquery/cypress/results && yarn junit:transform && mkdir -p ../../../target/junit && cp ../../../target/kibana-osquery/cypress/results/*.xml ../../../target/junit/",
     "junit:transform": "node ../security_solution/scripts/junit_transformer --pathPattern '../../../target/kibana-osquery/cypress/results/*.xml' --rootDirectory ../../../ --reportName 'Osquery Cypress' --writeInPlace",
diff --git a/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
index 9bdd9bc5a45287..6b9581249a0754 100644
--- a/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
+++ b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
@@ -16,6 +16,7 @@ import { useActionResultsPrivileges } from './use_action_privileges';
 
 interface ActionResultsSummaryProps {
   actionId: string;
+  startDate?: string;
   expirationDate?: string;
   agentIds?: string[];
   error?: string;
@@ -32,6 +33,7 @@ const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
   expirationDate,
   agentIds,
   error,
+  startDate,
 }) => {
   const [pageIndex] = useState(0);
   const [pageSize] = useState(50);
@@ -46,6 +48,7 @@ const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
     data: { aggregations, edges },
   } = useActionResults({
     actionId,
+    startDate,
     activePage: pageIndex,
     agentIds,
     limit: pageSize,
@@ -158,7 +161,7 @@ const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
     setIsLive(() => {
       if (!agentIds?.length || expired || error) return false;
 
-      return !!(aggregations.totalResponded !== agentIds?.length);
+      return aggregations.totalResponded !== agentIds?.length;
     });
   }, [agentIds?.length, aggregations.totalResponded, error, expired]);
 
diff --git a/x-pack/plugins/osquery/public/action_results/use_action_results.ts b/x-pack/plugins/osquery/public/action_results/use_action_results.ts
index ef7dbad151d208..8c20e4ed1c6027 100644
--- a/x-pack/plugins/osquery/public/action_results/use_action_results.ts
+++ b/x-pack/plugins/osquery/public/action_results/use_action_results.ts
@@ -34,6 +34,7 @@ export interface ResultsArgs {
 export interface UseActionResults {
   actionId: string;
   activePage: number;
+  startDate?: string;
   agentIds?: string[];
   direction: Direction;
   limit: number;
@@ -51,6 +52,7 @@ export const useActionResults = ({
   limit,
   sortField,
   kuery,
+  startDate,
   skip = false,
   isLive = false,
 }: UseActionResults) => {
@@ -64,6 +66,7 @@ export const useActionResults = ({
         data.search.search<ActionResultsRequestOptions, ActionResultsStrategyResponse>(
           {
             actionId,
+            startDate,
             factoryQueryType: OsqueryQueries.actionResults,
             kuery,
             pagination: generateTablePaginationOptions(activePage, limit),
diff --git a/x-pack/plugins/osquery/public/agents/agent_grouper.ts b/x-pack/plugins/osquery/public/agents/agent_grouper.ts
index 156f09b5c130b7..1375c30437d60b 100644
--- a/x-pack/plugins/osquery/public/agents/agent_grouper.ts
+++ b/x-pack/plugins/osquery/public/agents/agent_grouper.ts
@@ -32,6 +32,7 @@ export const generateAgentOption = (
 ) => ({
   label,
   options: data.map((agent) => ({
+    disabled: agent.status !== 'online',
     label: `${agent.local_metadata.host.hostname} (${agent.local_metadata.elastic.agent.id})`,
     key: agent.local_metadata.elastic.agent.id,
     color: getColor(groupType),
diff --git a/x-pack/plugins/osquery/public/agents/agents_table.tsx b/x-pack/plugins/osquery/public/agents/agents_table.tsx
index 6bf041bf9d9d0c..f6b80e670f95b1 100644
--- a/x-pack/plugins/osquery/public/agents/agents_table.tsx
+++ b/x-pack/plugins/osquery/public/agents/agents_table.tsx
@@ -22,7 +22,7 @@ import useDebounce from 'react-use/lib/useDebounce';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { useKibana } from '../common/lib/kibana';
 import { useAllAgents } from './use_all_agents';
-import { useAgentGroups } from './use_agent_groups';
+
 import { AgentGrouper } from './agent_grouper';
 import {
   getNumAgentsInGrouping,
@@ -68,15 +68,9 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
     [searchValue]
   );
 
-  // grouping related
-  const {
-    isLoading: groupsLoading,
-    data: agentGroupsData,
-    isFetched: groupsFetched,
-  } = useAgentGroups();
   const {
     isLoading: agentsLoading,
-    data: agents,
+    data: agentList,
     isFetched: agentsFetched,
   } = useAllAgents(debouncedSearchValue, {
     perPage,
@@ -101,7 +95,7 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
         selectedGroups: SelectedGroups;
       } = generateAgentSelection(selection);
       if (newAgentSelection.allAgentsSelected) {
-        setNumAgentsSelected(agentGroupsData?.total ?? 0);
+        setNumAgentsSelected(agentList?.total ?? 0);
       } else {
         const checkAgent = generateAgentCheck(selectedGroups);
         setNumAgentsSelected(
@@ -110,14 +104,14 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
             // add the number of agents added via policy and platform groups
             getNumAgentsInGrouping(selectedGroups) -
             // subtract the number of agents double counted by policy/platform selections
-            getNumOverlapped(selectedGroups, agentGroupsData?.groups?.overlap ?? {})
+            getNumOverlapped(selectedGroups, agentList?.groups?.overlap ?? {})
         );
       }
 
       onChange(newAgentSelection);
       setSelectedOptions(selection);
     },
-    [agentGroupsData, onChange]
+    [agentList?.groups?.overlap, agentList?.total, onChange]
   );
 
   useEffect(() => {
@@ -159,24 +153,23 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
   }, [agentSelection, onSelection, options, selectedOptions]);
 
   useEffect(() => {
-    if (agentsFetched && groupsFetched && agentGroupsData) {
+    if (agentsFetched && agentList?.groups) {
       // Cap policies to 10 on init dropdown
-      const policies = (agentGroupsData?.groups.policies || []).slice(
+      const policies = (agentList.groups?.policies || []).slice(
         0,
         searchValue === '' ? 10 : undefined
       );
 
       const grouper = new AgentGrouper();
       // update the groups when groups or agents have changed
-      grouper.setTotalAgents(agentGroupsData?.total);
-      grouper.updateGroup(AGENT_GROUP_KEY.Platform, agentGroupsData?.groups.platforms);
+      grouper.setTotalAgents(agentList.total);
+      grouper.updateGroup(AGENT_GROUP_KEY.Platform, agentList?.groups?.platforms ?? []);
       grouper.updateGroup(AGENT_GROUP_KEY.Policy, policies);
-      // @ts-expect-error update types
-      grouper.updateGroup(AGENT_GROUP_KEY.Agent, agents);
+      grouper.updateGroup(AGENT_GROUP_KEY.Agent, agentList?.agents);
       const newOptions = grouper.generateOptions();
       setOptions((prevOptions) => (!deepEqual(prevOptions, newOptions) ? newOptions : prevOptions));
     }
-  }, [groupsLoading, agents, agentsFetched, groupsFetched, agentGroupsData, searchValue]);
+  }, [agentList?.agents, agentList?.groups, agentList?.total, agentsFetched, searchValue]);
 
   const renderOption = useCallback((option, searchVal, contentClassName) => {
     const { label, value } = option;
@@ -201,10 +194,9 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
     setModifyingSearch(v !== '');
     setSearchValue(v);
   }, []);
-  const isFetched = groupsFetched && agentsFetched && agentGroupsData;
 
   const renderNoAgentAvailableWarning = () => {
-    if (isFetched && !options.length) {
+    if (agentsFetched && agentList?.groups && !options.length) {
       return (
         <>
           <EuiCallOut color="danger" size="s" iconType="warning" title={NO_AGENT_AVAILABLE_TITLE}>
@@ -243,7 +235,7 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
           <EuiComboBox
             data-test-subj="agentSelection"
             placeholder={SELECT_AGENT_LABEL}
-            isLoading={groupsLoading || agentsLoading || modifyingSearch}
+            isLoading={agentsLoading || modifyingSearch}
             options={options}
             isClearable={true}
             fullWidth={true}
diff --git a/x-pack/plugins/osquery/public/agents/helpers.test.ts b/x-pack/plugins/osquery/public/agents/helpers.test.ts
index c69805b6f0dd74..067aebc57944e4 100644
--- a/x-pack/plugins/osquery/public/agents/helpers.test.ts
+++ b/x-pack/plugins/osquery/public/agents/helpers.test.ts
@@ -7,14 +7,10 @@
 
 import { v4 as uuidv4 } from 'uuid';
 import { generateGroupOption } from './agent_grouper';
-import {
-  getNumOverlapped,
-  getNumAgentsInGrouping,
-  processAggregations,
-  generateAgentSelection,
-} from './helpers';
+import { getNumOverlapped, getNumAgentsInGrouping, generateAgentSelection } from './helpers';
 import type { GroupOption, Overlap, SelectedGroups } from './types';
 import { AGENT_GROUP_KEY } from './types';
+import { processAggregations } from '../../common/utils/aggregations';
 
 describe('generateAgentSelection', () => {
   it('should handle empty input', () => {
diff --git a/x-pack/plugins/osquery/public/agents/helpers.ts b/x-pack/plugins/osquery/public/agents/helpers.ts
index 62ad37de506cb9..b84c6e4957286b 100644
--- a/x-pack/plugins/osquery/public/agents/helpers.ts
+++ b/x-pack/plugins/osquery/public/agents/helpers.ts
@@ -5,17 +5,14 @@
  * 2.0.
  */
 
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { euiPaletteColorBlindBehindText } from '@elastic/eui';
 import type {
-  SelectedGroups,
-  Overlap,
-  Group,
   AgentOptionValue,
-  AggregationDataPoint,
   AgentSelection,
-  GroupOptionValue,
   GroupOption,
+  GroupOptionValue,
+  Overlap,
+  SelectedGroups,
 } from './types';
 import { AGENT_GROUP_KEY } from './types';
 
@@ -34,49 +31,6 @@ export const getNumOverlapped = (
   return sum;
 };
 
-interface Aggs extends estypes.AggregationsTermsAggregateBase {
-  buckets: AggregationDataPoint[];
-}
-
-export const processAggregations = (
-  aggs: Record<string, estypes.AggregationsAggregate> | undefined
-) => {
-  if (!aggs) {
-    return {
-      platforms: [],
-      overlap: {},
-      policies: [],
-    };
-  }
-
-  const platforms: Group[] = [];
-  const overlap: Overlap = {};
-  const platformTerms = aggs.platforms as Aggs;
-  const policyTerms = aggs.policies as Aggs;
-
-  const policies =
-    policyTerms?.buckets.map((o) => ({ name: o.key, id: o.key, size: o.doc_count })) ?? [];
-
-  if (platformTerms?.buckets) {
-    for (const { key, doc_count: size, policies: platformPolicies } of platformTerms.buckets) {
-      platforms.push({ name: key, id: key, size });
-      if (platformPolicies?.buckets && policies.length > 0) {
-        overlap[key] = platformPolicies.buckets.reduce((acc: { [key: string]: number }, pol) => {
-          acc[pol.key] = pol.doc_count;
-
-          return acc;
-        }, {} as { [key: string]: number });
-      }
-    }
-  }
-
-  return {
-    platforms,
-    overlap,
-    policies,
-  };
-};
-
 export const generateColorPicker = () => {
   const visColorsBehindText = euiPaletteColorBlindBehindText();
   const typeColors = new Map<AGENT_GROUP_KEY, string>();
diff --git a/x-pack/plugins/osquery/public/agents/types.ts b/x-pack/plugins/osquery/public/agents/types.ts
index 71ebdc2983aefa..6f443641b227bc 100644
--- a/x-pack/plugins/osquery/public/agents/types.ts
+++ b/x-pack/plugins/osquery/public/agents/types.ts
@@ -5,23 +5,9 @@
  * 2.0.
  */
 
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
 import type { Agent } from '../../common/shared_imports';
 
-interface BaseDataPoint {
-  key: string;
-  doc_count: number;
-}
-
-interface AggDataPoint extends estypes.AggregationsTermsAggregateBase {
-  buckets: AggregationDataPoint[];
-}
-
-export type AggregationDataPoint = BaseDataPoint & {
-  [key: string]: AggDataPoint;
-};
-
 export interface Group {
   id: string;
   name: string;
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_groups.ts b/x-pack/plugins/osquery/public/agents/use_agent_groups.ts
deleted file mode 100644
index c7b72b489bbec3..00000000000000
--- a/x-pack/plugins/osquery/public/agents/use_agent_groups.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { useQuery } from '@tanstack/react-query';
-import { i18n } from '@kbn/i18n';
-import { lastValueFrom } from 'rxjs';
-import { useKibana } from '../common/lib/kibana';
-import { useAgentPolicies } from './use_agent_policies';
-
-import type { AgentsRequestOptions, AgentsStrategyResponse } from '../../common/search_strategy';
-import { OsqueryQueries } from '../../common/search_strategy';
-
-import { processAggregations } from './helpers';
-import { generateTablePaginationOptions } from '../common/helpers';
-import { useErrorToast } from '../common/hooks/use_error_toast';
-import { useOsqueryPolicies } from './use_osquery_policies';
-
-export const useAgentGroups = () => {
-  const { data } = useKibana().services;
-  const setErrorToast = useErrorToast();
-
-  const { data: osqueryPolicies, isFetched: isOsqueryPoliciesFetched } = useOsqueryPolicies();
-  const { agentPoliciesLoading, agentPolicyById } = useAgentPolicies(osqueryPolicies);
-
-  return useQuery<
-    AgentsStrategyResponse,
-    unknown,
-    {
-      total: number;
-      groups: ReturnType<typeof processAggregations>;
-    }
-  >(
-    ['agentGroups'],
-    async () => {
-      const policiesQuery = osqueryPolicies?.reduce((acc, policy) => `${acc} OR ${policy}`);
-
-      const responseData = await lastValueFrom(
-        data.search.search<AgentsRequestOptions, AgentsStrategyResponse>(
-          {
-            kuery: `policy_id: ( ${policiesQuery} )`,
-            factoryQueryType: OsqueryQueries.agents,
-            pagination: generateTablePaginationOptions(0, 9000),
-            sort: {
-              direction: 'asc',
-              field: 'local_metadata.os.platform',
-            },
-          } as AgentsRequestOptions,
-          {
-            strategy: 'osquerySearchStrategy',
-          }
-        )
-      );
-
-      return responseData;
-    },
-    {
-      select: (response) => {
-        const { platforms, overlap, policies } = processAggregations(
-          response.rawResponse.aggregations
-        );
-
-        return {
-          total: response.total ?? 0,
-          groups: {
-            platforms,
-            overlap,
-            policies: policies.map((p) => {
-              const name = agentPolicyById[p.id]?.name ?? p.name;
-
-              return {
-                ...p,
-                name,
-              };
-            }),
-          },
-        };
-      },
-      placeholderData: {
-        total: 0,
-        edges: [],
-        rawResponse: {
-          took: 0,
-          timed_out: false,
-          _shards: {
-            failed: 0,
-            successful: 0,
-            total: 0,
-          },
-          hits: {
-            hits: [],
-          },
-        },
-      },
-      refetchOnWindowFocus: false,
-      keepPreviousData: true,
-      enabled: isOsqueryPoliciesFetched && !agentPoliciesLoading,
-      onSuccess: () => setErrorToast(),
-      onError: (error) =>
-        setErrorToast(error as Error, {
-          title: i18n.translate('xpack.osquery.agent_groups.fetchError', {
-            defaultMessage: 'Error while fetching agent groups',
-          }),
-        }),
-    }
-  );
-};
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_policies.ts b/x-pack/plugins/osquery/public/agents/use_agent_policies.ts
deleted file mode 100644
index 235789ef548a3e..00000000000000
--- a/x-pack/plugins/osquery/public/agents/use_agent_policies.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { mapKeys } from 'lodash';
-import type { UseQueryResult } from '@tanstack/react-query';
-import { useQueries } from '@tanstack/react-query';
-import { i18n } from '@kbn/i18n';
-import type { GetOneAgentPolicyResponse } from '@kbn/fleet-plugin/common';
-import { API_VERSIONS } from '../../common/constants';
-import { useKibana } from '../common/lib/kibana';
-import { useErrorToast } from '../common/hooks/use_error_toast';
-
-export const useAgentPolicies = (policyIds: string[] = []) => {
-  const { http } = useKibana().services;
-  const setErrorToast = useErrorToast();
-
-  const agentResponse = useQueries({
-    queries: policyIds.map((policyId) => ({
-      queryKey: ['agentPolicy', policyId],
-      queryFn: () =>
-        http.get(`/internal/osquery/fleet_wrapper/agent_policies/${policyId}`, {
-          version: API_VERSIONS.internal.v1,
-        }),
-      enabled: policyIds.length > 0,
-      onSuccess: () => setErrorToast(),
-
-      onError: (error: Error) =>
-        setErrorToast(error, {
-          title: i18n.translate('xpack.osquery.action_policy_details.fetchError', {
-            defaultMessage: 'Error while fetching policy details',
-          }),
-        }),
-    })),
-  }) as Array<UseQueryResult<GetOneAgentPolicyResponse>>;
-
-  const agentPoliciesLoading = agentResponse.some((p) => p.isLoading);
-  const agentPolicies = agentResponse.map((p) => p.data?.item);
-  const agentPolicyById = mapKeys(agentPolicies, 'id');
-
-  return { agentPoliciesLoading, agentPolicies, agentPolicyById };
-};
diff --git a/x-pack/plugins/osquery/public/agents/use_all_agents.ts b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
index 98985b1c385050..d0ea65c6bab05b 100644
--- a/x-pack/plugins/osquery/public/agents/use_all_agents.ts
+++ b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
@@ -8,7 +8,8 @@
 import { i18n } from '@kbn/i18n';
 import { useQuery } from '@tanstack/react-query';
 
-import type { ListResult, Agent } from '@kbn/fleet-plugin/common';
+import type { Agent } from '@kbn/fleet-plugin/common';
+import type { processAggregations } from '../../common/utils/aggregations';
 import { API_VERSIONS } from '../../common/constants';
 import { useErrorToast } from '../common/hooks/use_error_toast';
 import { useKibana } from '../common/lib/kibana';
@@ -27,7 +28,11 @@ export const useAllAgents = (searchValue = '', opts: RequestOptions = { perPage:
 
   const { data: osqueryPolicies, isFetched } = useOsqueryPolicies();
 
-  return useQuery<Omit<ListResult<{}>, 'items'> & { agents: Agent[] }, unknown, Agent[]>(
+  return useQuery<{
+    agents: Agent[];
+    groups: ReturnType<typeof processAggregations>;
+    total: number;
+  }>(
     ['agents', osqueryPolicies, searchValue, perPage],
     () => {
       let kuery = '';
@@ -37,6 +42,8 @@ export const useAllAgents = (searchValue = '', opts: RequestOptions = { perPage:
 
         if (searchValue) {
           kuery += ` and (local_metadata.host.hostname:*${searchValue}* or local_metadata.elastic.agent.id:*${searchValue}*)`;
+        } else {
+          kuery += ` and (status:online)`;
         }
       }
 
@@ -49,7 +56,6 @@ export const useAllAgents = (searchValue = '', opts: RequestOptions = { perPage:
       });
     },
     {
-      select: (data) => data?.agents || [],
       enabled: isFetched && !!osqueryPolicies?.length,
       onSuccess: () => setErrorToast(),
       onError: (error) =>
diff --git a/x-pack/plugins/osquery/public/form/index.ts b/x-pack/plugins/osquery/public/form/index.ts
index 623477aaa0d16a..1da48659051668 100644
--- a/x-pack/plugins/osquery/public/form/index.ts
+++ b/x-pack/plugins/osquery/public/form/index.ts
@@ -10,3 +10,4 @@ export { QueryDescriptionField } from './query_description_field';
 export { IntervalField } from './interval_field';
 export { QueryIdField } from './query_id_field';
 export { ResultsTypeField } from './results_type_field';
+export { TimeoutField } from './timeout_field';
diff --git a/x-pack/plugins/osquery/public/form/timeout_field.tsx b/x-pack/plugins/osquery/public/form/timeout_field.tsx
new file mode 100644
index 00000000000000..a9ad26d11e1736
--- /dev/null
+++ b/x-pack/plugins/osquery/public/form/timeout_field.tsx
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React, { useCallback, useMemo } from 'react';
+import deepEqual from 'fast-deep-equal';
+import { useController } from 'react-hook-form';
+import type { EuiFieldNumberProps } from '@elastic/eui';
+import {
+  EuiFieldNumber,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIconTip,
+  EuiText,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+
+import { QUERY_TIMEOUT } from '../../common/constants';
+
+const timeoutFieldValidations = {
+  min: {
+    message: i18n.translate('xpack.osquery.pack.queryFlyoutForm.timeoutFieldMinNumberError', {
+      defaultMessage: 'Timeout value must be greater than {than} seconds.',
+      values: { than: QUERY_TIMEOUT.DEFAULT },
+    }),
+    value: QUERY_TIMEOUT.DEFAULT,
+  },
+  max: {
+    message: i18n.translate('xpack.osquery.pack.queryFlyoutForm.timeoutFieldMaxNumberError', {
+      defaultMessage: 'Timeout value must be lower than {than} seconds.',
+      values: { than: QUERY_TIMEOUT.MAX },
+    }),
+    value: QUERY_TIMEOUT.MAX,
+  },
+};
+
+interface TimeoutFieldProps {
+  euiFieldProps?: Record<string, unknown>;
+}
+
+const TimeoutFieldComponent = ({ euiFieldProps }: TimeoutFieldProps) => {
+  const {
+    field: { onChange, value },
+    fieldState: { error },
+  } = useController({
+    name: 'timeout',
+    defaultValue: QUERY_TIMEOUT.DEFAULT,
+    rules: {
+      ...timeoutFieldValidations,
+    },
+  });
+  const handleChange = useCallback(
+    (e: React.ChangeEvent<HTMLInputElement>) => {
+      const numberValue = e.target.valueAsNumber ? e.target.valueAsNumber : 0;
+      onChange(numberValue);
+    },
+    [onChange]
+  );
+  const hasError = useMemo(() => !!error?.message, [error?.message]);
+
+  return (
+    <EuiFormRow
+      label={
+        <EuiFlexGroup gutterSize="xs" alignItems="flexEnd">
+          <EuiFlexItem grow={false}>
+            <FormattedMessage id="xpack.osquery.liveQuery.timeout" defaultMessage="Timeout" />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiIconTip
+              content={i18n.translate('xpack.osquery.liveQuery.timeoutHint', {
+                defaultMessage: 'Maximum time to wait for query results, default is 60 seconds.',
+              })}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      }
+      fullWidth
+      error={error?.message}
+      isInvalid={hasError}
+      labelAppend={
+        <EuiFlexItem grow={false}>
+          <EuiText size="xs" color="subdued">
+            <FormattedMessage
+              id="xpack.osquery.osquery.liveQuery.timeoutFieldOptionalLabel"
+              defaultMessage="(optional)"
+            />
+          </EuiText>
+        </EuiFlexItem>
+      }
+    >
+      <EuiFieldNumber
+        isInvalid={hasError}
+        value={value as EuiFieldNumberProps['value']}
+        onChange={handleChange}
+        fullWidth
+        type="number"
+        data-test-subj="timeout-input"
+        name="timeout"
+        min={QUERY_TIMEOUT.DEFAULT}
+        max={QUERY_TIMEOUT.MAX}
+        defaultValue={QUERY_TIMEOUT.DEFAULT}
+        step={1}
+        append="seconds"
+        {...euiFieldProps}
+      />
+    </EuiFormRow>
+  );
+};
+
+export const TimeoutField = React.memo(TimeoutFieldComponent, deepEqual);
diff --git a/x-pack/plugins/osquery/public/live_queries/form/index.tsx b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
index 5f256b505043f3..287c8b25b45b14 100644
--- a/x-pack/plugins/osquery/public/live_queries/form/index.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
@@ -10,7 +10,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import type { ECSMapping } from '@kbn/osquery-io-ts-types';
 import React, { useCallback, useContext, useEffect, useMemo, useState } from 'react';
 import { useForm as useHookForm, FormProvider } from 'react-hook-form';
-import { isEmpty, find, pickBy } from 'lodash';
+import { isEmpty, find, pickBy, isNumber } from 'lodash';
 
 import {
   containsDynamicQuery,
@@ -39,6 +39,7 @@ export interface LiveQueryFormFields {
   savedQueryId?: string | null;
   ecs_mapping: ECSMapping;
   packId: string[];
+  timeout?: number;
   queryType: 'query' | 'pack';
 }
 
@@ -151,10 +152,10 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
           alert_ids: values.alertIds,
           pack_id: queryType === 'pack' && values?.packId?.length ? values?.packId[0] : undefined,
           ecs_mapping: values.ecs_mapping,
+          timeout: values.timeout,
         },
-        (value) => !isEmpty(value)
+        (value) => !isEmpty(value) || isNumber(value)
       ) as unknown as LiveQueryFormFields;
-
       await mutateAsync(serializedData);
     },
     [alertAttachmentContext, mutateAsync, queryType]
@@ -221,6 +222,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
       singleQueryDetails?.action_id ? (
         <ResultTabs
           actionId={singleQueryDetails?.action_id}
+          startDate={liveQueryDetails?.['@timestamp']}
           ecsMapping={serializedData.ecs_mapping}
           endDate={singleQueryDetails?.expiration}
           agentIds={singleQueryDetails?.agents}
@@ -231,6 +233,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
       singleQueryDetails?.action_id,
       singleQueryDetails?.expiration,
       singleQueryDetails?.agents,
+      liveQueryDetails,
       serializedData.ecs_mapping,
       liveQueryActionId,
     ]
diff --git a/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
index 100319f7c16a59..23ef0524dbb15d 100644
--- a/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
@@ -11,6 +11,8 @@ import { EuiCodeBlock, EuiFormRow, EuiAccordion, EuiSpacer } from '@elastic/eui'
 import React, { useCallback, useMemo, useState } from 'react';
 import { useController, useFormContext } from 'react-hook-form';
 import { i18n } from '@kbn/i18n';
+import { QUERY_TIMEOUT } from '../../../common/constants';
+import { TimeoutField } from '../../form/timeout_field';
 import type { LiveQueryFormFields } from '.';
 import { OsqueryEditor } from '../../editor';
 import { useKibana } from '../../common/lib/kibana';
@@ -68,6 +70,7 @@ const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({
         resetField('query', { defaultValue: savedQuery.query });
         resetField('savedQueryId', { defaultValue: savedQuery.savedQueryId });
         resetField('ecs_mapping', { defaultValue: savedQuery.ecs_mapping ?? {} });
+        resetField('timeout', { defaultValue: savedQuery.timeout ?? QUERY_TIMEOUT.DEFAULT });
 
         if (!isEmpty(savedQuery.ecs_mapping)) {
           setAdvancedContentState('open');
@@ -122,6 +125,7 @@ const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({
       {!isSavedQueryDisabled && (
         <SavedQueriesDropdown disabled={isSavedQueryDisabled} onChange={handleSavedQueryChange} />
       )}
+
       <EuiFormRow
         isInvalid={!!error?.message}
         error={error?.message}
@@ -155,6 +159,8 @@ const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({
           data-test-subj="advanced-accordion-content"
         >
           <EuiSpacer size="xs" />
+          <TimeoutField />
+          <EuiSpacer size="s" />
           <ECSMappingEditorField euiFieldProps={ecsFieldProps} />
         </EuiAccordion>
       )}
diff --git a/x-pack/plugins/osquery/public/packs/form/queries_field.tsx b/x-pack/plugins/osquery/public/packs/form/queries_field.tsx
index d40532bf808142..3e62a5639e1f7c 100644
--- a/x-pack/plugins/osquery/public/packs/form/queries_field.tsx
+++ b/x-pack/plugins/osquery/public/packs/form/queries_field.tsx
@@ -14,6 +14,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import deepEqual from 'fast-deep-equal';
 import { useController, useFormContext, useWatch, useFieldArray } from 'react-hook-form';
 
+import { QUERY_TIMEOUT } from '../../../common/constants';
 import { PackQueriesTable } from '../pack_queries_table';
 import { QueryFlyout } from '../queries/query_flyout';
 import { OsqueryPackUploader } from './pack_uploader';
@@ -84,6 +85,7 @@ const QueriesFieldComponent: React.FC<QueriesFieldProps> = ({ euiFieldProps }) =
               draft.id = updatedQuery.id;
               draft.interval = updatedQuery.interval;
               draft.query = updatedQuery.query;
+              draft.timeout = updatedQuery.timeout;
 
               if (updatedQuery.platform?.length) {
                 draft.platform = updatedQuery.platform;
@@ -137,6 +139,7 @@ const QueriesFieldComponent: React.FC<QueriesFieldProps> = ({ euiFieldProps }) =
             {
               id: newQueryId,
               interval: newQuery.interval ?? parsedContent.interval ?? '3600',
+              timeout: newQuery.timeout ?? parsedContent.timeout ?? QUERY_TIMEOUT.DEFAULT,
               query: newQuery.query,
               version: newQuery.version ?? parsedContent.version,
               snapshot: newQuery.snapshot ?? parsedContent.snapshot,
diff --git a/x-pack/plugins/osquery/public/packs/form/utils.ts b/x-pack/plugins/osquery/public/packs/form/utils.ts
index e04db1ed5b237c..c44fb468bb80d9 100644
--- a/x-pack/plugins/osquery/public/packs/form/utils.ts
+++ b/x-pack/plugins/osquery/public/packs/form/utils.ts
@@ -17,6 +17,7 @@ export const convertPackQueriesToSO = (queries: Record<string, Omit<PackQueryFor
         ...pick(value, [
           'query',
           'interval',
+          'timeout',
           'snapshot',
           'removed',
           'platform',
diff --git a/x-pack/plugins/osquery/public/packs/queries/query_flyout.tsx b/x-pack/plugins/osquery/public/packs/queries/query_flyout.tsx
index 8bc6e94ba790d7..751f53f91ece21 100644
--- a/x-pack/plugins/osquery/public/packs/queries/query_flyout.tsx
+++ b/x-pack/plugins/osquery/public/packs/queries/query_flyout.tsx
@@ -22,8 +22,14 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { FormProvider } from 'react-hook-form';
 
-import { DEFAULT_PLATFORM } from '../../../common/constants';
-import { QueryIdField, IntervalField, VersionField, ResultsTypeField } from '../../form';
+import { DEFAULT_PLATFORM, QUERY_TIMEOUT } from '../../../common/constants';
+import {
+  QueryIdField,
+  IntervalField,
+  VersionField,
+  ResultsTypeField,
+  TimeoutField,
+} from '../../form';
 import { CodeEditorField } from '../../saved_queries/form/code_editor_field';
 import { PlatformCheckBoxGroupField } from './platform_checkbox_group_field';
 import { ALL_OSQUERY_VERSIONS_OPTIONS } from './constants';
@@ -79,6 +85,9 @@ const QueryFlyoutComponent: React.FC<QueryFlyoutProps> = ({
         });
         resetField('version', { defaultValue: savedQuery.version ? [savedQuery.version] : [] });
         resetField('interval', { defaultValue: savedQuery.interval ? savedQuery.interval : 3600 });
+        resetField('timeout', {
+          defaultValue: savedQuery.timeout ? savedQuery.timeout : QUERY_TIMEOUT.DEFAULT,
+        });
         resetField('snapshot', { defaultValue: savedQuery.snapshot ?? true });
         resetField('removed', { defaultValue: savedQuery.removed });
         resetField('ecs_mapping', { defaultValue: savedQuery.ecs_mapping ?? {} });
@@ -146,9 +155,14 @@ const QueryFlyoutComponent: React.FC<QueryFlyoutProps> = ({
               <EuiSpacer />
               <ResultsTypeField />
             </EuiFlexItem>
-            <EuiFlexItem>
-              <PlatformCheckBoxGroupField />
-            </EuiFlexItem>
+            <EuiFlexGroup direction={'column'} justifyContent={'spaceBetween'}>
+              <EuiFlexItem>
+                <PlatformCheckBoxGroupField />
+              </EuiFlexItem>
+              <EuiFlexItem grow={0}>
+                <TimeoutField />
+              </EuiFlexItem>
+            </EuiFlexGroup>
           </EuiFlexGroup>
           <EuiSpacer />
           <EuiFlexGroup>
diff --git a/x-pack/plugins/osquery/public/packs/queries/use_pack_query_form.tsx b/x-pack/plugins/osquery/public/packs/queries/use_pack_query_form.tsx
index 1a0ecdbe71c59a..ea6f2a2105b414 100644
--- a/x-pack/plugins/osquery/public/packs/queries/use_pack_query_form.tsx
+++ b/x-pack/plugins/osquery/public/packs/queries/use_pack_query_form.tsx
@@ -11,6 +11,7 @@ import type { Draft } from 'immer';
 import { produce } from 'immer';
 import { useMemo } from 'react';
 import type { ECSMapping } from '@kbn/osquery-io-ts-types';
+import { QUERY_TIMEOUT } from '../../../common/constants';
 import type { Shard } from '../../../common/utils/converters';
 
 export interface UsePackQueryFormProps {
@@ -22,6 +23,7 @@ export interface PackSOQueryFormData {
   id: string;
   query: string;
   interval: string;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string | undefined;
@@ -37,6 +39,7 @@ export interface PackQueryFormData {
   description?: string;
   query: string;
   interval: number;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string | undefined;
@@ -48,6 +51,7 @@ const deserializer = (payload: PackSOQueryFormData): PackQueryFormData => ({
   id: payload.id,
   query: payload.query,
   interval: payload.interval ? parseInt(payload.interval, 10) : 3600,
+  timeout: payload.timeout || QUERY_TIMEOUT.DEFAULT,
   snapshot: payload.snapshot,
   removed: payload.removed,
   platform: payload.platform,
diff --git a/x-pack/plugins/osquery/public/results/results_table.tsx b/x-pack/plugins/osquery/public/results/results_table.tsx
index c74ca9d607dc1d..48a3e7f355a180 100644
--- a/x-pack/plugins/osquery/public/results/results_table.tsx
+++ b/x-pack/plugins/osquery/public/results/results_table.tsx
@@ -92,6 +92,7 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({
     data: { aggregations },
   } = useActionResults({
     actionId,
+    startDate,
     activePage: 0,
     agentIds,
     limit: 0,
@@ -140,6 +141,7 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({
 
   const { data: allResultsData, isLoading } = useAllResults({
     actionId,
+    startDate,
     activePage: pagination.pageIndex,
     limit: pagination.pageSize,
     isLive,
diff --git a/x-pack/plugins/osquery/public/results/use_all_results.ts b/x-pack/plugins/osquery/public/results/use_all_results.ts
index 09f18cfd2d17cc..8dca0d1ba4a871 100644
--- a/x-pack/plugins/osquery/public/results/use_all_results.ts
+++ b/x-pack/plugins/osquery/public/results/use_all_results.ts
@@ -33,6 +33,7 @@ export interface ResultsArgs {
 interface UseAllResults {
   actionId: string;
   activePage: number;
+  startDate?: string;
   limit: number;
   sort: Array<{ field: string; direction: Direction }>;
   kuery?: string;
@@ -43,6 +44,7 @@ interface UseAllResults {
 export const useAllResults = ({
   actionId,
   activePage,
+  startDate,
   limit,
   sort,
   kuery,
@@ -59,6 +61,7 @@ export const useAllResults = ({
         data.search.search<ResultsRequestOptions, ResultsStrategyResponse>(
           {
             actionId,
+            startDate,
             factoryQueryType: OsqueryQueries.results,
             kuery,
             pagination: generateTablePaginationOptions(activePage, limit),
diff --git a/x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx b/x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx
index e73dc404370cbb..c55bebcd9056be 100644
--- a/x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx
+++ b/x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx
@@ -63,6 +63,7 @@ const ResultTabsComponent: React.FC<ResultTabsProps> = ({
         'data-test-subj': 'osquery-status-tab',
         content: (
           <ActionResultsSummary
+            startDate={startDate}
             actionId={actionId}
             agentIds={agentIds}
             expirationDate={endDate}
diff --git a/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx b/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
index 767e323fa52544..b09acd4ae754d2 100644
--- a/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx
@@ -34,6 +34,7 @@ export interface SavedQuerySO {
   saved_object_id: string;
   description?: string;
   query: string;
+  timeout?: number;
   ecs_mapping: ECSMapping;
   updated_at: string;
   prebuilt?: boolean;
diff --git a/x-pack/plugins/osquery/public/saved_queries/form/index.tsx b/x-pack/plugins/osquery/public/saved_queries/form/index.tsx
index 0035fbd18f0400..8d5eea2f4ec22f 100644
--- a/x-pack/plugins/osquery/public/saved_queries/form/index.tsx
+++ b/x-pack/plugins/osquery/public/saved_queries/form/index.tsx
@@ -23,6 +23,7 @@ import {
   QueryDescriptionField,
   VersionField,
   ResultsTypeField,
+  TimeoutField,
 } from '../../form';
 import { PlatformCheckBoxGroupField } from '../../packs/queries/platform_checkbox_group_field';
 import { ALL_OSQUERY_VERSIONS_OPTIONS } from '../../packs/queries/constants';
@@ -89,12 +90,20 @@ const SavedQueryFormComponent: React.FC<SavedQueryFormProps> = ({
       <QueryDescriptionField euiFieldProps={euiFieldProps} />
       <EuiSpacer />
       <CodeEditorField euiFieldProps={euiFieldProps} />
+      <EuiSpacer size="m" />
+      <EuiFlexGroup justifyContent={'spaceBetween'}>
+        <EuiFlexItem>
+          <TimeoutField />
+        </EuiFlexItem>
+        <EuiFlexItem />
+      </EuiFlexGroup>
       <EuiSpacer size="xl" />
       <EuiFlexGroup>
         <EuiFlexItem css={overflowCss}>
           <ECSMappingEditorField euiFieldProps={euiFieldProps} />
         </EuiFlexItem>
       </EuiFlexGroup>
+
       {!viewMode && hasPlayground && (
         <EuiFlexGroup>
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/osquery/public/saved_queries/form/use_saved_query_form.tsx b/x-pack/plugins/osquery/public/saved_queries/form/use_saved_query_form.tsx
index 453fb9b87c6cd0..340541eb5d598f 100644
--- a/x-pack/plugins/osquery/public/saved_queries/form/use_saved_query_form.tsx
+++ b/x-pack/plugins/osquery/public/saved_queries/form/use_saved_query_form.tsx
@@ -11,6 +11,7 @@ import type { Draft } from 'immer';
 import produce from 'immer';
 import { useMemo } from 'react';
 import type { ECSMapping } from '@kbn/osquery-io-ts-types';
+import { QUERY_TIMEOUT } from '../../../common/constants';
 import { useSavedQueries } from '../use_saved_queries';
 
 export interface SavedQuerySOFormData {
@@ -18,6 +19,7 @@ export interface SavedQuerySOFormData {
   description?: string;
   query?: string;
   interval?: string;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string;
@@ -30,6 +32,7 @@ export interface SavedQueryFormData {
   description?: string;
   query?: string;
   interval?: number;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string;
@@ -46,6 +49,7 @@ const deserializer = (payload: SavedQuerySOFormData): SavedQueryFormData => ({
   description: payload.description,
   query: payload.query,
   interval: payload.interval ? parseInt(payload.interval, 10) : 3600,
+  timeout: payload.timeout ?? QUERY_TIMEOUT.DEFAULT,
   snapshot: payload.snapshot ?? true,
   removed: payload.removed ?? false,
   platform: payload.platform,
@@ -95,6 +99,7 @@ export const useSavedQueryForm = ({ defaultValue }: UseSavedQueryFormProps) => {
             id: '',
             query: '',
             interval: 3600,
+            timeout: QUERY_TIMEOUT.DEFAULT,
             ecs_mapping: {},
             snapshot: true,
           },
diff --git a/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx b/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
index 411813c655e241..690341fd2221fe 100644
--- a/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
+++ b/x-pack/plugins/osquery/public/saved_queries/saved_queries_dropdown.tsx
@@ -25,7 +25,7 @@ export interface SavedQueriesDropdownProps {
   disabled?: boolean;
   onChange: (
     value:
-      | (Pick<SavedQuerySO, 'id' | 'description' | 'query' | 'ecs_mapping'> & {
+      | (Pick<SavedQuerySO, 'id' | 'description' | 'query' | 'ecs_mapping' | 'timeout'> & {
           savedQueryId: string;
         })
       | null
diff --git a/x-pack/plugins/osquery/public/shared_components/osquery_response_action_type/index.tsx b/x-pack/plugins/osquery/public/shared_components/osquery_response_action_type/index.tsx
index 064e55d9350b26..cba12d5ef3e6e1 100644
--- a/x-pack/plugins/osquery/public/shared_components/osquery_response_action_type/index.tsx
+++ b/x-pack/plugins/osquery/public/shared_components/osquery_response_action_type/index.tsx
@@ -24,23 +24,27 @@ interface OsqueryResponseActionsValues {
   id?: string;
   ecsMapping?: ECSMapping;
   query?: string;
+  timeout: number;
   packId?: string;
   queries?: Array<{
     id: string;
     ecs_mapping: ECSMapping;
     query: string;
+    timeout?: number;
   }>;
 }
 
 interface OsqueryResponseActionsParamsFormFields {
   savedQueryId: string | null;
   ecs_mapping: ECSMapping;
+  timeout: number;
   query: string;
   packId?: string[];
   queries: Array<{
     id: string;
     ecs_mapping: ECSMapping;
     query: string;
+    timeout?: number;
   }>;
   queryType: 'query' | 'pack';
 }
@@ -115,6 +119,7 @@ const OsqueryResponseActionParamsFormComponent = ({
           : {
               savedQueryId: formData.savedQueryId,
               query: formData.query,
+              timeout: formData.timeout,
               ecsMapping: formData.ecs_mapping,
             }
       );
diff --git a/x-pack/plugins/osquery/server/common/types.ts b/x-pack/plugins/osquery/server/common/types.ts
index 999041c0debcf9..364d4d95328c7d 100644
--- a/x-pack/plugins/osquery/server/common/types.ts
+++ b/x-pack/plugins/osquery/server/common/types.ts
@@ -21,6 +21,7 @@ export interface PackSavedObject {
     name: string;
     query: string;
     interval: number;
+    timeout?: number;
     snapshot?: boolean;
     removed?: boolean;
     ecs_mapping?: Record<string, unknown>;
@@ -41,6 +42,7 @@ export interface SavedQuerySavedObject {
   description: string | undefined;
   query: string;
   interval: number | string;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform: string;
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts b/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
index d60c7bae8d9b34..79e0cdb2d2a481 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
@@ -7,7 +7,7 @@
 
 import { v4 as uuidv4 } from 'uuid';
 import moment from 'moment';
-import { filter, isEmpty, map, omit, pick, pickBy, some } from 'lodash';
+import { filter, isEmpty, isNumber, map, omit, pick, pickBy, some } from 'lodash';
 import type { SavedObjectsClientContract } from '@kbn/core/server';
 import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
 import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
@@ -17,7 +17,7 @@ import { parseAgentSelection } from '../../lib/parse_agent_groups';
 import { packSavedObjectType } from '../../../common/types';
 import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
 import { convertSOQueriesToPack } from '../../routes/pack/utils';
-import { ACTIONS_INDEX } from '../../../common/constants';
+import { ACTIONS_INDEX, QUERY_TIMEOUT } from '../../../common/constants';
 import { TELEMETRY_EBT_LIVE_QUERY_EVENT } from '../../lib/telemetry/constants';
 import type { PackSavedObject } from '../../common/types';
 import { CustomHttpRequestError } from '../../common/error';
@@ -100,9 +100,10 @@ export const createActionHandler = async (
               ecs_mapping: packQuery.ecs_mapping,
               version: packQuery.version,
               platform: packQuery.platform,
+              timeout: packQuery.timeout,
               agents: selectedAgents,
             },
-            (value) => !isEmpty(value)
+            (value) => !isEmpty(value) || isNumber(value)
           );
         })
       : await createDynamicQueries({
@@ -125,6 +126,7 @@ export const createActionHandler = async (
           input_type: 'osquery',
           agents: query.agents,
           user_id: metadata?.currentUser,
+          ...(query.timeout !== QUERY_TIMEOUT.DEFAULT ? { timeout: query.timeout } : {}),
           data: pick(query, ['id', 'query', 'ecs_mapping', 'version', 'platform']),
         })
       )
diff --git a/x-pack/plugins/osquery/server/handlers/action/create_queries.ts b/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
index 78092859a39900..cf7f2563b3fbba 100644
--- a/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
+++ b/x-pack/plugins/osquery/server/handlers/action/create_queries.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isEmpty, map, pickBy } from 'lodash';
+import { isEmpty, isNumber, map, pickBy } from 'lodash';
 import { v4 as uuidv4 } from 'uuid';
 
 import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
@@ -43,7 +43,7 @@ export const createDynamicQueries = async ({
             alert_ids: params.alert_ids,
             agents,
           },
-          (value) => !isEmpty(value) || value === true
+          (value) => !isEmpty(value) || value === true || isNumber(value)
         );
       })
     : [
@@ -61,10 +61,11 @@ export const createDynamicQueries = async ({
               : undefined,
             ecs_mapping: params.ecs_mapping,
             alert_ids: params.alert_ids,
+            timeout: params.timeout,
             agents,
             ...(error ? { error } : {}),
           },
-          (value) => !isEmpty(value)
+          (value) => !isEmpty(value) || isNumber(value)
         ),
       ];
 
diff --git a/x-pack/plugins/osquery/server/index.ts b/x-pack/plugins/osquery/server/index.ts
index 4f2c732620df98..f82552cec52fbf 100644
--- a/x-pack/plugins/osquery/server/index.ts
+++ b/x-pack/plugins/osquery/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { OsqueryPlugin } from './plugin';
 import type { ConfigType } from '../common/config';
 import { ConfigSchema } from '../common/config';
 
@@ -16,7 +15,9 @@ export const config: PluginConfigDescriptor<ConfigType> = {
     actionEnabled: true,
   },
 };
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { OsqueryPlugin } = await import('./plugin');
+
   return new OsqueryPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/osquery/server/lib/parse_agent_groups.ts b/x-pack/plugins/osquery/server/lib/parse_agent_groups.ts
index ab82b629f59eaa..723216a675fb43 100644
--- a/x-pack/plugins/osquery/server/lib/parse_agent_groups.ts
+++ b/x-pack/plugins/osquery/server/lib/parse_agent_groups.ts
@@ -49,7 +49,7 @@ export const parseAgentSelection = async (
   } = agentSelection;
   const agentService = context.service.getAgentService()?.asInternalUser;
   const packagePolicyService = context.service.getPackagePolicyService();
-  const kueryFragments = [];
+  const kueryFragments = ['status:online'];
 
   if (agentService && packagePolicyService) {
     const osqueryPolicies = await aggregateResults(async (page, perPage) => {
diff --git a/x-pack/plugins/osquery/server/lib/saved_query/saved_object_mappings.ts b/x-pack/plugins/osquery/server/lib/saved_query/saved_object_mappings.ts
index 70bee246ae886b..a28dc7bafae7fa 100644
--- a/x-pack/plugins/osquery/server/lib/saved_query/saved_object_mappings.ts
+++ b/x-pack/plugins/osquery/server/lib/saved_query/saved_object_mappings.ts
@@ -8,6 +8,11 @@
 import { produce } from 'immer';
 import type { SavedObjectsType } from '@kbn/core/server';
 import { SECURITY_SOLUTION_SAVED_OBJECT_INDEX } from '@kbn/core-saved-objects-server';
+import {
+  packAssetSavedObjectModelVersion1,
+  packSavedObjectModelVersion1,
+  savedQueryModelVersion1,
+} from './saved_object_model_versions';
 import {
   savedQuerySavedObjectType,
   packSavedObjectType,
@@ -67,6 +72,9 @@ export const savedQuerySavedObjectMappings: SavedObjectsType['mappings'] = {
     interval: {
       type: 'keyword',
     },
+    timeout: {
+      type: 'short',
+    },
     ecs_mapping: {
       dynamic: false,
       properties: {},
@@ -80,6 +88,9 @@ export const savedQueryType: SavedObjectsType = {
   hidden: false,
   namespaceType: 'multiple-isolated',
   mappings: savedQuerySavedObjectMappings,
+  modelVersions: {
+    1: savedQueryModelVersion1,
+  },
   management: {
     importableAndExportable: true,
     getTitle: (savedObject) => savedObject.attributes.id,
@@ -145,6 +156,9 @@ export const packSavedObjectMappings: SavedObjectsType['mappings'] = {
         interval: {
           type: 'text',
         },
+        timeout: {
+          type: 'short',
+        },
         platform: {
           type: 'keyword',
         },
@@ -166,6 +180,9 @@ export const packType: SavedObjectsType = {
   hidden: false,
   namespaceType: 'multiple-isolated',
   mappings: packSavedObjectMappings,
+  modelVersions: {
+    1: packSavedObjectModelVersion1,
+  },
   management: {
     defaultSearchField: 'name',
     importableAndExportable: true,
@@ -219,6 +236,9 @@ export const packAssetSavedObjectMappings: SavedObjectsType['mappings'] = {
         interval: {
           type: 'text',
         },
+        timeout: {
+          type: 'short',
+        },
         platform: {
           type: 'keyword',
         },
@@ -242,6 +262,9 @@ export const packAssetType: SavedObjectsType = {
     importableAndExportable: true,
     visibleInManagement: false,
   },
+  modelVersions: {
+    1: packAssetSavedObjectModelVersion1,
+  },
   namespaceType: 'agnostic',
   mappings: packAssetSavedObjectMappings,
 };
diff --git a/x-pack/plugins/osquery/server/lib/saved_query/saved_object_model_versions.ts b/x-pack/plugins/osquery/server/lib/saved_query/saved_object_model_versions.ts
new file mode 100644
index 00000000000000..9ab021c7f0cfca
--- /dev/null
+++ b/x-pack/plugins/osquery/server/lib/saved_query/saved_object_model_versions.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObjectsModelVersion } from '@kbn/core-saved-objects-server';
+
+export const savedQueryModelVersion1: SavedObjectsModelVersion = {
+  changes: [
+    {
+      type: 'mappings_addition',
+      addedMappings: {
+        timeout: { type: 'short' },
+      },
+    },
+  ],
+};
+
+export const packSavedObjectModelVersion1: SavedObjectsModelVersion = {
+  changes: [
+    {
+      type: 'mappings_addition',
+      addedMappings: {
+        queries: {
+          properties: {
+            timeout: { type: 'short' },
+          },
+        },
+      },
+    },
+  ],
+};
+
+export const packAssetSavedObjectModelVersion1: SavedObjectsModelVersion = {
+  changes: [
+    {
+      type: 'mappings_addition',
+      addedMappings: {
+        queries: {
+          properties: {
+            timeout: { type: 'short' },
+          },
+        },
+      },
+    },
+  ],
+};
diff --git a/x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agents.ts b/x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agents.ts
index 44ce43305e697b..c930bb4d9ffe56 100644
--- a/x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agents.ts
+++ b/x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agents.ts
@@ -6,10 +6,18 @@
  */
 
 import type { IRouter } from '@kbn/core/server';
+import type { ListWithKuery } from '@kbn/fleet-plugin/server/types';
+import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
+import { filter, map, mapKeys, uniq } from 'lodash';
+import type { PackagePolicy } from '@kbn/fleet-plugin/server/types';
+import { satisfies } from 'semver';
+import type { SortResults } from '@elastic/elasticsearch/lib/api/types';
+import { processAggregations } from '../../../common/utils/aggregations';
+import { getInternalSavedObjectsClient } from '../utils';
 import { getAgentsRequestQuerySchema } from '../../../common/api';
 import type { GetAgentsRequestQuerySchema } from '../../../common/api';
 import { buildRouteValidation } from '../../utils/build_validation/route_validation';
-import { API_VERSIONS } from '../../../common/constants';
+import { API_VERSIONS, OSQUERY_INTEGRATION_NAME } from '../../../common/constants';
 import { PLUGIN_ID } from '../../../common';
 import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
 
@@ -33,17 +41,89 @@ export const getAgentsRoute = (router: IRouter, osqueryContext: OsqueryAppContex
         },
       },
       async (context, request, response) => {
-        let agents;
+        let esAgents;
+        const query = request.query as ListWithKuery & {
+          showInactive: boolean;
+          searchAfter?: SortResults;
+          pitId?: string;
+          getStatusSummary?: boolean;
+        };
         try {
-          agents = await osqueryContext.service
-            .getAgentService()
-            ?.asInternalUser // @ts-expect-error update types
-            .listAgents(request.query);
+          esAgents = await osqueryContext.service.getAgentService()?.asInternalUser.listAgents({
+            page: query.page,
+            perPage: query.perPage,
+            sortField: query.sortField,
+            sortOrder: query.sortOrder,
+            showUpgradeable: query.showUpgradeable,
+            getStatusSummary: query.getStatusSummary,
+            pitId: query.pitId,
+            searchAfter: query.searchAfter,
+            kuery: query.kuery,
+            showInactive: query.showInactive,
+            aggregations: {
+              platforms: {
+                terms: {
+                  field: 'local_metadata.os.platform',
+                },
+              },
+              policies: {
+                terms: {
+                  field: 'policy_id',
+                  size: 2000,
+                },
+              },
+            },
+          });
         } catch (error) {
           return response.badRequest({ body: error });
         }
 
-        return response.ok({ body: agents });
+        const internalSavedObjectsClient = await getInternalSavedObjectsClient(
+          osqueryContext.getStartServices
+        );
+        const packagePolicyService = osqueryContext.service.getPackagePolicyService();
+        const agentPolicyService = osqueryContext.service.getAgentPolicyService();
+
+        const { items: packagePolicies } = (await packagePolicyService?.list(
+          internalSavedObjectsClient,
+          {
+            kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:${OSQUERY_INTEGRATION_NAME}`,
+            perPage: 1000,
+            page: 1,
+          }
+        )) ?? { items: [] as PackagePolicy[] };
+        const supportedPackagePolicyIds = filter(packagePolicies, (packagePolicy) =>
+          satisfies(packagePolicy.package?.version ?? '', '>=0.6.0')
+        );
+        const agentPolicyIds = uniq(map(supportedPackagePolicyIds, 'policy_id'));
+
+        const agentPolicies = await agentPolicyService?.getByIds(
+          internalSavedObjectsClient,
+          agentPolicyIds
+        );
+
+        const agentPolicyById = mapKeys(agentPolicies, 'id');
+
+        const { platforms, overlap, policies } = processAggregations(esAgents?.aggregations);
+
+        return response.ok({
+          body: {
+            total: esAgents?.total ?? 0,
+            groups: {
+              platforms,
+              overlap,
+              policies: policies.map((p) => {
+                const name = agentPolicyById[p.id]?.name ?? p.name;
+
+                return {
+                  ...p,
+                  name,
+                };
+              }),
+            },
+            agents: esAgents?.agents ?? [],
+          },
+        });
       }
     );
 };
diff --git a/x-pack/plugins/osquery/server/routes/pack/utils.ts b/x-pack/plugins/osquery/server/routes/pack/utils.ts
index a458e6edadfa14..3f3c9fa90c746d 100644
--- a/x-pack/plugins/osquery/server/routes/pack/utils.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/utils.ts
@@ -21,7 +21,16 @@ export const convertPackQueriesToSO = (queries) =>
       const ecsMapping = value.ecs_mapping && convertECSMappingToArray(value.ecs_mapping);
       acc.push({
         id: key,
-        ...pick(value, ['name', 'query', 'interval', 'platform', 'version', 'snapshot', 'removed']),
+        ...pick(value, [
+          'name',
+          'query',
+          'interval',
+          'platform',
+          'version',
+          'snapshot',
+          'removed',
+          'timeout',
+        ]),
         ...(ecsMapping ? { ecs_mapping: ecsMapping } : {}),
       });
 
@@ -32,6 +41,7 @@ export const convertPackQueriesToSO = (queries) =>
       name: string;
       query: string;
       interval: number;
+      timeout?: number;
       snapshot?: boolean;
       removed?: boolean;
       ecs_mapping?: Record<string, unknown>;
diff --git a/x-pack/plugins/osquery/server/routes/saved_query/create_saved_query_route.ts b/x-pack/plugins/osquery/server/routes/saved_query/create_saved_query_route.ts
index bccd521f6323dc..d59f1c5ba0f8d3 100644
--- a/x-pack/plugins/osquery/server/routes/saved_query/create_saved_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/saved_query/create_saved_query_route.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isEmpty, pickBy, some, isBoolean } from 'lodash';
+import { isEmpty, pickBy, some, isBoolean, isNumber } from 'lodash';
 import type { IRouter } from '@kbn/core/server';
 import type { CreateSavedQueryRequestSchemaDecoded } from '../../../common/api';
 import { API_VERSIONS } from '../../../common/constants';
@@ -50,6 +50,7 @@ export const createSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
           interval,
           snapshot,
           removed,
+          timeout,
           // eslint-disable-next-line @typescript-eslint/naming-convention
           ecs_mapping,
         } = request.body;
@@ -80,13 +81,14 @@ export const createSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
               interval,
               snapshot,
               removed,
+              timeout,
               ecs_mapping: convertECSMappingToArray(ecs_mapping),
               created_by: currentUser,
               created_at: new Date().toISOString(),
               updated_by: currentUser,
               updated_at: new Date().toISOString(),
             },
-            (value) => !isEmpty(value) || isBoolean(value)
+            (value) => !isEmpty(value) || isBoolean(value) || isNumber(value)
           )
         );
 
@@ -102,6 +104,7 @@ export const createSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
             snapshot: attributes.snapshot,
             version: attributes.version,
             interval: attributes.interval,
+            timeout: attributes.timeout,
             platform: attributes.platform,
             query: attributes.query,
             updated_at: attributes.updated_at,
@@ -109,7 +112,7 @@ export const createSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
             saved_object_id: savedQuerySO.id,
             ecs_mapping,
           },
-          (value) => !isEmpty(value)
+          (value) => !isEmpty(value) || isNumber(value)
         );
 
         return response.ok({
diff --git a/x-pack/plugins/osquery/server/routes/saved_query/find_saved_query_route.ts b/x-pack/plugins/osquery/server/routes/saved_query/find_saved_query_route.ts
index a176d581329b5f..88ccc120d0fd6b 100644
--- a/x-pack/plugins/osquery/server/routes/saved_query/find_saved_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/saved_query/find_saved_query_route.ts
@@ -73,6 +73,7 @@ export const findSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
                 description,
                 id,
                 interval,
+                timeout,
                 platform,
                 query,
                 removed,
@@ -94,6 +95,7 @@ export const findSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
                 version,
                 ecs_mapping: ecsMapping,
                 interval,
+                timeout,
                 platform,
                 query,
                 updated_at: updatedAt,
diff --git a/x-pack/plugins/osquery/server/routes/saved_query/read_saved_query_route.ts b/x-pack/plugins/osquery/server/routes/saved_query/read_saved_query_route.ts
index fb355c8b732b0a..706304300c40a9 100644
--- a/x-pack/plugins/osquery/server/routes/saved_query/read_saved_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/saved_query/read_saved_query_route.ts
@@ -64,6 +64,7 @@ export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
           description,
           id,
           interval,
+          timeout,
           platform,
           query,
           removed,
@@ -85,6 +86,7 @@ export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
           version,
           ecs_mapping: ecsMapping,
           interval,
+          timeout,
           platform,
           query,
           updated_at: updatedAt,
diff --git a/x-pack/plugins/osquery/server/routes/saved_query/types.ts b/x-pack/plugins/osquery/server/routes/saved_query/types.ts
index 3e3ecf9d188441..07f1a812cf9f64 100644
--- a/x-pack/plugins/osquery/server/routes/saved_query/types.ts
+++ b/x-pack/plugins/osquery/server/routes/saved_query/types.ts
@@ -11,6 +11,7 @@ export interface SavedQueryResponse {
   description: string | undefined;
   query: string;
   interval: number | string;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string;
@@ -29,6 +30,7 @@ export interface UpdateSavedQueryResponse {
   description: string | undefined;
   query: string;
   interval: number | string;
+  timeout?: number;
   snapshot?: boolean;
   removed?: boolean;
   platform?: string;
diff --git a/x-pack/plugins/osquery/server/routes/saved_query/update_saved_query_route.ts b/x-pack/plugins/osquery/server/routes/saved_query/update_saved_query_route.ts
index d6cd11805c57a4..f6bcad9d4bed4e 100644
--- a/x-pack/plugins/osquery/server/routes/saved_query/update_saved_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/saved_query/update_saved_query_route.ts
@@ -60,6 +60,7 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
           query,
           version,
           interval,
+          timeout,
           snapshot,
           removed,
           // eslint-disable-next-line @typescript-eslint/naming-convention
@@ -102,6 +103,7 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
             query,
             version,
             interval,
+            timeout,
             snapshot,
             removed,
             ecs_mapping: convertECSMappingToArray(ecs_mapping),
@@ -133,6 +135,7 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
           version: attributes.version,
           ecs_mapping: attributes.ecs_mapping,
           interval: attributes.interval,
+          timeout: attributes.timeout,
           platform: attributes.platform,
           query: attributes.query,
           updated_at: attributes.updated_at,
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
index 81c1e0541b8bd1..fc1884a83fda73 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
@@ -9,9 +9,9 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { ISearchRequestParams } from '@kbn/data-plugin/common';
 import { AGENT_ACTIONS_INDEX } from '@kbn/fleet-plugin/common';
+import type { AgentsRequestOptions } from '../../../../../../common/search_strategy/osquery/agents';
 import { getQueryFilter } from '../../../../../utils/build_query';
 import { ACTIONS_INDEX } from '../../../../../../common/constants';
-import type { AgentsRequestOptions } from '../../../../../../common/search_strategy';
 
 export const buildActionsQuery = ({
   kuery = '',
@@ -23,7 +23,7 @@ export const buildActionsQuery = ({
     bool: { filter },
   } = getQueryFilter({ filter: kuery });
 
-  const dslQuery = {
+  return {
     allow_no_indices: true,
     index: componentTemplateExists ? `${ACTIONS_INDEX}*` : AGENT_ACTIONS_INDEX,
     ignore_unavailable: true,
@@ -62,6 +62,4 @@ export const buildActionsQuery = ({
       ],
     },
   };
-
-  return dslQuery;
 };
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
index 47901f47b65934..830447e65be5f0 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
@@ -8,6 +8,7 @@
 import type { ISearchRequestParams } from '@kbn/data-plugin/common';
 import { AGENT_ACTIONS_RESULTS_INDEX } from '@kbn/fleet-plugin/common';
 import { isEmpty } from 'lodash';
+import moment from 'moment';
 import { ACTION_RESPONSES_INDEX } from '../../../../../../common/constants';
 import type { ActionResultsRequestOptions } from '../../../../../../common/search_strategy';
 import { getQueryFilter } from '../../../../../utils/build_query';
@@ -15,19 +16,32 @@ import { getQueryFilter } from '../../../../../utils/build_query';
 export const buildActionResultsQuery = ({
   actionId,
   kuery,
-  // pagination: { activePage, querySize },
+  startDate,
   sort,
   componentTemplateExists,
 }: ActionResultsRequestOptions): ISearchRequestParams => {
-  const actionIdQuery = `action_id: ${actionId}`;
-  let filter = actionIdQuery;
+  let filter = `action_id: ${actionId}`;
   if (!isEmpty(kuery)) {
     filter = filter + ` AND ${kuery}`;
   }
 
-  const filterQuery = getQueryFilter({ filter });
+  const timeRangeFilter =
+    startDate && !isEmpty(startDate)
+      ? [
+          {
+            range: {
+              started_at: {
+                gte: startDate,
+                lte: moment(startDate).clone().add(30, 'minutes').toISOString(),
+              },
+            },
+          },
+        ]
+      : [];
 
-  const dslQuery = {
+  const filterQuery = [...timeRangeFilter, getQueryFilter({ filter })];
+
+  return {
     allow_no_indices: true,
     index: componentTemplateExists
       ? `${ACTION_RESPONSES_INDEX}-default*`
@@ -84,6 +98,4 @@ export const buildActionResultsQuery = ({
       ],
     },
   };
-
-  return dslQuery;
 };
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/index.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/index.ts
deleted file mode 100644
index 72bb97f1b8eaa3..00000000000000
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/index.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { IEsSearchResponse } from '@kbn/data-plugin/common';
-import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../common/constants';
-import type {
-  AgentsStrategyResponse,
-  AgentsRequestOptions,
-  OsqueryQueries,
-} from '../../../../../common/search_strategy/osquery';
-
-import type { Agent } from '../../../../../common/shared_imports';
-import { inspectStringifyObject } from '../../../../../common/utils/build_query';
-import type { OsqueryFactory } from '../types';
-import { buildAgentsQuery } from './query.all_agents.dsl';
-
-export const allAgents: OsqueryFactory<OsqueryQueries.agents> = {
-  buildDsl: (options: AgentsRequestOptions) => {
-    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
-      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
-    }
-
-    return buildAgentsQuery(options);
-  },
-  parse: async (
-    options: AgentsRequestOptions,
-    response: IEsSearchResponse<Agent>
-  ): Promise<AgentsStrategyResponse> => {
-    const inspect = {
-      dsl: [inspectStringifyObject(buildAgentsQuery(options))],
-    };
-
-    return {
-      ...response,
-      inspect,
-      edges: response.rawResponse.hits.hits.map((hit) => ({
-        _id: hit._id,
-        ...hit._source,
-      })) as Agent[],
-    };
-  },
-};
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts
deleted file mode 100644
index b06f54900d2593..00000000000000
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { ISearchRequestParams } from '@kbn/data-plugin/common';
-import { AGENTS_INDEX } from '@kbn/fleet-plugin/common';
-import { isEmpty } from 'lodash';
-import { getQueryFilter } from '../../../../utils/build_query';
-import type { AgentsRequestOptions } from '../../../../../common/search_strategy';
-
-export const buildAgentsQuery = ({
-  kuery,
-  pagination: { cursorStart },
-  sort,
-}: AgentsRequestOptions): ISearchRequestParams => {
-  const activeQuery = `active: true`;
-  let filter = activeQuery;
-  if (!isEmpty(kuery)) {
-    filter = activeQuery + ` AND ${kuery}`;
-  }
-
-  const filterQuery = getQueryFilter({ filter });
-
-  return {
-    allow_no_indices: true,
-    index: AGENTS_INDEX,
-    ignore_unavailable: true,
-    body: {
-      query: {
-        bool: {
-          filter: filterQuery,
-        },
-      },
-      aggs: {
-        platforms: {
-          terms: {
-            field: 'local_metadata.os.platform',
-          },
-        },
-        policies: {
-          terms: {
-            field: 'policy_id',
-            size: 2000,
-          },
-        },
-      },
-      track_total_hits: true,
-      sort: [
-        {
-          [sort.field]: {
-            order: sort.direction,
-          },
-        },
-      ],
-      size: 0,
-      from: cursorStart,
-    },
-  };
-};
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/index.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/index.ts
index d1af1cf36622a0..747293630d694e 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/index.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/index.ts
@@ -9,7 +9,6 @@ import type { FactoryQueryTypes } from '../../../../common/search_strategy/osque
 import { OsqueryQueries } from '../../../../common/search_strategy/osquery';
 
 import { allActions, actionDetails, actionResults } from './actions';
-import { allAgents } from './agents';
 import { allResults } from './results';
 
 import type { OsqueryFactory } from './types';
@@ -18,6 +17,5 @@ export const osqueryFactory: Record<FactoryQueryTypes, OsqueryFactory<FactoryQue
   [OsqueryQueries.actions]: allActions,
   [OsqueryQueries.actionDetails]: actionDetails,
   [OsqueryQueries.actionResults]: actionResults,
-  [OsqueryQueries.agents]: allAgents,
   [OsqueryQueries.results]: allResults,
 };
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
index 2c8d4086722759..8a4bc5d110d140 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
@@ -7,6 +7,7 @@
 
 import type { ISearchRequestParams } from '@kbn/data-plugin/common';
 import { isEmpty } from 'lodash';
+import moment from 'moment/moment';
 import { getQueryFilter } from '../../../../utils/build_query';
 import { OSQUERY_INTEGRATION_NAME } from '../../../../../common';
 import type { ResultsRequestOptions } from '../../../../../common/search_strategy';
@@ -16,6 +17,7 @@ export const buildResultsQuery = ({
   agentId,
   kuery,
   sort,
+  startDate,
   pagination: { activePage, querySize },
 }: ResultsRequestOptions): ISearchRequestParams => {
   const actionIdQuery = `action_id: ${actionId}`;
@@ -25,9 +27,22 @@ export const buildResultsQuery = ({
     filter = filter + ` AND ${kuery}`;
   }
 
-  const filterQuery = getQueryFilter({ filter });
+  const timeRangeFilter =
+    startDate && !isEmpty(startDate)
+      ? [
+          {
+            range: {
+              '@timestamp': {
+                gte: startDate,
+                lte: moment(startDate).clone().add(30, 'minutes').toISOString(),
+              },
+            },
+          },
+        ]
+      : [];
+  const filterQuery = [...timeRangeFilter, getQueryFilter({ filter })];
 
-  const dslQuery = {
+  return {
     allow_no_indices: true,
     index: `logs-${OSQUERY_INTEGRATION_NAME}.result*`,
     ignore_unavailable: true,
@@ -58,6 +73,4 @@ export const buildResultsQuery = ({
         })) ?? [],
     },
   };
-
-  return dslQuery;
 };
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts
index af14d84fa36378..898f53b17c552e 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/index.ts
@@ -45,6 +45,7 @@ export const osquerySearchStrategyProvider = <T extends FactoryQueryTypes>(
             ...('pagination' in request ? { pagination: request.pagination } : {}),
             ...('sort' in request ? { sort: request.sort } : {}),
             ...('actionId' in request ? { actionId: request.actionId } : {}),
+            ...('startDate' in request ? { startDate: request.startDate } : {}),
             ...('agentId' in request ? { agentId: request.agentId } : {}),
           } as StrategyRequestType<T>;
 
diff --git a/x-pack/plugins/painless_lab/server/index.ts b/x-pack/plugins/painless_lab/server/index.ts
index d81147ed9e3951..ad8203ecba1942 100644
--- a/x-pack/plugins/painless_lab/server/index.ts
+++ b/x-pack/plugins/painless_lab/server/index.ts
@@ -7,7 +7,6 @@
 
 import { offeringBasedSchema, schema, TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import { PainlessLabServerPlugin } from './plugin';
 
 export const configSchema = schema.object({
   enabled: offeringBasedSchema({
@@ -20,6 +19,7 @@ export const config: PluginConfigDescriptor<ConfigType> = {
   schema: configSchema,
 };
 
-export const plugin = (ctx: PluginInitializerContext) => {
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { PainlessLabServerPlugin } = await import('./plugin');
   return new PainlessLabServerPlugin(ctx);
 };
diff --git a/x-pack/plugins/profiling/server/index.ts b/x-pack/plugins/profiling/server/index.ts
index 25861fbcfc750b..cbd429315cbb5c 100644
--- a/x-pack/plugins/profiling/server/index.ts
+++ b/x-pack/plugins/profiling/server/index.ts
@@ -7,7 +7,6 @@
 
 import { schema, TypeOf } from '@kbn/config-schema';
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { ProfilingPlugin } from './plugin';
 
 /**
  * These properties are used to create both the Collector and the Symbolizer integrations
@@ -56,7 +55,8 @@ export const config: PluginConfigDescriptor<ProfilingConfig> = {
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ProfilingPlugin } = await import('./plugin');
   return new ProfilingPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/profiling_data_access/server/index.ts b/x-pack/plugins/profiling_data_access/server/index.ts
index d979d22f4a011f..c245297c86bd85 100644
--- a/x-pack/plugins/profiling_data_access/server/index.ts
+++ b/x-pack/plugins/profiling_data_access/server/index.ts
@@ -7,7 +7,6 @@
 import { schema, TypeOf } from '@kbn/config-schema';
 
 import type { PluginInitializerContext } from '@kbn/core/server';
-import { ProfilingDataAccessPlugin } from './plugin';
 import type { ProfilingDataAccessPluginSetup, ProfilingDataAccessPluginStart } from './plugin';
 
 const configSchema = schema.object({
@@ -29,6 +28,7 @@ export type ProfilingConfig = TypeOf<typeof configSchema>;
 
 export type { ProfilingDataAccessPluginSetup, ProfilingDataAccessPluginStart };
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ProfilingDataAccessPlugin } = await import('./plugin');
   return new ProfilingDataAccessPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/remote_clusters/server/index.ts b/x-pack/plugins/remote_clusters/server/index.ts
index 8325b869b150d6..4702f6390d99a7 100644
--- a/x-pack/plugins/remote_clusters/server/index.ts
+++ b/x-pack/plugins/remote_clusters/server/index.ts
@@ -6,9 +6,11 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { RemoteClustersServerPlugin } from './plugin';
 
 export { config } from './config';
 export type { RemoteClustersPluginSetup } from './plugin';
 
-export const plugin = (ctx: PluginInitializerContext) => new RemoteClustersServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { RemoteClustersServerPlugin } = await import('./plugin');
+  return new RemoteClustersServerPlugin(ctx);
+};
diff --git a/x-pack/plugins/reporting/README.md b/x-pack/plugins/reporting/README.md
index 9b54ef68920148..c0c28c5c6fcd53 100644
--- a/x-pack/plugins/reporting/README.md
+++ b/x-pack/plugins/reporting/README.md
@@ -10,7 +10,7 @@ This should be deprecated. It is historically a customer driven endpoint.  This
 This new endpoint is designed to have a more automation-friendly signature. It will replace csv_searchsource in the UI at some point, when there is more capacity in reporting. It will need a little more work to have parity: it needs to be able to export "unsaved" searches.
 
 ## Generate CSV
-Although historically related to reporting, the CsvGenerator class has now be moved into its own package `@kbn/generate-csv` and `@kbn/generate-csv-types`. 
+Although historically related to reporting, the CsvGenerator class has now be moved into its own package `@kbn/generate-csv`. 
 
 ## Serverless configuration
 There are several improvements made for reporting in serverless environments. Most changes are reflected in `reporting/server/config/schema.ts` for reference. 
diff --git a/x-pack/plugins/reporting/common/constants/export_types.ts b/x-pack/plugins/reporting/common/constants/export_types.ts
new file mode 100644
index 00000000000000..20f8a63204e752
--- /dev/null
+++ b/x-pack/plugins/reporting/common/constants/export_types.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// Export Type Sets
+import {
+  CSV_JOB_TYPE,
+  CSV_JOB_TYPE_DEPRECATED,
+  CSV_JOB_TYPE_V2,
+  CSV_REPORT_TYPE,
+  CSV_REPORT_TYPE_V2,
+} from '@kbn/reporting-export-types-csv-common';
+import {
+  PDF_JOB_TYPE,
+  PDF_JOB_TYPE_V2,
+  PDF_REPORT_TYPE,
+  PDF_REPORT_TYPE_V2,
+} from '@kbn/reporting-export-types-pdf-common';
+import {
+  PNG_JOB_TYPE,
+  PNG_JOB_TYPE_V2,
+  PNG_REPORT_TYPE,
+  PNG_REPORT_TYPE_V2,
+} from '@kbn/reporting-export-types-png-common';
+
+export const reportTypes = [
+  CSV_REPORT_TYPE,
+  CSV_REPORT_TYPE_V2,
+  PDF_REPORT_TYPE,
+  PDF_REPORT_TYPE_V2,
+  PNG_REPORT_TYPE,
+  PNG_REPORT_TYPE_V2,
+];
+
+export const jobTypes = [
+  CSV_JOB_TYPE,
+  CSV_JOB_TYPE_V2,
+  PDF_JOB_TYPE,
+  PDF_JOB_TYPE_V2,
+  PNG_JOB_TYPE,
+  PNG_JOB_TYPE_V2,
+];
+
+export const USES_HEADLESS_JOB_TYPES = [
+  PDF_JOB_TYPE,
+  PNG_JOB_TYPE,
+  PDF_JOB_TYPE_V2,
+  PNG_JOB_TYPE_V2,
+];
+
+export const DEPRECATED_JOB_TYPES = [CSV_JOB_TYPE_DEPRECATED];
diff --git a/x-pack/plugins/reporting/common/constants/index.ts b/x-pack/plugins/reporting/common/constants/index.ts
index f02ea766da66b4..44e90356027bc3 100644
--- a/x-pack/plugins/reporting/common/constants/index.ts
+++ b/x-pack/plugins/reporting/common/constants/index.ts
@@ -5,98 +5,9 @@
  * 2.0.
  */
 
-import { CONTENT_TYPE_CSV } from '@kbn/generate-csv/src/constants';
-import * as jobTypes from './job_types';
-import * as reportTypes from './report_types';
-
-const { PDF_JOB_TYPE, PDF_JOB_TYPE_V2, PNG_JOB_TYPE, PNG_JOB_TYPE_V2 } = jobTypes;
-
-export const PLUGIN_ID = 'reporting';
-
-export const REPORTING_TRANSACTION_TYPE = PLUGIN_ID;
-
-export const REPORTING_SYSTEM_INDEX = '.reporting';
-
-export const JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY =
-  'xpack.reporting.jobCompletionNotifications';
-
-export const ALLOWED_JOB_CONTENT_TYPES = [
-  'application/json',
-  'application/pdf',
-  CONTENT_TYPE_CSV,
-  'image/png',
-  'text/plain',
-];
-
-type ReportTypeDeclaration = typeof reportTypes;
-export type ReportTypes = ReportTypeDeclaration[keyof ReportTypeDeclaration];
-
-type JobTypeDeclaration = typeof jobTypes;
-export type JobTypes = JobTypeDeclaration[keyof JobTypeDeclaration];
-
-export const CSV_SEARCHSOURCE_IMMEDIATE_TYPE = 'csv_searchsource_immediate';
-
-// This is deprecated because it lacks support for runtime fields
-// but the extension points are still needed for pre-existing scripted automation, until 8.0
-export const CSV_REPORT_TYPE_DEPRECATED = 'CSV';
-export const CSV_JOB_TYPE_DEPRECATED = 'csv';
-
-export const USES_HEADLESS_JOB_TYPES = [
-  PDF_JOB_TYPE,
-  PNG_JOB_TYPE,
-  PDF_JOB_TYPE_V2,
-  PNG_JOB_TYPE_V2,
-];
-
-export const DEPRECATED_JOB_TYPES = [CSV_JOB_TYPE_DEPRECATED];
-
-// Licenses
-export const LICENSE_TYPE_TRIAL = 'trial' as const;
-export const LICENSE_TYPE_BASIC = 'basic' as const;
-export const LICENSE_TYPE_CLOUD_STANDARD = 'standard' as const;
-export const LICENSE_TYPE_GOLD = 'gold' as const;
-export const LICENSE_TYPE_PLATINUM = 'platinum' as const;
-export const LICENSE_TYPE_ENTERPRISE = 'enterprise' as const;
-
-export const ILM_POLICY_NAME = 'kibana-reporting';
-
-// Usage counter types
-export const API_USAGE_COUNTER_TYPE = 'reportingApi';
-export const API_USAGE_ERROR_TYPE = 'reportingApiError';
-
-// Management UI route
-export const REPORTING_MANAGEMENT_HOME = '/app/management/insightsAndAlerting/reporting';
-
-export const REPORTING_REDIRECT_LOCATOR_STORE_KEY = '__REPORTING_REDIRECT_LOCATOR_STORE_KEY__';
-
-/**
- * A way to get the client side route for the reporting redirect app.
- *
- * TODO: Add a job ID and a locator to use so that we can redirect without expecting state to
- * be injected to the page
- */
-export const getRedirectAppPath = () => {
-  return '/app/reportingRedirect';
-};
-
-// Statuses
-export enum JOB_STATUSES {
-  PENDING = 'pending',
-  PROCESSING = 'processing',
-  COMPLETED = 'completed',
-  FAILED = 'failed',
-  WARNINGS = 'completed_with_warnings',
-}
+export * from './routes';
+export * from './export_types';
 
 // Test Subjects
 export const REPORT_TABLE_ID = 'reportJobListing';
 export const REPORT_TABLE_ROW_ID = 'reportJobRow';
-
-// Job params require a `version` field as of 7.15.0. For older jobs set with
-// automation that have no version value in the job params, we assume the
-// intended version is 7.14.0
-export const UNVERSIONED_VERSION = '7.14.0';
-
-export * from './job_types';
-export * from './report_types';
-export * from './routes';
diff --git a/x-pack/plugins/reporting/common/constants/job_types.ts b/x-pack/plugins/reporting/common/constants/job_types.ts
deleted file mode 100644
index b11391d81fa143..00000000000000
--- a/x-pack/plugins/reporting/common/constants/job_types.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export const CSV_JOB_TYPE = 'csv_searchsource';
-
-export const PDF_JOB_TYPE = 'printable_pdf';
-export const PDF_JOB_TYPE_V2 = 'printable_pdf_v2';
-
-export const PNG_JOB_TYPE = 'PNG';
-export const PNG_JOB_TYPE_V2 = 'PNGV2';
diff --git a/x-pack/plugins/reporting/common/constants/report_types.ts b/x-pack/plugins/reporting/common/constants/report_types.ts
deleted file mode 100644
index b66e00de7407f2..00000000000000
--- a/x-pack/plugins/reporting/common/constants/report_types.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-// Export Type Definitions
-export const CSV_REPORT_TYPE = 'csv_searchsource';
-export const CSV_REPORT_TYPE_V2 = 'csv_v2';
-
-export const PDF_REPORT_TYPE = 'printablePdf';
-export const PDF_REPORT_TYPE_V2 = 'printablePdfV2';
-
-export const PNG_REPORT_TYPE = 'PNG';
-export const PNG_REPORT_TYPE_V2 = 'pngV2';
diff --git a/x-pack/plugins/reporting/common/errors/map_to_reporting_error.test.ts b/x-pack/plugins/reporting/common/errors/map_to_reporting_error.test.ts
index 5b22591e7a16ae..5e8193deaf07fd 100644
--- a/x-pack/plugins/reporting/common/errors/map_to_reporting_error.test.ts
+++ b/x-pack/plugins/reporting/common/errors/map_to_reporting_error.test.ts
@@ -5,15 +5,15 @@
  * 2.0.
  */
 
-import { mapToReportingError } from './map_to_reporting_error';
-import { errors } from '@kbn/screenshotting-plugin/common';
 import {
-  UnknownError,
   BrowserCouldNotLaunchError,
-  BrowserUnexpectedlyClosedError,
   BrowserScreenshotError,
+  BrowserUnexpectedlyClosedError,
   InvalidLayoutParametersError,
+  UnknownError,
 } from '@kbn/reporting-common';
+import { mapToReportingError } from './map_to_reporting_error';
+import { errors } from '@kbn/screenshotting-plugin/common';
 
 describe('mapToReportingError', () => {
   test('Non-Error values', () => {
diff --git a/x-pack/plugins/reporting/common/index.ts b/x-pack/plugins/reporting/common/index.ts
deleted file mode 100644
index 36c9f996287787..00000000000000
--- a/x-pack/plugins/reporting/common/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/**
- * Common types that are documented in the Public API
- */
-export type {
-  BaseParams,
-  BaseParamsV2,
-  BasePayload,
-  BasePayloadV2,
-  JobAppParamsPDF,
-  JobAppParamsPDFV2,
-  LocatorParams,
-} from './types';
diff --git a/x-pack/plugins/reporting/common/job_utils.ts b/x-pack/plugins/reporting/common/job_utils.ts
index c1fd2eb5eb8c45..580f2d74671132 100644
--- a/x-pack/plugins/reporting/common/job_utils.ts
+++ b/x-pack/plugins/reporting/common/job_utils.ts
@@ -5,14 +5,9 @@
  * 2.0.
  */
 
-import {
-  CSV_JOB_TYPE,
-  PDF_JOB_TYPE,
-  PNG_JOB_TYPE,
-  PDF_JOB_TYPE_V2,
-  PNG_JOB_TYPE_V2,
-  CSV_JOB_TYPE_DEPRECATED,
-} from './constants';
+import { CSV_JOB_TYPE, CSV_JOB_TYPE_DEPRECATED } from '@kbn/reporting-export-types-csv-common';
+import { PDF_JOB_TYPE, PDF_JOB_TYPE_V2 } from '@kbn/reporting-export-types-pdf-common';
+import { PNG_JOB_TYPE, PNG_JOB_TYPE_V2 } from '@kbn/reporting-export-types-png-common';
 
 // TODO: Remove this code once everyone is using the new PDF format, then we can also remove the legacy
 // export type entirely
diff --git a/x-pack/plugins/reporting/common/schema_utils.test.ts b/x-pack/plugins/reporting/common/schema_utils.test.ts
deleted file mode 100644
index 6e9bb2db754375..00000000000000
--- a/x-pack/plugins/reporting/common/schema_utils.test.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import moment from 'moment';
-import { numberToDuration } from './schema_utils';
-
-describe('Schema Utils', () => {
-  it('numberToDuration converts a number/Duration into a Duration object', () => {
-    expect(numberToDuration(500)).toMatchInlineSnapshot(`"PT0.5S"`);
-    expect(numberToDuration(moment.duration(1, 'hour'))).toMatchInlineSnapshot(`"PT1H"`);
-  });
-});
diff --git a/x-pack/plugins/reporting/common/schema_utils.ts b/x-pack/plugins/reporting/common/schema_utils.ts
deleted file mode 100644
index 798440bfbb69c4..00000000000000
--- a/x-pack/plugins/reporting/common/schema_utils.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ByteSizeValue } from '@kbn/config-schema';
-import moment from 'moment';
-
-/*
- * For cleaner code: use these functions when a config schema value could be
- * one type or another.  This allows you to treat the value as one type.
- */
-
-export const durationToNumber = (value: number | moment.Duration): number => {
-  if (typeof value === 'number') {
-    return value;
-  }
-  return value.asMilliseconds();
-};
-
-export const numberToDuration = (value: number | moment.Duration): moment.Duration => {
-  if (typeof value === 'number') {
-    return moment.duration(value, 'milliseconds');
-  }
-  return value;
-};
-
-export const byteSizeValueToNumber = (value: number | ByteSizeValue) => {
-  if (typeof value === 'number') {
-    return value;
-  }
-
-  return value.getValueInBytes();
-};
diff --git a/x-pack/plugins/reporting/common/test/fixtures.ts b/x-pack/plugins/reporting/common/test/fixtures.ts
index 1a78e521995342..823785c4eb273f 100644
--- a/x-pack/plugins/reporting/common/test/fixtures.ts
+++ b/x-pack/plugins/reporting/common/test/fixtures.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import type { ReportApiJSON } from '../types';
+import { JOB_STATUS } from '@kbn/reporting-common';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 import type { ReportMock } from './types';
 
 const buildMockReport = (baseObj: ReportMock): ReportApiJSON => ({
@@ -43,7 +44,7 @@ export const mockJobs: ReportApiJSON[] = [
         },
       ],
     } as any,
-    status: 'pending',
+    status: JOB_STATUS.PENDING,
   }),
   buildMockReport({
     id: 'k90e51pk1ieucbae0c3t8wo1',
@@ -56,7 +57,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T21:01:14.526Z',
-    status: 'processing',
+    status: JOB_STATUS.PROCESSING,
   }),
   buildMockReport({
     id: 'k90cmthd1gv8cbae0c2le8bo',
@@ -71,7 +72,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T20:19:04.073Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
   buildMockReport({
     id: 'k906958e1d4wcbae0c9hip1a',
@@ -92,7 +93,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T17:20:29.444Z',
-    status: 'completed_with_warnings',
+    status: JOB_STATUS.WARNINGS,
   }),
   buildMockReport({
     id: 'k9067y2a1d4wcbae0cad38n0',
@@ -107,7 +108,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T17:19:39.883Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
   buildMockReport({
     id: 'k9067s1m1d4wcbae0cdnvcms',
@@ -122,7 +123,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T17:19:25.247Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
   buildMockReport({
     id: 'k9065q3s1d4wcbae0c00fxlh',
@@ -137,7 +138,7 @@ export const mockJobs: ReportApiJSON[] = [
       title: 'My Canvas Workpad',
     },
     started_at: '2020-04-14T17:17:50.379Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
   buildMockReport({
     id: 'k905zdw11d34cbae0c3y6tzh',
@@ -153,7 +154,7 @@ export const mockJobs: ReportApiJSON[] = [
       isDeprecated: true,
     },
     started_at: '2020-04-14T17:12:52.431Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
   buildMockReport({
     id: 'k8t4ylcb07mi9d006214ifyg',
@@ -169,6 +170,6 @@ export const mockJobs: ReportApiJSON[] = [
       isDeprecated: true,
     },
     started_at: '2020-04-09T19:09:54.570Z',
-    status: 'completed',
+    status: JOB_STATUS.COMPLETED,
   }),
 ];
diff --git a/x-pack/plugins/reporting/common/test/types.ts b/x-pack/plugins/reporting/common/test/types.ts
index 83ebc1e3358cb8..5a4b7ed8530a6c 100644
--- a/x-pack/plugins/reporting/common/test/types.ts
+++ b/x-pack/plugins/reporting/common/test/types.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ReportApiJSON } from '../types';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 
 /** @internal */
 export interface PayloadMock {
diff --git a/x-pack/plugins/reporting/common/types.ts b/x-pack/plugins/reporting/common/types.ts
new file mode 100644
index 00000000000000..09d1dc8f43e31f
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { jobTypes, reportTypes } from './constants';
+
+type ReportTypeDeclaration = typeof reportTypes;
+export type ReportTypes = ReportTypeDeclaration[keyof ReportTypeDeclaration];
+
+type JobTypeDeclaration = typeof jobTypes;
+export type JobTypes = JobTypeDeclaration[keyof JobTypeDeclaration];
diff --git a/x-pack/plugins/reporting/common/types/base.ts b/x-pack/plugins/reporting/common/types/base.ts
deleted file mode 100644
index 5f5a6f360c2a4f..00000000000000
--- a/x-pack/plugins/reporting/common/types/base.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { Ensure, SerializableRecord } from '@kbn/utility-types';
-import type { LayoutParams } from '@kbn/screenshotting-plugin/common';
-import { LocatorParams } from './url';
-
-export type JobId = string;
-
-/**
- * @deprecated
- */
-export type BaseParams = Ensure<
-  {
-    layout?: LayoutParams;
-    objectType: string;
-    title: string;
-    browserTimezone: string; // to format dates in the user's time zone
-    version: string; // to handle any state migrations
-  },
-  SerializableRecord
->;
-
-/**
- * Report job parameters that an application must return from its
- * getSharingData function.
- */
-export type BaseParamsV2 = BaseParams & {
-  locatorParams: LocatorParams[];
-};
-
-/**
- * @deprecated
- */
-export interface BasePayload extends BaseParams {
-  headers: string;
-  spaceId?: string;
-  isDeprecated?: boolean;
-}
-
-/**
- * Report job parameters, after they are processed in the request handler.
- */
-export interface BasePayloadV2 extends BaseParamsV2 {
-  headers: string;
-  spaceId?: string;
-  isDeprecated?: boolean;
-}
diff --git a/x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts b/x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts
deleted file mode 100644
index 9943deb642e888..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { SerializedSearchSourceFields } from '@kbn/data-plugin/common';
-import type { BaseParams, BasePayload } from '../base';
-
-interface BaseParamsCSV {
-  searchSource: SerializedSearchSourceFields;
-  columns?: string[];
-}
-
-export type JobParamsCSV = BaseParamsCSV & BaseParams;
-export type TaskPayloadCSV = BaseParamsCSV & BasePayload;
diff --git a/x-pack/plugins/reporting/common/types/export_types/csv_searchsource_immediate.ts b/x-pack/plugins/reporting/common/types/export_types/csv_searchsource_immediate.ts
deleted file mode 100644
index b7954f3b936d87..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/csv_searchsource_immediate.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { SerializedSearchSourceFields } from '@kbn/data-plugin/common';
-
-export interface FakeRequest {
-  headers: Record<string, string>;
-}
-
-export interface JobParamsDownloadCSV {
-  browserTimezone: string;
-  title: string;
-  searchSource: SerializedSearchSourceFields;
-  columns?: string[];
-}
-
-export interface SavedObjectServiceError {
-  statusCode: number;
-  error?: string;
-  message?: string;
-}
diff --git a/x-pack/plugins/reporting/common/types/export_types/csv_v2.ts b/x-pack/plugins/reporting/common/types/export_types/csv_v2.ts
deleted file mode 100644
index f56295ca651d53..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/csv_v2.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { BaseParamsV2, BasePayloadV2 } from '..';
-interface CsvFromSavedObjectBase {
-  objectType: 'search';
-}
-
-/**
- * Makes title optional, as it can be derived from the saved search object
- */
-export type JobParamsCsvFromSavedObject = CsvFromSavedObjectBase &
-  Omit<BaseParamsV2, 'title'> & { title?: string };
-
-/**
- *
- */
-export type TaskPayloadCsvFromSavedObject = CsvFromSavedObjectBase & BasePayloadV2;
diff --git a/x-pack/plugins/reporting/common/types/export_types/png.ts b/x-pack/plugins/reporting/common/types/export_types/png.ts
deleted file mode 100644
index 4a5367c754f4cf..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/png.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { LayoutParams } from '@kbn/screenshotting-plugin/common';
-import type { BaseParams, BasePayload } from '../base';
-
-interface BaseParamsPNG {
-  layout: LayoutParams;
-  forceNow?: string;
-  relativeUrl: string;
-}
-
-// Job params: structure of incoming user request data
-/**
- * @deprecated
- */
-export type JobParamsPNGDeprecated = BaseParamsPNG & BaseParams;
-
-// Job payload: structure of stored job data provided by create_job
-export type TaskPayloadPNG = BaseParamsPNG & BasePayload;
diff --git a/x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts b/x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts
deleted file mode 100644
index 240cc778b269d0..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { LayoutParams } from '@kbn/screenshotting-plugin/common';
-import type { BaseParams, BasePayload } from '../base';
-
-interface BaseParamsPDF {
-  layout: LayoutParams;
-  relativeUrls: string[];
-  isDeprecated?: boolean;
-}
-
-// Job params: structure of incoming user request data, after being parsed from RISON
-
-/**
- * @deprecated
- */
-export type JobParamsPDFDeprecated = BaseParamsPDF & BaseParams;
-
-/**
- * @deprecated
- */
-export type JobAppParamsPDF = Omit<JobParamsPDFDeprecated, 'browserTimezone' | 'version'>;
-
-/**
- * Structure of stored job data provided by create_job
- */
-export interface TaskPayloadPDF extends BasePayload {
-  layout: LayoutParams;
-  forceNow?: string;
-  objects: Array<{ relativeUrl: string }>;
-}
diff --git a/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts b/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts
deleted file mode 100644
index 58462b84c5eec2..00000000000000
--- a/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { LayoutParams } from '@kbn/screenshotting-plugin/common';
-import type { LocatorParams } from '../url';
-import type { BaseParams, BasePayload } from '../base';
-
-interface BaseParamsPDFV2 {
-  layout: LayoutParams;
-
-  /**
-   * This value is used to re-create the same visual state as when the report was requested as well as navigate to the correct page.
-   */
-  locatorParams: LocatorParams[];
-}
-
-// Job params: structure of incoming user request data, after being parsed from RISON
-export type JobParamsPDFV2 = BaseParamsPDFV2 & BaseParams;
-
-export type JobAppParamsPDFV2 = Omit<JobParamsPDFV2, 'browserTimezone' | 'version'>;
-
-// Job payload: structure of stored job data provided by create_job
-export interface TaskPayloadPDFV2 extends BasePayload, BaseParamsPDFV2 {
-  layout: LayoutParams;
-  /**
-   * The value of forceNow is injected server-side every time a given report is generated.
-   */
-  forceNow: string;
-}
diff --git a/x-pack/plugins/reporting/kibana.jsonc b/x-pack/plugins/reporting/kibana.jsonc
index e89e750ebe98cf..55518519a5898f 100644
--- a/x-pack/plugins/reporting/kibana.jsonc
+++ b/x-pack/plugins/reporting/kibana.jsonc
@@ -30,7 +30,7 @@
       "security",
       "spaces",
       "usageCollection",
-      "screenshotting",
+      "screenshotting"
     ],
     "requiredBundles": [
       "kibanaReact",
diff --git a/x-pack/plugins/reporting/public/lib/ilm_policy_status_context.tsx b/x-pack/plugins/reporting/public/lib/ilm_policy_status_context.tsx
index 78b2e77d09aeea..8c0013b14f95a6 100644
--- a/x-pack/plugins/reporting/public/lib/ilm_policy_status_context.tsx
+++ b/x-pack/plugins/reporting/public/lib/ilm_policy_status_context.tsx
@@ -7,8 +7,7 @@
 
 import type { FunctionComponent } from 'react';
 import React, { createContext, useContext } from 'react';
-
-import { IlmPolicyStatusResponse } from '../../common/types';
+import type { IlmPolicyStatusResponse } from '@kbn/reporting-common/types';
 
 import { useCheckIlmPolicyStatus } from './reporting_api_client';
 
diff --git a/x-pack/plugins/reporting/public/lib/job.test.ts b/x-pack/plugins/reporting/public/lib/job.test.ts
index 8e6ebe51cc66dd..3f1e64d57daf80 100644
--- a/x-pack/plugins/reporting/public/lib/job.test.ts
+++ b/x-pack/plugins/reporting/public/lib/job.test.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { jobTypes } from '../../common/constants';
 import { mockJobs } from '../../common/test';
-import * as jobTypes from '../../common/constants/job_types';
 import { Job } from './job';
 
 describe('Job', () => {
diff --git a/x-pack/plugins/reporting/public/lib/job.tsx b/x-pack/plugins/reporting/public/lib/job.tsx
index 6ce8617d703592..9aadb06bf5cc86 100644
--- a/x-pack/plugins/reporting/public/lib/job.tsx
+++ b/x-pack/plugins/reporting/public/lib/job.tsx
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
-import { EuiText, EuiTextColor } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { TaskRunResult } from '@kbn/reporting-common';
 import moment from 'moment';
 import React from 'react';
-import { JobTypes, JOB_STATUSES } from '../../common/constants';
+
+import { EuiText, EuiTextColor } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { JOB_STATUS } from '@kbn/reporting-common';
 import type {
   BaseParamsV2,
   JobId,
@@ -18,9 +18,12 @@ import type {
   ReportFields,
   ReportOutput,
   ReportSource,
-} from '../../common/types';
+  TaskRunResult,
+} from '@kbn/reporting-common/types';
+
+import { JobTypes } from '../../common/types';
 
-const { COMPLETED, FAILED, PENDING, PROCESSING, WARNINGS } = JOB_STATUSES;
+const { COMPLETED, FAILED, PENDING, PROCESSING, WARNINGS } = JOB_STATUS;
 
 type ReportPayload = ReportSource['payload'];
 
@@ -45,7 +48,7 @@ export class Job {
   public readonly created_at: ReportSource['created_at'];
   public readonly started_at: ReportSource['started_at'];
   public readonly completed_at: ReportSource['completed_at'];
-  public readonly status: JOB_STATUSES; // FIXME: can not use ReportSource['status'] due to type mismatch
+  public readonly status: JOB_STATUS; // FIXME: can not use ReportSource['status'] due to type mismatch
   public readonly attempts: ReportSource['attempts'];
   public readonly max_attempts: ReportSource['max_attempts'];
 
@@ -79,7 +82,7 @@ export class Job {
     this.created_at = report.created_at;
     this.started_at = report.started_at;
     this.completed_at = report.completed_at;
-    this.status = report.status as JOB_STATUSES;
+    this.status = report.status as JOB_STATUS;
     this.attempts = report.attempts;
     this.max_attempts = report.max_attempts;
 
@@ -164,7 +167,7 @@ export class Job {
   }
 
   public get isDownloadReady(): boolean {
-    return this.status === JOB_STATUSES.COMPLETED || this.status === JOB_STATUSES.WARNINGS;
+    return this.status === JOB_STATUS.COMPLETED || this.status === JOB_STATUS.WARNINGS;
   }
 
   public get prettyJobTypeName(): undefined | string {
@@ -179,6 +182,7 @@ export class Job {
         return i18n.translate('xpack.reporting.jobType.pngOutputName', {
           defaultMessage: 'PNG',
         });
+      case 'csv_v2':
       case 'csv_searchsource':
         return i18n.translate('xpack.reporting.jobType.csvOutputName', {
           defaultMessage: 'CSV',
@@ -319,7 +323,7 @@ export class Job {
   }
 }
 
-const jobStatusLabelsMap = new Map<JOB_STATUSES, string>([
+const jobStatusLabelsMap = new Map<JOB_STATUS, string>([
   [
     PENDING,
     i18n.translate('xpack.reporting.jobStatuses.pendingText', {
diff --git a/x-pack/plugins/reporting/public/lib/license_check.ts b/x-pack/plugins/reporting/public/lib/license_check.ts
index 80ecaefe8a853e..6145d9b02f7e8a 100644
--- a/x-pack/plugins/reporting/public/lib/license_check.ts
+++ b/x-pack/plugins/reporting/public/lib/license_check.ts
@@ -6,7 +6,7 @@
  */
 
 import { LicenseCheck } from '@kbn/licensing-plugin/public';
-import { LicenseCheckResults } from '../../common/types';
+import { LicenseCheckResults } from '@kbn/reporting-common/types';
 
 export const checkLicense = (checkResults: LicenseCheck): LicenseCheckResults => {
   switch (checkResults.state) {
diff --git a/x-pack/plugins/reporting/public/lib/reporting_api_client/hooks.ts b/x-pack/plugins/reporting/public/lib/reporting_api_client/hooks.ts
index 8410ec8f82019b..5ede6e11ee78ad 100644
--- a/x-pack/plugins/reporting/public/lib/reporting_api_client/hooks.ts
+++ b/x-pack/plugins/reporting/public/lib/reporting_api_client/hooks.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { IlmPolicyStatusResponse } from '@kbn/reporting-common/types';
 import { INTERNAL_ROUTES } from '../../../common/constants';
-import { IlmPolicyStatusResponse } from '../../../common/types';
 import { useKibana, useRequest, UseRequestResponse } from '../../shared_imports';
 
 export const useCheckIlmPolicyStatus = (): UseRequestResponse<IlmPolicyStatusResponse> => {
diff --git a/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.test.ts b/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.test.ts
index 8737c80e969f85..87483e98fe5dde 100644
--- a/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.test.ts
+++ b/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.test.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-jest.mock('moment', () => ({ tz: { guess: jest.fn() } }));
+import { tz } from 'moment-timezone';
 
-import { tz } from 'moment';
 import { HttpSetup, IUiSettingsClient } from '@kbn/core/public';
 import { httpServiceMock, uiSettingsServiceMock } from '@kbn/core/public/mocks';
 import { Job } from '../job';
diff --git a/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.ts b/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.ts
index 7e30866474991c..37b8c60f4fe163 100644
--- a/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.ts
+++ b/x-pack/plugins/reporting/public/lib/reporting_api_client/reporting_api_client.ts
@@ -8,17 +8,16 @@ import { ELASTIC_INTERNAL_ORIGIN_QUERY_PARAM } from '@kbn/core-http-common';
 import type { HttpFetchQuery } from '@kbn/core/public';
 import { HttpSetup, IUiSettingsClient } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
+import {
+  REPORTING_MANAGEMENT_HOME,
+  buildKibanaPath,
+  getRedirectAppPath,
+} from '@kbn/reporting-common';
+import { BaseParams, JobId, ManagementLinkFn, ReportApiJSON } from '@kbn/reporting-common/types';
 import rison from '@kbn/rison';
 import moment from 'moment';
 import { stringify } from 'query-string';
-import { buildKibanaPath } from '../../../common/build_kibana_path';
-import {
-  getRedirectAppPath,
-  INTERNAL_ROUTES,
-  PUBLIC_ROUTES,
-  REPORTING_MANAGEMENT_HOME,
-} from '../../../common/constants';
-import { BaseParams, JobId, ManagementLinkFn, ReportApiJSON } from '../../../common/types';
+import { INTERNAL_ROUTES, PUBLIC_ROUTES } from '../../../common/constants';
 import { add } from '../../notifier/job_completion_notifications';
 import { Job } from '../job';
 
diff --git a/x-pack/plugins/reporting/public/lib/stream_handler.test.ts b/x-pack/plugins/reporting/public/lib/stream_handler.test.ts
index ed3b973a95e64b..3c2aef023022ba 100644
--- a/x-pack/plugins/reporting/public/lib/stream_handler.test.ts
+++ b/x-pack/plugins/reporting/public/lib/stream_handler.test.ts
@@ -6,9 +6,12 @@
  */
 
 import sinon, { stub } from 'sinon';
+
 import { NotificationsStart } from '@kbn/core/public';
-import { coreMock, themeServiceMock, docLinksServiceMock } from '@kbn/core/public/mocks';
-import { JobSummary, ReportApiJSON } from '../../common/types';
+import { coreMock, docLinksServiceMock, themeServiceMock } from '@kbn/core/public/mocks';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
+
+import { JobSummary } from '../types';
 import { Job } from './job';
 import { ReportingAPIClient } from './reporting_api_client';
 import { ReportingNotifierStreamHandler } from './stream_handler';
diff --git a/x-pack/plugins/reporting/public/lib/stream_handler.ts b/x-pack/plugins/reporting/public/lib/stream_handler.ts
index ef27989a6d4202..6bdba0b9bf84df 100644
--- a/x-pack/plugins/reporting/public/lib/stream_handler.ts
+++ b/x-pack/plugins/reporting/public/lib/stream_handler.ts
@@ -5,20 +5,23 @@
  * 2.0.
  */
 
-import { i18n } from '@kbn/i18n';
 import * as Rx from 'rxjs';
 import { catchError, map } from 'rxjs/operators';
-import { NotificationsSetup, ThemeServiceStart, DocLinksStart } from '@kbn/core/public';
-import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY, JOB_STATUSES } from '../../common/constants';
-import { JobId, JobSummary, JobSummarySet } from '../../common/types';
+
+import { DocLinksStart, NotificationsSetup, ThemeServiceStart } from '@kbn/core/public';
+import { i18n } from '@kbn/i18n';
+import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY, JOB_STATUS } from '@kbn/reporting-common';
+import { JobId } from '@kbn/reporting-common/types';
+
 import {
   getFailureToast,
-  getWarningToast,
-  getSuccessToast,
   getGeneralErrorToast,
-  getWarningMaxSizeToast,
+  getSuccessToast,
   getWarningFormulasToast,
+  getWarningMaxSizeToast,
+  getWarningToast,
 } from '../notifier';
+import { JobSummary, JobSummarySet } from '../types';
 import { Job } from './job';
 import { ReportingAPIClient } from './reporting_api_client';
 
@@ -84,7 +87,7 @@ export class ReportingNotifierStreamHandler {
             ),
             completedOptions
           );
-        } else if (job.status === JOB_STATUSES.WARNINGS) {
+        } else if (job.status === JOB_STATUS.WARNINGS) {
           this.notifications.toasts.addWarning(
             getWarningToast(
               job,
@@ -141,9 +144,9 @@ export class ReportingNotifierStreamHandler {
         for (const job of jobs) {
           const { id: jobId, status: jobStatus } = job;
           if (storedJobs.includes(jobId)) {
-            if (jobStatus === JOB_STATUSES.COMPLETED || jobStatus === JOB_STATUSES.WARNINGS) {
+            if (jobStatus === JOB_STATUS.COMPLETED || jobStatus === JOB_STATUS.WARNINGS) {
               completedJobs.push(getReportStatus(job));
-            } else if (jobStatus === JOB_STATUSES.FAILED) {
+            } else if (jobStatus === JOB_STATUS.FAILED) {
               failedJobs.push(getReportStatus(job));
             } else {
               pending.push(jobId);
diff --git a/x-pack/plugins/reporting/public/management/components/ilm_policy_link.tsx b/x-pack/plugins/reporting/public/management/components/ilm_policy_link.tsx
index 092f33d06215c9..8bb72cddd6c765 100644
--- a/x-pack/plugins/reporting/public/management/components/ilm_policy_link.tsx
+++ b/x-pack/plugins/reporting/public/management/components/ilm_policy_link.tsx
@@ -7,11 +7,12 @@
 
 import type { FunctionComponent } from 'react';
 import React from 'react';
+
 import { i18n } from '@kbn/i18n';
 import { EuiButtonEmpty } from '@elastic/eui';
 import type { ApplicationStart } from '@kbn/core/public';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
 
-import { ILM_POLICY_NAME } from '../../../common/constants';
 import { LocatorPublic, SerializableRecord } from '../../shared_imports';
 
 interface Props {
diff --git a/x-pack/plugins/reporting/public/management/components/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx b/x-pack/plugins/reporting/public/management/components/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
index a1b0dbcd24c302..4e8d039251e818 100644
--- a/x-pack/plugins/reporting/public/management/components/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
+++ b/x-pack/plugins/reporting/public/management/components/migrate_ilm_policy_callout/ilm_policy_migration_needed_callout.tsx
@@ -5,16 +5,14 @@
  * 2.0.
  */
 
+import { EuiButton, EuiCallOut, EuiCode } from '@elastic/eui';
+import type { NotificationsSetup } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
 import type { FunctionComponent } from 'react';
 import React, { useState } from 'react';
 import useMountedState from 'react-use/lib/useMountedState';
-import { EuiCallOut, EuiButton, EuiCode } from '@elastic/eui';
-
-import type { NotificationsSetup } from '@kbn/core/public';
-
-import { ILM_POLICY_NAME } from '../../../../common/constants';
 
 import { useInternalApiClient } from '../../../lib/reporting_api_client';
 
diff --git a/x-pack/plugins/reporting/public/management/components/report_diagnostic.tsx b/x-pack/plugins/reporting/public/management/components/report_diagnostic.tsx
index dd59f34eb24a94..2e63ab4a6f253c 100644
--- a/x-pack/plugins/reporting/public/management/components/report_diagnostic.tsx
+++ b/x-pack/plugins/reporting/public/management/components/report_diagnostic.tsx
@@ -19,8 +19,8 @@ import {
   EuiText,
   EuiTitle,
 } from '@elastic/eui';
+import { ClientConfigType } from '@kbn/reporting-public';
 import { ReportingAPIClient, DiagnoseResponse } from '../../lib/reporting_api_client';
-import { ClientConfigType } from '../../plugin';
 
 interface Props {
   apiClient: ReportingAPIClient;
diff --git a/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx b/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx
index fa8fe07762791a..ca47477133f6f2 100644
--- a/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx
+++ b/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx
@@ -5,24 +5,23 @@
  * 2.0.
  */
 
+import moment from 'moment';
 import React, { FunctionComponent } from 'react';
-import { i18n } from '@kbn/i18n';
+
 import {
+  EuiCallOut,
   EuiDescriptionList,
   EuiDescriptionListProps,
-  EuiTitle,
-  EuiCallOut,
   EuiSpacer,
+  EuiTitle,
 } from '@elastic/eui';
-import moment from 'moment';
-import { VisualReportingSoftDisabledError } from '@kbn/reporting-common';
+import { i18n } from '@kbn/i18n';
+import { VisualReportingSoftDisabledError } from '@kbn/reporting-common/errors';
 
 import { USES_HEADLESS_JOB_TYPES } from '../../../common/constants';
-
 import type { Job } from '../../lib/job';
-import { useKibana } from '../../shared_imports';
-
 import { sharedI18nTexts } from '../../shared_i18n_texts';
+import { useKibana } from '../../shared_imports';
 
 // TODO: Move all of these i18n texts to ./i18n_texts.tsx
 const NA = i18n.translate('xpack.reporting.listing.infoPanel.notApplicableLabel', {
diff --git a/x-pack/plugins/reporting/public/management/components/report_status_indicator.tsx b/x-pack/plugins/reporting/public/management/components/report_status_indicator.tsx
index 3f15813cd4c2f3..08e58d538da3ba 100644
--- a/x-pack/plugins/reporting/public/management/components/report_status_indicator.tsx
+++ b/x-pack/plugins/reporting/public/management/components/report_status_indicator.tsx
@@ -8,9 +8,9 @@
 import React, { FC, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiLoadingSpinner, EuiToolTip } from '@elastic/eui';
+import { JOB_STATUS } from '@kbn/reporting-common/constants';
 
 import type { Job } from '../../lib/job';
-import { JOB_STATUSES } from '../../../common/constants';
 import { jobHasIssues } from '../utils';
 
 interface Props {
@@ -60,7 +60,7 @@ export const ReportStatusIndicator: FC<Props> = ({ job }) => {
   let statusText: string;
 
   switch (job.status) {
-    case JOB_STATUSES.COMPLETED:
+    case JOB_STATUS.COMPLETED:
       if (hasIssues) {
         icon = <EuiIcon type="warning" color="warning" />;
         statusText = i18nTexts.completedWithWarnings;
@@ -69,19 +69,19 @@ export const ReportStatusIndicator: FC<Props> = ({ job }) => {
       icon = <EuiIcon type="checkInCircleFilled" color="success" />;
       statusText = i18nTexts.completed;
       break;
-    case JOB_STATUSES.WARNINGS:
+    case JOB_STATUS.WARNINGS:
       icon = <EuiIcon type="warning" color="warning" />;
       statusText = i18nTexts.completedWithWarnings;
       break;
-    case JOB_STATUSES.PENDING:
+    case JOB_STATUS.PENDING:
       icon = <EuiLoadingSpinner />;
       statusText = i18nTexts.pending;
       break;
-    case JOB_STATUSES.PROCESSING:
+    case JOB_STATUS.PROCESSING:
       icon = <EuiLoadingSpinner />;
       statusText = i18nTexts.processing({ attempt: job.attempts, of: job.max_attempts });
       break;
-    case JOB_STATUSES.FAILED:
+    case JOB_STATUS.FAILED:
       icon = <EuiIcon type="error" color="danger" />;
       statusText = i18nTexts.failed;
       break;
diff --git a/x-pack/plugins/reporting/public/management/index.ts b/x-pack/plugins/reporting/public/management/index.ts
index c3e338af8ad3d2..4b9074267dd49a 100644
--- a/x-pack/plugins/reporting/public/management/index.ts
+++ b/x-pack/plugins/reporting/public/management/index.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { ApplicationStart, ToastsSetup } from '@kbn/core/public';
-import { LicensingPluginStart } from '@kbn/licensing-plugin/public';
-import { UseIlmPolicyStatusReturn } from '../lib/ilm_policy_status_context';
-import { ReportingAPIClient } from '../lib/reporting_api_client';
-import { ClientConfigType } from '../plugin';
+import type { ApplicationStart, ToastsSetup } from '@kbn/core/public';
+import type { LicensingPluginStart } from '@kbn/licensing-plugin/public';
+import type { ClientConfigType } from '@kbn/reporting-public';
+import type { UseIlmPolicyStatusReturn } from '../lib/ilm_policy_status_context';
+import type { ReportingAPIClient } from '../lib/reporting_api_client';
 import type { SharePluginSetup } from '../shared_imports';
 
 export interface ListingProps {
diff --git a/x-pack/plugins/reporting/public/management/mount_management_section.tsx b/x-pack/plugins/reporting/public/management/mount_management_section.tsx
index 4c994a5bb61b4d..60cd66d952780f 100644
--- a/x-pack/plugins/reporting/public/management/mount_management_section.tsx
+++ b/x-pack/plugins/reporting/public/management/mount_management_section.tsx
@@ -5,19 +5,20 @@
  * 2.0.
  */
 
-import { I18nProvider } from '@kbn/i18n-react';
 import * as React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { Observable } from 'rxjs';
+
 import { CoreSetup, CoreStart } from '@kbn/core/public';
+import { I18nProvider } from '@kbn/i18n-react';
 import { ILicense } from '@kbn/licensing-plugin/public';
 import { KibanaThemeProvider } from '@kbn/react-kibana-context-theme';
-import { ReportingAPIClient, InternalApiClientProvider } from '../lib/reporting_api_client';
+import type { ClientConfigType } from '@kbn/reporting-public';
+import { ReportListing } from '.';
 import { IlmPolicyStatusContextProvider } from '../lib/ilm_policy_status_context';
-import { ClientConfigType } from '../plugin';
+import { InternalApiClientProvider, ReportingAPIClient } from '../lib/reporting_api_client';
 import type { ManagementAppMountParams, SharePluginSetup } from '../shared_imports';
 import { KibanaContextProvider } from '../shared_imports';
-import { ReportListing } from '.';
 
 export async function mountManagementSection(
   coreSetup: CoreSetup,
diff --git a/x-pack/plugins/reporting/public/management/report_listing.test.ts b/x-pack/plugins/reporting/public/management/report_listing.test.ts
index 0ec0e47ea5132a..d43930cff5af98 100644
--- a/x-pack/plugins/reporting/public/management/report_listing.test.ts
+++ b/x-pack/plugins/reporting/public/management/report_listing.test.ts
@@ -5,16 +5,15 @@
  * 2.0.
  */
 
-import type { Observable } from 'rxjs';
 import { act } from 'react-dom/test-utils';
+import type { Observable } from 'rxjs';
 
 import type { ILicense } from '@kbn/licensing-plugin/public';
-import type { IlmPolicyMigrationStatus } from '../../common/types';
+import { IlmPolicyMigrationStatus } from '@kbn/reporting-common/types';
 
 import { ListingProps as Props } from '.';
-
-import { setup, TestBed, TestDependencies, mockJobs } from './__test__';
 import { Job } from '../lib/job';
+import { TestBed, TestDependencies, mockJobs, setup } from './__test__';
 import { mockConfig } from './__test__/report_listing.test.helpers';
 
 describe('ReportListing', () => {
diff --git a/x-pack/plugins/reporting/public/management/report_listing.tsx b/x-pack/plugins/reporting/public/management/report_listing.tsx
index d6289bc2032f97..31976dd196a9ad 100644
--- a/x-pack/plugins/reporting/public/management/report_listing.tsx
+++ b/x-pack/plugins/reporting/public/management/report_listing.tsx
@@ -5,41 +5,44 @@
  * 2.0.
  */
 
+import { Component, Fragment, default as React } from 'react';
+import { Subscription } from 'rxjs';
+
 import {
   EuiBasicTable,
+  EuiBasicTableColumn,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiIconTip,
+  EuiLink,
   EuiLoadingSpinner,
   EuiPageHeader,
   EuiSpacer,
-  EuiBasicTableColumn,
-  EuiIconTip,
-  EuiLink,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { Component, default as React, Fragment } from 'react';
-import { Subscription } from 'rxjs';
 import { ILicense } from '@kbn/licensing-plugin/public';
+import { durationToNumber } from '@kbn/reporting-common';
+
+import { ListingProps as Props } from '.';
 import { REPORT_TABLE_ID, REPORT_TABLE_ROW_ID } from '../../common/constants';
 import { prettyPrintJobType } from '../../common/job_utils';
 import { Poller } from '../../common/poller';
-import { durationToNumber } from '../../common/schema_utils';
 import { useIlmPolicyStatus } from '../lib/ilm_policy_status_context';
 import { Job } from '../lib/job';
 import { checkLicense } from '../lib/license_check';
 import { useInternalApiClient } from '../lib/reporting_api_client';
 import { useKibana } from '../shared_imports';
-import { ListingProps as Props } from '.';
 import {
   IlmPolicyLink,
   MigrateIlmPolicyCallOut,
   ReportDeleteButton,
   ReportDiagnostic,
-  ReportStatusIndicator,
   ReportInfoFlyout,
+  ReportStatusIndicator,
 } from './components';
 import { guessAppIconTypeFromObjectType } from './utils';
+
 import './report_listing.scss';
 
 type TableColumn = EuiBasicTableColumn<Job>;
diff --git a/x-pack/plugins/reporting/public/management/utils.ts b/x-pack/plugins/reporting/public/management/utils.ts
index 87e49c2054f923..b26c5fdf580461 100644
--- a/x-pack/plugins/reporting/public/management/utils.ts
+++ b/x-pack/plugins/reporting/public/management/utils.ts
@@ -6,7 +6,7 @@
  */
 
 import type { IconType } from '@elastic/eui';
-import { JOB_STATUSES } from '../../common/constants';
+import { JOB_STATUS } from '@kbn/reporting-common';
 import { Job } from '../lib/job';
 
 /**
@@ -35,6 +35,6 @@ export const guessAppIconTypeFromObjectType = (type: string): IconType => {
 export const jobHasIssues = (job: Job): boolean => {
   return (
     Boolean(job.getWarnings()) ||
-    [JOB_STATUSES.WARNINGS, JOB_STATUSES.FAILED].some((status) => job.status === status)
+    [JOB_STATUS.WARNINGS, JOB_STATUS.FAILED].some((status) => job.status === status)
   );
 };
diff --git a/x-pack/plugins/reporting/public/notifier/job_completion_notifications.ts b/x-pack/plugins/reporting/public/notifier/job_completion_notifications.ts
index c4addfa3eedef3..61db874e75208a 100644
--- a/x-pack/plugins/reporting/public/notifier/job_completion_notifications.ts
+++ b/x-pack/plugins/reporting/public/notifier/job_completion_notifications.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY } from '../../common/constants';
-
-type JobId = string;
+import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY } from '@kbn/reporting-common';
+import { JobId } from '@kbn/reporting-common/types';
 
 const set = (jobs: string[]) => {
   sessionStorage.setItem(JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY, JSON.stringify(jobs));
diff --git a/x-pack/plugins/reporting/public/notifier/job_download_button.tsx b/x-pack/plugins/reporting/public/notifier/job_download_button.tsx
index 05f92a4ed36106..5b7cd42f78a16d 100644
--- a/x-pack/plugins/reporting/public/notifier/job_download_button.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_download_button.tsx
@@ -7,8 +7,9 @@
 
 import { EuiButton } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
+import { JobId } from '@kbn/reporting-common/types';
 import React from 'react';
-import { JobId, JobSummary } from '../../common/types';
+import { JobSummary } from '../types';
 
 interface Props {
   getUrl: (jobId: JobId) => string;
diff --git a/x-pack/plugins/reporting/public/notifier/job_failure.tsx b/x-pack/plugins/reporting/public/notifier/job_failure.tsx
index b1e318a785b7e1..e5c6f06413bdfd 100644
--- a/x-pack/plugins/reporting/public/notifier/job_failure.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_failure.tsx
@@ -11,8 +11,9 @@ import React from 'react';
 import { DocLinksStart, ThemeServiceStart, ToastInput } from '@kbn/core/public';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
 import * as errors from '@kbn/reporting-common/errors';
-import type { JobSummary, ManagementLinkFn } from '../../common/types';
+import { ManagementLinkFn } from '@kbn/reporting-common/types';
 import { sharedI18nTexts } from '../shared_i18n_texts';
+import type { JobSummary } from '../types';
 
 export const getFailureToast = (
   errorText: string,
diff --git a/x-pack/plugins/reporting/public/notifier/job_success.tsx b/x-pack/plugins/reporting/public/notifier/job_success.tsx
index 44389e164472ac..00b08ed2413d90 100644
--- a/x-pack/plugins/reporting/public/notifier/job_success.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_success.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import { FormattedMessage } from '@kbn/i18n-react';
-import React from 'react';
 import { ThemeServiceStart, ToastInput } from '@kbn/core/public';
+import { FormattedMessage } from '@kbn/i18n-react';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
-import { JobId, JobSummary } from '../../common/types';
+import { JobId } from '@kbn/reporting-common/types';
+import React from 'react';
+import { JobSummary } from '../types';
 import { DownloadButton } from './job_download_button';
 import { ReportLink } from './report_link';
 
diff --git a/x-pack/plugins/reporting/public/notifier/job_warning.tsx b/x-pack/plugins/reporting/public/notifier/job_warning.tsx
index 9df5bbbc913e2e..6751eb76ab0734 100644
--- a/x-pack/plugins/reporting/public/notifier/job_warning.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_warning.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import { FormattedMessage } from '@kbn/i18n-react';
-import React from 'react';
 import { ThemeServiceStart, ToastInput } from '@kbn/core/public';
+import { FormattedMessage } from '@kbn/i18n-react';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
-import { JobId, JobSummary } from '../../common/types';
+import { JobId } from '@kbn/reporting-common/types';
+import React from 'react';
+import { JobSummary } from '../types';
 import { DownloadButton } from './job_download_button';
 import { ReportLink } from './report_link';
 
diff --git a/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx b/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx
index 314610b9b9f29c..4cf9f3f655cc1f 100644
--- a/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_warning_formulas.tsx
@@ -5,12 +5,15 @@
  * 2.0.
  */
 
-import { FormattedMessage } from '@kbn/i18n-react';
 import React from 'react';
+
 import { ThemeServiceStart, ToastInput } from '@kbn/core/public';
+import { FormattedMessage } from '@kbn/i18n-react';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
-import { JobId, JobSummary } from '../../common/types';
+import { JobId } from '@kbn/reporting-common/types';
 import { DownloadButton } from './job_download_button';
+
+import { JobSummary } from '../types';
 import { ReportLink } from './report_link';
 
 export const getWarningFormulasToast = (
diff --git a/x-pack/plugins/reporting/public/notifier/job_warning_max_size.tsx b/x-pack/plugins/reporting/public/notifier/job_warning_max_size.tsx
index 41d97ae4d7f3e7..54c76282420676 100644
--- a/x-pack/plugins/reporting/public/notifier/job_warning_max_size.tsx
+++ b/x-pack/plugins/reporting/public/notifier/job_warning_max_size.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import { FormattedMessage } from '@kbn/i18n-react';
-import React from 'react';
 import { ThemeServiceStart, ToastInput } from '@kbn/core/public';
+import { FormattedMessage } from '@kbn/i18n-react';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
-import { JobId, JobSummary } from '../../common/types';
+import type { JobId } from '@kbn/reporting-common/types';
+import React from 'react';
+import { JobSummary } from '../types';
 import { DownloadButton } from './job_download_button';
 import { ReportLink } from './report_link';
 
diff --git a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.test.ts b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.test.ts
index ab5be8a06defd8..5bf73525c2dcc5 100644
--- a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.test.ts
+++ b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.test.ts
@@ -15,7 +15,7 @@ import { coreMock } from '@kbn/core/public/mocks';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/public/mocks';
 import { ReportingAPIClient } from '../lib/reporting_api_client';
-import type { ReportingPublicPluginStartDendencies } from '../plugin';
+import type { ReportingPublicPluginStartDependencies } from '../plugin';
 import type { ActionContext } from './get_csv_panel_action';
 import { ReportingCsvPanelAction } from './get_csv_panel_action';
 
@@ -26,7 +26,7 @@ describe('GetCsvReportPanelAction', () => {
   let context: ActionContext;
   let mockLicenseState: LicenseCheckState;
   let mockSearchSource: SearchSource;
-  let mockStartServicesPayload: [CoreStart, ReportingPublicPluginStartDendencies, unknown];
+  let mockStartServicesPayload: [CoreStart, ReportingPublicPluginStartDependencies, unknown];
   let mockStartServices$: Rx.Observable<typeof mockStartServicesPayload>;
 
   const mockLicense$ = () => {
@@ -64,7 +64,7 @@ describe('GetCsvReportPanelAction', () => {
       {
         data: dataPluginMock.createStartContract(),
         licensing: { ...licensingMock.createStart(), license$: mockLicense$() },
-      } as unknown as ReportingPublicPluginStartDendencies,
+      } as unknown as ReportingPublicPluginStartDependencies,
       null,
     ];
     mockStartServices$ = Rx.from(Promise.resolve(mockStartServicesPayload));
diff --git a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
index 497d52b9444400..40a231a5220e97 100644
--- a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
+++ b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
@@ -5,21 +5,24 @@
  * 2.0.
  */
 
-import { i18n } from '@kbn/i18n';
-import * as Rx from 'rxjs';
+import { firstValueFrom, Observable } from 'rxjs';
+
 import type { CoreSetup, NotificationsSetup } from '@kbn/core/public';
 import { CoreStart } from '@kbn/core/public';
 import type { ISearchEmbeddable } from '@kbn/discover-plugin/public';
-import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import { loadSharingDataHelpers, SEARCH_EMBEDDABLE_TYPE } from '@kbn/discover-plugin/public';
 import type { IEmbeddable } from '@kbn/embeddable-plugin/public';
 import { ViewMode } from '@kbn/embeddable-plugin/public';
+import { i18n } from '@kbn/i18n';
+import { CSV_REPORTING_ACTION } from '@kbn/reporting-export-types-csv-common';
+import type { SavedSearch } from '@kbn/saved-search-plugin/public';
 import type { UiActionsActionDefinition as ActionDefinition } from '@kbn/ui-actions-plugin/public';
 import { IncompatibleActionError } from '@kbn/ui-actions-plugin/public';
-import { CSV_REPORTING_ACTION } from '@kbn/reporting-common';
+
 import { checkLicense } from '../lib/license_check';
 import { ReportingAPIClient } from '../lib/reporting_api_client';
-import type { ReportingPublicPluginStartDendencies } from '../plugin';
+import type { ReportingPublicPluginStartDependencies } from '../plugin';
+
 function isSavedSearchEmbeddable(
   embeddable: IEmbeddable | ISearchEmbeddable
 ): embeddable is ISearchEmbeddable {
@@ -33,7 +36,7 @@ export interface ActionContext {
 interface Params {
   apiClient: ReportingAPIClient;
   core: CoreSetup;
-  startServices$: Rx.Observable<[CoreStart, ReportingPublicPluginStartDendencies, unknown]>;
+  startServices$: Observable<[CoreStart, ReportingPublicPluginStartDependencies, unknown]>;
   usesUiCapabilities: boolean;
 }
 
@@ -69,7 +72,7 @@ export class ReportingCsvPanelAction implements ActionDefinition<ActionContext>
   }
 
   public async getSharingData(savedSearch: SavedSearch) {
-    const [{ uiSettings }, { data }] = await Rx.firstValueFrom(this.startServices$);
+    const [{ uiSettings }, { data }] = await firstValueFrom(this.startServices$);
     const { getSharingData } = await loadSharingDataHelpers();
     return await getSharingData(savedSearch.searchSource, savedSearch, { uiSettings, data });
   }
diff --git a/x-pack/plugins/reporting/public/plugin.ts b/x-pack/plugins/reporting/public/plugin.ts
index 46e425b54239d8..fd315269e32a5d 100644
--- a/x-pack/plugins/reporting/public/plugin.ts
+++ b/x-pack/plugins/reporting/public/plugin.ts
@@ -5,10 +5,9 @@
  * 2.0.
  */
 
-import { i18n } from '@kbn/i18n';
 import * as Rx from 'rxjs';
 import { catchError, filter, map, mergeMap, takeUntil } from 'rxjs/operators';
-import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
+
 import {
   CoreSetup,
   CoreStart,
@@ -19,18 +18,25 @@ import {
   PluginInitializerContext,
   ThemeServiceStart,
 } from '@kbn/core/public';
-import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
+import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import { CONTEXT_MENU_TRIGGER } from '@kbn/embeddable-plugin/public';
 import type { HomePublicPluginSetup, HomePublicPluginStart } from '@kbn/home-plugin/public';
-import { ManagementSetup, ManagementStart } from '@kbn/management-plugin/public';
+import { i18n } from '@kbn/i18n';
 import { LicensingPluginStart } from '@kbn/licensing-plugin/public';
-import { durationToNumber } from '../common/schema_utils';
-import { JobId, JobSummarySet } from '../common/types';
-import { ReportingSetup, ReportingStart } from '.';
+import { ManagementSetup, ManagementStart } from '@kbn/management-plugin/public';
+import { ClientConfigType } from '@kbn/reporting-public';
+import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
+
+import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY, durationToNumber } from '@kbn/reporting-common';
+import type { JobId } from '@kbn/reporting-common/types';
+
+import type { ReportingSetup, ReportingStart } from '.';
 import { ReportingAPIClient } from './lib/reporting_api_client';
 import { ReportingNotifierStreamHandler as StreamHandler } from './lib/stream_handler';
 import { getGeneralErrorToast } from './notifier';
 import { ReportingCsvPanelAction } from './panel_actions/get_csv_panel_action';
+import { reportingCsvShareProvider } from './share_context_menu/register_csv_reporting';
+import { reportingScreenshotShareProvider } from './share_context_menu/register_pdf_png_reporting';
 import { getSharedComponents } from './shared';
 import type {
   SharePluginSetup,
@@ -39,17 +45,7 @@ import type {
   UiActionsStart,
 } from './shared_imports';
 import { AppNavLinkStatus } from './shared_imports';
-import { reportingCsvShareProvider } from './share_context_menu/register_csv_reporting';
-import { reportingScreenshotShareProvider } from './share_context_menu/register_pdf_png_reporting';
-import { JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY } from '../common/constants';
-
-export interface ClientConfigType {
-  poll: { jobsRefresh: { interval: number; intervalErrorMultiplier: number } };
-  roles: { enabled: boolean };
-  export_types: { pdf: { enabled: boolean }; png: { enabled: boolean }; csv: { enabled: boolean } };
-  statefulSettings: { enabled: boolean };
-}
-
+import type { JobSummarySet } from './types';
 function getStored(): JobId[] {
   const sessionValue = sessionStorage.getItem(JOB_COMPLETION_NOTIFICATIONS_SESSION_KEY);
   return sessionValue ? JSON.parse(sessionValue) : [];
@@ -73,7 +69,7 @@ function handleError(
   return Rx.of({ completed: [], failed: [] });
 }
 
-export interface ReportingPublicPluginSetupDendencies {
+export interface ReportingPublicPluginSetupDependencies {
   home: HomePublicPluginSetup;
   management: ManagementSetup;
   uiActions: UiActionsSetup;
@@ -81,7 +77,7 @@ export interface ReportingPublicPluginSetupDendencies {
   share: SharePluginSetup;
 }
 
-export interface ReportingPublicPluginStartDendencies {
+export interface ReportingPublicPluginStartDependencies {
   home: HomePublicPluginStart;
   data: DataPublicPluginStart;
   management: ManagementStart;
@@ -99,8 +95,8 @@ export class ReportingPublicPlugin
     Plugin<
       ReportingSetup,
       ReportingStart,
-      ReportingPublicPluginSetupDendencies,
-      ReportingPublicPluginStartDendencies
+      ReportingPublicPluginSetupDependencies,
+      ReportingPublicPluginStartDependencies
     >
 {
   private kibanaVersion: string;
@@ -146,8 +142,8 @@ export class ReportingPublicPlugin
   }
 
   public setup(
-    core: CoreSetup<ReportingPublicPluginStartDendencies>,
-    setupDeps: ReportingPublicPluginSetupDendencies
+    core: CoreSetup<ReportingPublicPluginStartDependencies>,
+    setupDeps: ReportingPublicPluginSetupDependencies
   ) {
     const { getStartServices, uiSettings } = core;
     const { home, management, screenshotMode, share, uiActions } = setupDeps;
diff --git a/x-pack/plugins/reporting/public/redirect/redirect_app.tsx b/x-pack/plugins/reporting/public/redirect/redirect_app.tsx
index c7ce0b8d5b24fe..f26fae4e85763e 100644
--- a/x-pack/plugins/reporting/public/redirect/redirect_app.tsx
+++ b/x-pack/plugins/reporting/public/redirect/redirect_app.tsx
@@ -5,18 +5,18 @@
  * 2.0.
  */
 
-import React, { useEffect, useState } from 'react';
-import type { FunctionComponent } from 'react';
 import { parse } from 'query-string';
-import { i18n } from '@kbn/i18n';
+import type { FunctionComponent } from 'react';
+import React, { useEffect, useState } from 'react';
+
 import { EuiCallOut, EuiCodeBlock } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 
 import type { ScopedHistory } from '@kbn/core/public';
+import { REPORTING_REDIRECT_LOCATOR_STORE_KEY } from '@kbn/reporting-common';
+import { LocatorParams } from '@kbn/reporting-common/types';
 import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/public';
 
-import { REPORTING_REDIRECT_LOCATOR_STORE_KEY } from '../../common/constants';
-import { LocatorParams } from '../../common/types';
-
 import { ReportingAPIClient } from '../lib/reporting_api_client';
 import type { SharePluginSetup } from '../shared_imports';
 
diff --git a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
index 363eedfafa1707..17f26c6c34e8ab 100644
--- a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
+++ b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
@@ -7,11 +7,13 @@
 
 import { i18n } from '@kbn/i18n';
 import React from 'react';
+
+import { CSV_JOB_TYPE } from '@kbn/reporting-export-types-csv-common';
+
 import type { SearchSourceFields } from '@kbn/data-plugin/common';
 import { ShareContext, ShareMenuProvider } from '@kbn/share-plugin/public';
-import { CSV_JOB_TYPE } from '../../common/constants';
 import { checkLicense } from '../lib/license_check';
-import { ExportPanelShareOpts } from '.';
+import type { ExportPanelShareOpts } from '.';
 import { ReportingPanelContent } from './reporting_panel_content_lazy';
 
 export const reportingCsvShareProvider = ({
diff --git a/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/reporting_panel_content.tsx b/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/reporting_panel_content.tsx
index 58358d33f5b1fe..920f74a4f2bbab 100644
--- a/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/reporting_panel_content.tsx
+++ b/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/reporting_panel_content.tsx
@@ -5,6 +5,13 @@
  * 2.0.
  */
 
+import React, { Component, ReactElement } from 'react';
+import url from 'url';
+
+import { CSV_REPORT_TYPE } from '@kbn/reporting-export-types-csv-common';
+import { PDF_REPORT_TYPE, PDF_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-pdf-common';
+import { PNG_REPORT_TYPE, PNG_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-png-common';
+
 import {
   EuiAccordion,
   EuiButton,
@@ -15,20 +22,12 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
+import { IUiSettingsClient, ThemeServiceSetup, ToastsSetup } from '@kbn/core/public';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage, InjectedIntl, injectI18n } from '@kbn/i18n-react';
-import React, { Component, ReactElement } from 'react';
-import { IUiSettingsClient, ThemeServiceSetup, ToastsSetup } from '@kbn/core/public';
-import url from 'url';
 import { toMountPoint } from '@kbn/kibana-react-plugin/public';
-import {
-  CSV_REPORT_TYPE,
-  PDF_REPORT_TYPE,
-  PDF_REPORT_TYPE_V2,
-  PNG_REPORT_TYPE,
-  PNG_REPORT_TYPE_V2,
-} from '../../../common/constants';
-import { BaseParams } from '../../../common/types';
+import type { BaseParams } from '@kbn/reporting-common/types';
+
 import { ReportingAPIClient } from '../../lib/reporting_api_client';
 import { ErrorUnsavedWorkPanel, ErrorUrlTooLongPanel } from './components';
 import { getMaxUrlLength } from './constants';
diff --git a/x-pack/plugins/reporting/public/shared/get_shared_components.tsx b/x-pack/plugins/reporting/public/shared/get_shared_components.tsx
index ba6b1c6d1a9298..577f0135f137de 100644
--- a/x-pack/plugins/reporting/public/shared/get_shared_components.tsx
+++ b/x-pack/plugins/reporting/public/shared/get_shared_components.tsx
@@ -7,7 +7,10 @@
 
 import { CoreSetup } from '@kbn/core/public';
 import React from 'react';
-import { PDF_REPORT_TYPE, PDF_REPORT_TYPE_V2, PNG_REPORT_TYPE_V2 } from '../../common/constants';
+
+import { PDF_REPORT_TYPE, PDF_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-pdf-common';
+import { PNG_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-png-common';
+
 import { ReportingAPIClient } from '../lib/reporting_api_client';
 import { ReportingPanelProps } from '../share_context_menu/reporting_panel_content';
 import { ScreenCapturePanelContent } from '../share_context_menu/screen_capture_panel_content_lazy';
diff --git a/x-pack/plugins/reporting/public/types.ts b/x-pack/plugins/reporting/public/types.ts
index 3be354bada72e1..5b88f2abbf5bd7 100644
--- a/x-pack/plugins/reporting/public/types.ts
+++ b/x-pack/plugins/reporting/public/types.ts
@@ -6,6 +6,24 @@
  */
 
 import type { CoreSetup, CoreStart } from '@kbn/core/public';
+import { JOB_STATUS } from '@kbn/reporting-common';
+import type { JobId, ReportOutput, ReportSource, TaskRunResult } from '@kbn/reporting-common/types';
+
+/* Notifier Toasts */
+export interface JobSummary {
+  id: JobId;
+  status: JOB_STATUS;
+  jobtype: ReportSource['jobtype'];
+  title: ReportSource['payload']['title'];
+  errorCode?: ReportOutput['error_code'];
+  maxSizeReached: TaskRunResult['max_size_reached'];
+  csvContainsFormulas: TaskRunResult['csv_contains_formulas'];
+}
+
+export interface JobSummarySet {
+  completed: JobSummary[];
+  failed: JobSummary[];
+}
 
 export interface KibanaContext {
   http: CoreSetup['http'];
diff --git a/x-pack/plugins/reporting/server/config/create_config.test.ts b/x-pack/plugins/reporting/server/config/create_config.test.ts
index dbb16d050297f1..bd65ad245e89d8 100644
--- a/x-pack/plugins/reporting/server/config/create_config.test.ts
+++ b/x-pack/plugins/reporting/server/config/create_config.test.ts
@@ -7,7 +7,7 @@
 
 import type { CoreSetup, HttpServerInfo, Logger } from '@kbn/core/server';
 import { coreMock, loggingSystemMock } from '@kbn/core/server/mocks';
-import { createMockConfigSchema } from '../test_helpers';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { createConfig } from './create_config';
 
 describe('Reporting server createConfig', () => {
diff --git a/x-pack/plugins/reporting/server/config/create_config.ts b/x-pack/plugins/reporting/server/config/create_config.ts
index 54cd09a0a9dddc..3841b2920a8eb2 100644
--- a/x-pack/plugins/reporting/server/config/create_config.ts
+++ b/x-pack/plugins/reporting/server/config/create_config.ts
@@ -7,9 +7,10 @@
 
 import crypto from 'crypto';
 import ipaddr from 'ipaddr.js';
-import type { CoreSetup, Logger } from '@kbn/core/server';
 import { sum } from 'lodash';
-import { ReportingConfigType } from './schema';
+
+import type { CoreSetup, Logger } from '@kbn/core/server';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 
 /*
  * Set up dynamic config defaults
diff --git a/x-pack/plugins/reporting/server/config/index.ts b/x-pack/plugins/reporting/server/config/index.ts
index 3bb4b79dd6fc85..5965693e37c132 100644
--- a/x-pack/plugins/reporting/server/config/index.ts
+++ b/x-pack/plugins/reporting/server/config/index.ts
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
+import { get } from 'lodash';
+
 import { PluginConfigDescriptor } from '@kbn/core/server';
 import { i18n } from '@kbn/i18n';
-import { get } from 'lodash';
-import { ConfigSchema, ReportingConfigType } from './schema';
+import { ConfigSchema, ReportingConfigType } from '@kbn/reporting-server';
 
 export const config: PluginConfigDescriptor<ReportingConfigType> = {
   exposeToBrowser: { poll: true, roles: true, export_types: true, statefulSettings: true },
@@ -71,4 +72,3 @@ export const config: PluginConfigDescriptor<ReportingConfigType> = {
 export { createConfig } from './create_config';
 export { registerUiSettings } from './ui_settings';
 export { ConfigSchema };
-export type { ReportingConfigType };
diff --git a/x-pack/plugins/reporting/server/config/ui_settings.ts b/x-pack/plugins/reporting/server/config/ui_settings.ts
index f6122a814d6f78..cb4a5ca4ec09b7 100644
--- a/x-pack/plugins/reporting/server/config/ui_settings.ts
+++ b/x-pack/plugins/reporting/server/config/ui_settings.ts
@@ -6,10 +6,9 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { i18n } from '@kbn/i18n';
 import { CoreSetup, UiSettingsParams } from '@kbn/core/server';
-import { UI_SETTINGS_CUSTOM_PDF_LOGO } from '@kbn/reporting-common';
-import { PLUGIN_ID } from '../../common/constants';
+import { i18n } from '@kbn/i18n';
+import { PLUGIN_ID, UI_SETTINGS_CUSTOM_PDF_LOGO } from '@kbn/reporting-common';
 
 const kbToBase64Length = (kb: number) => Math.floor((kb * 1024 * 8) / 6);
 const maxLogoSizeInBase64 = kbToBase64Length(200);
diff --git a/x-pack/plugins/reporting/server/core.ts b/x-pack/plugins/reporting/server/core.ts
index c240d6d165704e..c4af9d15f8c4c4 100644
--- a/x-pack/plugins/reporting/server/core.ts
+++ b/x-pack/plugins/reporting/server/core.ts
@@ -5,6 +5,9 @@
  * 2.0.
  */
 
+import * as Rx from 'rxjs';
+import { map, take } from 'rxjs/operators';
+
 import type {
   CoreSetup,
   DocLinksServiceSetup,
@@ -23,12 +26,17 @@ import type { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
 import type { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
 import type { FieldFormatsStart } from '@kbn/field-formats-plugin/server';
 import type { LicensingPluginStart } from '@kbn/licensing-plugin/server';
+import type { ReportingServerInfo } from '@kbn/reporting-common/types';
 import {
-  PdfScreenshotResult,
-  PngScreenshotResult,
-  ScreenshotOptions,
-  ScreenshottingStart,
-} from '@kbn/screenshotting-plugin/server';
+  CsvSearchSourceExportType,
+  CsvSearchSourceImmediateExportType,
+  CsvV2ExportType,
+} from '@kbn/reporting-export-types-csv';
+import { PdfExportType, PdfV1ExportType } from '@kbn/reporting-export-types-pdf';
+import { PngExportType } from '@kbn/reporting-export-types-png';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+import { ExportType } from '@kbn/reporting-server';
+import { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
 import type { SecurityPluginSetup, SecurityPluginStart } from '@kbn/security-plugin/server';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common';
 import type { SpacesPluginSetup } from '@kbn/spaces-plugin/server';
@@ -37,23 +45,14 @@ import type {
   TaskManagerStartContract,
 } from '@kbn/task-manager-plugin/server';
 import type { UsageCounter } from '@kbn/usage-collection-plugin/server';
-import * as Rx from 'rxjs';
-import { map, switchMap, take } from 'rxjs/operators';
+
 import type { ReportingSetup } from '.';
-import { REPORTING_REDIRECT_LOCATOR_STORE_KEY } from '../common/constants';
-import { createConfig, ReportingConfigType } from './config';
-import { CsvSearchSourceExportType } from './export_types/csv_searchsource';
-import { CsvV2ExportType } from './export_types/csv_v2';
-import { PdfV1ExportType } from './export_types/printable_pdf';
-import { PdfExportType } from './export_types/printable_pdf_v2';
-import { PngExportType } from './export_types/png_v2';
-import { checkLicense, ExportTypesRegistry } from './lib';
+import { createConfig } from './config';
+import { ExportTypesRegistry, checkLicense } from './lib';
 import { reportingEventLoggerFactory } from './lib/event_logger/logger';
 import type { IReport, ReportingStore } from './lib/store';
 import { ExecuteReportTask, MonitorReportsTask, ReportTaskParams } from './lib/tasks';
-import type { PdfScreenshotOptions, PngScreenshotOptions, ReportingPluginRouter } from './types';
-import { CsvSearchSourceImmediateExportType } from './export_types/csv_searchsource_immediate';
-import { ExportType } from './export_types/common';
+import type { ReportingPluginRouter } from './types';
 
 export interface ReportingInternalSetup {
   basePath: Pick<IBasePath, 'set'>;
@@ -83,18 +82,6 @@ export interface ReportingInternalStart {
   taskManager: TaskManagerStartContract;
 }
 
-/**
- * @internal
- */
-export interface ReportingServerInfo {
-  port: number;
-  name: string;
-  uuid: string;
-  basePath: string;
-  protocol: string;
-  hostname: string;
-}
-
 /**
  * @internal
  */
@@ -134,7 +121,6 @@ export class ReportingCore {
     this.getContract = () => ({
       usesUiCapabilities: () => config.roles.enabled === false,
       registerExportTypes: (id) => id,
-      getScreenshots: config.statefulSettings.enabled ? this.getScreenshots.bind(this) : undefined,
       getSpaceId: this.getSpaceId.bind(this),
     });
 
@@ -171,7 +157,7 @@ export class ReportingCore {
     this.pluginStartDeps = startDeps; // cache
 
     this.exportTypesRegistry.getAll().forEach((et) => {
-      et.start({ ...startDeps, reporting: this.getContract() });
+      et.start({ ...startDeps });
     });
 
     const { taskManager } = startDeps;
@@ -401,25 +387,6 @@ export class ReportingCore {
     }
   }
 
-  public getScreenshots(options: PdfScreenshotOptions): Rx.Observable<PdfScreenshotResult>;
-  public getScreenshots(options: PngScreenshotOptions): Rx.Observable<PngScreenshotResult>;
-  public getScreenshots(
-    options: PngScreenshotOptions | PdfScreenshotOptions
-  ): Rx.Observable<PngScreenshotResult | PdfScreenshotResult> {
-    return Rx.defer(() => this.getPluginStartDeps()).pipe(
-      switchMap(({ screenshotting }) => {
-        return screenshotting!.getScreenshots({
-          ...options,
-          urls: options.urls.map((url) =>
-            typeof url === 'string'
-              ? url
-              : [url[0], { [REPORTING_REDIRECT_LOCATOR_STORE_KEY]: url[1] }]
-          ),
-        } as ScreenshotOptions);
-      })
-    );
-  }
-
   public trackReport(reportId: string) {
     this.executing.add(reportId);
   }
@@ -447,7 +414,7 @@ export class ReportingCore {
       this.context
     );
     csvImmediateExport.setup(this.getPluginSetupDeps());
-    csvImmediateExport.start({ ...startDeps, reporting: this.getContract() });
+    csvImmediateExport.start({ ...startDeps });
     return csvImmediateExport;
   }
 }
diff --git a/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.test.ts b/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.test.ts
index 5dbbb9e9570c13..9f0a10b861adb9 100644
--- a/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.test.ts
+++ b/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.test.ts
@@ -7,9 +7,10 @@
 
 import type { GetDeprecationsContext } from '@kbn/core/server';
 import { elasticsearchServiceMock, savedObjectsClientMock } from '@kbn/core/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 
 import { ReportingCore } from '../core';
-import { createMockConfigSchema, createMockReportingCore } from '../test_helpers';
+import { createMockReportingCore } from '../test_helpers';
 
 import { getDeprecationsInfo } from './migrate_existing_indices_ilm_policy';
 
diff --git a/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.ts b/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.ts
index 6f0ddba9ce2967..d7c6e1fd9fc2a2 100644
--- a/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.ts
+++ b/x-pack/plugins/reporting/server/deprecations/migrate_existing_indices_ilm_policy.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-import { i18n } from '@kbn/i18n';
 import { DeprecationsDetails, GetDeprecationsContext } from '@kbn/core/server';
-import { INTERNAL_ROUTES, ILM_POLICY_NAME } from '../../common/constants';
+import { i18n } from '@kbn/i18n';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
+import { INTERNAL_ROUTES } from '../../common/constants';
 import { ReportingCore } from '../core';
 import { deprecations } from '../lib/deprecations';
 
diff --git a/x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts b/x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts
index 66559270290561..4f58767e78b060 100644
--- a/x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts
+++ b/x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts
@@ -7,12 +7,9 @@
 
 import { GetDeprecationsContext, IScopedClusterClient } from '@kbn/core/server';
 import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { ReportingCore } from '..';
-import {
-  createMockConfigSchema,
-  createMockPluginSetup,
-  createMockReportingCore,
-} from '../test_helpers';
+import { createMockPluginSetup, createMockReportingCore } from '../test_helpers';
 import { getDeprecationsInfo } from './reporting_role';
 
 let reportingCore: ReportingCore;
diff --git a/x-pack/plugins/reporting/server/export_types/common/index.ts b/x-pack/plugins/reporting/server/export_types/common/index.ts
deleted file mode 100644
index b81226b9c61127..00000000000000
--- a/x-pack/plugins/reporting/server/export_types/common/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { decryptJobHeaders } from './decrypt_job_headers';
-export { getFullUrls } from './get_full_urls';
-export { validateUrls } from './validate_urls';
-export { generatePngObservable } from './generate_png';
-export { getCustomLogo } from './get_custom_logo';
-export { ExportType } from './export_type';
-export type { BaseExportTypeSetupDeps, BaseExportTypeStartDeps } from './export_type';
-
-export interface TimeRangeParams {
-  min?: Date | string | number | null;
-  max?: Date | string | number | null;
-}
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts
deleted file mode 100644
index 39f055c707db13..00000000000000
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { PdfV1ExportType } from './printable_pdf';
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts
deleted file mode 100644
index ebf258f73a41ff..00000000000000
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export type {
-  JobParamsPDFDeprecated,
-  TaskPayloadPDF,
-} from '../../../common/types/export_types/printable_pdf';
diff --git a/x-pack/plugins/reporting/server/index.ts b/x-pack/plugins/reporting/server/index.ts
index 1089331ccd1101..44fa10396672a7 100644
--- a/x-pack/plugins/reporting/server/index.ts
+++ b/x-pack/plugins/reporting/server/index.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { PluginInitializerContext } from '@kbn/core/server';
-import { ReportingConfigType } from './config';
-import { ReportingPlugin } from './plugin';
+import type { PluginInitializerContext } from '@kbn/core/server';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 
 export { config } from './config';
 
@@ -17,8 +16,10 @@ export { config } from './config';
 export type { ReportingSetup, ReportingStart } from './types';
 
 // @internal
-export const plugin = (initContext: PluginInitializerContext<ReportingConfigType>) =>
-  new ReportingPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext<ReportingConfigType>) => {
+  const { ReportingPlugin } = await import('./plugin');
+  return new ReportingPlugin(initContext);
+};
 
 // @internal
 export { ReportingCore } from './core';
diff --git a/x-pack/plugins/reporting/server/lib/check_license.ts b/x-pack/plugins/reporting/server/lib/check_license.ts
index 9b603a83597b7d..a16c2a260d6ea1 100644
--- a/x-pack/plugins/reporting/server/lib/check_license.ts
+++ b/x-pack/plugins/reporting/server/lib/check_license.ts
@@ -6,7 +6,7 @@
  */
 
 import { ILicense } from '@kbn/licensing-plugin/server';
-import { ExportType } from '../export_types/common';
+import { ExportType } from '@kbn/reporting-server';
 import { ExportTypesRegistry } from './export_types_registry';
 
 export interface LicenseCheckResult {
diff --git a/x-pack/plugins/reporting/server/lib/check_params_version.ts b/x-pack/plugins/reporting/server/lib/check_params_version.ts
index b154c839f7fd78..9ab249ced9d6a4 100644
--- a/x-pack/plugins/reporting/server/lib/check_params_version.ts
+++ b/x-pack/plugins/reporting/server/lib/check_params_version.ts
@@ -6,8 +6,8 @@
  */
 
 import type { Logger } from '@kbn/core/server';
-import { UNVERSIONED_VERSION } from '../../common/constants';
-import type { BaseParams } from '../../common/types';
+import { UNVERSIONED_VERSION } from '@kbn/reporting-common';
+import type { BaseParams } from '@kbn/reporting-common/types';
 
 export function checkParamsVersion(jobParams: BaseParams, logger: Logger) {
   if (jobParams.version) {
diff --git a/x-pack/plugins/reporting/server/lib/content_stream.ts b/x-pack/plugins/reporting/server/lib/content_stream.ts
index 7bf7f1108776e6..0be61705d84b54 100644
--- a/x-pack/plugins/reporting/server/lib/content_stream.ts
+++ b/x-pack/plugins/reporting/server/lib/content_stream.ts
@@ -4,14 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+import { defaults, get } from 'lodash';
+import { Duplex } from 'stream';
+import { v4 as uuidv4 } from 'uuid';
+
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ByteSizeValue } from '@kbn/config-schema';
 import type { ElasticsearchClient, Logger } from '@kbn/core/server';
-import { defaults, get } from 'lodash';
-import { v4 as uuidv4 } from 'uuid';
-import { Duplex } from 'stream';
+import type { ReportSource } from '@kbn/reporting-common/types';
 import type { ReportingCore } from '..';
-import type { ReportSource } from '../../common/types';
 
 /**
  * @note The Elasticsearch `http.max_content_length` is including the whole POST body.
diff --git a/x-pack/plugins/reporting/server/lib/deprecations/check_ilm_migration_status.ts b/x-pack/plugins/reporting/server/lib/deprecations/check_ilm_migration_status.ts
index 9f3872dfa69182..aab4c1f0cecf4c 100644
--- a/x-pack/plugins/reporting/server/lib/deprecations/check_ilm_migration_status.ts
+++ b/x-pack/plugins/reporting/server/lib/deprecations/check_ilm_migration_status.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { ILM_POLICY_NAME } from '../../../common/constants';
-import { IlmPolicyMigrationStatus } from '../../../common/types';
+import { IlmPolicyMigrationStatus } from '@kbn/reporting-common/url';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
 import { IlmPolicyManager } from '../store/ilm_policy_manager';
 import type { DeprecationsDependencies } from './types';
 
diff --git a/x-pack/plugins/reporting/server/lib/event_logger/logger.test.ts b/x-pack/plugins/reporting/server/lib/event_logger/logger.test.ts
index cbff4ed0c1d833..84e625cc3981ef 100644
--- a/x-pack/plugins/reporting/server/lib/event_logger/logger.test.ts
+++ b/x-pack/plugins/reporting/server/lib/event_logger/logger.test.ts
@@ -7,7 +7,8 @@
 
 import { loggingSystemMock } from '@kbn/core/server/mocks';
 import { ConcreteTaskInstance } from '@kbn/task-manager-plugin/server';
-import { BasePayload } from '../../types';
+import type { BasePayload } from '@kbn/reporting-common/types';
+
 import { Report } from '../store';
 import { ReportingEventLogger, reportingEventLoggerFactory } from './logger';
 
diff --git a/x-pack/plugins/reporting/server/lib/event_logger/logger.ts b/x-pack/plugins/reporting/server/lib/event_logger/logger.ts
index b28efde88fd18a..a1a7d8e2ea1ca3 100644
--- a/x-pack/plugins/reporting/server/lib/event_logger/logger.ts
+++ b/x-pack/plugins/reporting/server/lib/event_logger/logger.ts
@@ -7,8 +7,8 @@
 
 import deepMerge from 'deepmerge';
 import type { Logger, LogMeta } from '@kbn/core/server';
-import { TaskRunMetrics } from '@kbn/reporting-common';
-import { PLUGIN_ID } from '../../../common/constants';
+import type { TaskRunMetrics } from '@kbn/reporting-common/types';
+import { PLUGIN_ID } from '@kbn/reporting-common';
 import { IReport } from '../store';
 import { ActionType } from '.';
 import { EcsLogAdapter } from './adapter';
diff --git a/x-pack/plugins/reporting/server/lib/event_logger/types.ts b/x-pack/plugins/reporting/server/lib/event_logger/types.ts
index da453e066c2bee..8a6725eb33a4d8 100644
--- a/x-pack/plugins/reporting/server/lib/event_logger/types.ts
+++ b/x-pack/plugins/reporting/server/lib/event_logger/types.ts
@@ -6,7 +6,7 @@
  */
 
 import { LogMeta } from '@kbn/core/server';
-import { TaskRunMetrics } from '@kbn/reporting-common';
+import type { TaskRunMetrics } from '@kbn/reporting-common/types';
 import { ActionType } from '.';
 
 export interface ReportingAction<A extends ActionType> extends LogMeta {
diff --git a/x-pack/plugins/reporting/server/lib/export_types_registry.ts b/x-pack/plugins/reporting/server/lib/export_types_registry.ts
index 4c93410347bb12..23aa3508dc3f45 100644
--- a/x-pack/plugins/reporting/server/lib/export_types_registry.ts
+++ b/x-pack/plugins/reporting/server/lib/export_types_registry.ts
@@ -6,7 +6,7 @@
  */
 
 import { isString } from 'lodash';
-import { ExportType } from '../export_types/common';
+import { ExportType } from '@kbn/reporting-server';
 
 type GetCallbackFn = (item: ExportType) => boolean;
 
diff --git a/x-pack/plugins/reporting/server/lib/index.ts b/x-pack/plugins/reporting/server/lib/index.ts
index be26675f05e888..4c3f29bfa1383f 100644
--- a/x-pack/plugins/reporting/server/lib/index.ts
+++ b/x-pack/plugins/reporting/server/lib/index.ts
@@ -8,9 +8,7 @@
 export { checkLicense } from './check_license';
 export { checkParamsVersion } from './check_params_version';
 export { ContentStream, getContentStream } from './content_stream';
-export { cryptoFactory } from './crypto';
 export { ExportTypesRegistry } from './export_types_registry';
 export { PassThroughStream } from './passthrough_stream';
-export { statuses } from './statuses';
 export { ReportingStore, IlmPolicyManager } from './store';
 export { startTrace } from './trace';
diff --git a/x-pack/plugins/reporting/server/lib/statuses.ts b/x-pack/plugins/reporting/server/lib/statuses.ts
deleted file mode 100644
index 2c25708078aaff..00000000000000
--- a/x-pack/plugins/reporting/server/lib/statuses.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { JobStatus } from '../../common/types';
-
-export const statuses: Record<string, JobStatus> = {
-  JOB_STATUS_PENDING: 'pending',
-  JOB_STATUS_PROCESSING: 'processing',
-  JOB_STATUS_COMPLETED: 'completed',
-  JOB_STATUS_WARNINGS: 'completed_with_warnings',
-  JOB_STATUS_FAILED: 'failed',
-};
diff --git a/x-pack/plugins/reporting/server/lib/store/ilm_policy_manager/ilm_policy_manager.ts b/x-pack/plugins/reporting/server/lib/store/ilm_policy_manager/ilm_policy_manager.ts
index 48a45be80f7161..90bda652898f3c 100644
--- a/x-pack/plugins/reporting/server/lib/store/ilm_policy_manager/ilm_policy_manager.ts
+++ b/x-pack/plugins/reporting/server/lib/store/ilm_policy_manager/ilm_policy_manager.ts
@@ -6,8 +6,7 @@
  */
 
 import type { ElasticsearchClient } from '@kbn/core/server';
-import { ILM_POLICY_NAME } from '../../../../common/constants';
-
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
 import { reportingIlmPolicy } from './constants';
 
 /**
diff --git a/x-pack/plugins/reporting/server/lib/store/index.ts b/x-pack/plugins/reporting/server/lib/store/index.ts
index 125c592c8626b3..5bc72b339d89eb 100644
--- a/x-pack/plugins/reporting/server/lib/store/index.ts
+++ b/x-pack/plugins/reporting/server/lib/store/index.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-export type { ReportDocument } from '../../../common/types';
 export { Report } from './report';
 export { SavedReport } from './saved_report';
 export { ReportingStore } from './store';
diff --git a/x-pack/plugins/reporting/server/lib/store/report.ts b/x-pack/plugins/reporting/server/lib/store/report.ts
index 6f23c23e9066a4..e4ed610eeecd69 100644
--- a/x-pack/plugins/reporting/server/lib/store/report.ts
+++ b/x-pack/plugins/reporting/server/lib/store/report.ts
@@ -8,18 +8,16 @@
 import { omit } from 'lodash';
 import moment from 'moment';
 import Puid from 'puid';
-import { JOB_STATUSES } from '../../../common/constants';
+
+import { JOB_STATUS } from '@kbn/reporting-common';
 import {
   ReportApiJSON,
-  ReportDocument,
   ReportDocumentHead,
   ReportFields,
   ReportSource,
-} from '../../../common/types';
-import type { ReportTaskParams } from '../tasks';
+} from '@kbn/reporting-common/types';
 
-export type { ReportDocument };
-export type { ReportApiJSON, ReportSource };
+import type { ReportTaskParams } from '../tasks';
 
 const puid = new Puid();
 export const MIGRATION_VERSION = '7.14.0';
@@ -95,7 +93,7 @@ export class Report implements Partial<ReportSource & ReportDocumentHead> {
     this.meta = opts.meta || { objectType: 'unknown' };
     this.metrics = opts.metrics;
 
-    this.status = opts.status || JOB_STATUSES.PENDING;
+    this.status = opts.status || JOB_STATUS.PENDING;
     this.output = opts.output || null;
 
     this.queue_time_ms = fields?.queue_time_ms;
diff --git a/x-pack/plugins/reporting/server/lib/store/saved_report.ts b/x-pack/plugins/reporting/server/lib/store/saved_report.ts
index c4d46c167a3125..090e87470a07df 100644
--- a/x-pack/plugins/reporting/server/lib/store/saved_report.ts
+++ b/x-pack/plugins/reporting/server/lib/store/saved_report.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ReportDocumentHead, ReportSource } from '../../../common/types';
+import { ReportDocumentHead, ReportSource } from '@kbn/reporting-common/types';
 import { Report } from '.';
 
 /*
diff --git a/x-pack/plugins/reporting/server/lib/store/store.test.ts b/x-pack/plugins/reporting/server/lib/store/store.test.ts
index 64556ef1a2c22b..18fea1349373eb 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.test.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.test.ts
@@ -6,9 +6,12 @@
  */
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
+import { JOB_STATUS } from '@kbn/reporting-common';
+import { ReportDocument } from '@kbn/reporting-common/types';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import { Report, ReportingStore, SavedReport } from '.';
 import { ReportingCore } from '../..';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
-import { Report, ReportDocument, ReportingStore, SavedReport } from '.';
+import { createMockReportingCore } from '../../test_helpers';
 
 describe('ReportingStore', () => {
   const mockLogger = loggingSystemMock.createLogger();
@@ -184,7 +187,7 @@ describe('ReportingStore', () => {
         created_at: 'some time',
         created_by: 'some security person',
         jobtype: 'csv_searchsource',
-        status: 'pending',
+        status: JOB_STATUS.PENDING,
         meta: { testMeta: 'meta' } as any,
         payload: { testPayload: 'payload' } as any,
         attempts: 0,
@@ -391,7 +394,7 @@ describe('ReportingStore', () => {
       _primary_term: 10002,
       jobtype: 'test-report-2',
       created_by: 'created_by_test_string',
-      status: 'processing',
+      status: JOB_STATUS.PROCESSING,
       process_expiration: '2002',
       max_attempts: 3,
       payload: {
diff --git a/x-pack/plugins/reporting/server/lib/store/store.ts b/x-pack/plugins/reporting/server/lib/store/store.ts
index d4907d43bc4905..710a78ffe859ad 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.ts
@@ -7,13 +7,12 @@
 
 import { estypes } from '@elastic/elasticsearch';
 import type { ElasticsearchClient, Logger } from '@kbn/core/server';
+import { ILM_POLICY_NAME, JOB_STATUS, REPORTING_SYSTEM_INDEX } from '@kbn/reporting-common';
+import { ReportDocument, ReportOutput, ReportSource } from '@kbn/reporting-common/types';
 import moment from 'moment';
-import type { IReport, Report, ReportDocument } from '.';
+import type { IReport, Report } from '.';
 import { SavedReport } from '.';
-import { statuses } from '..';
 import type { ReportingCore } from '../..';
-import { ILM_POLICY_NAME, REPORTING_SYSTEM_INDEX } from '../../../common/constants';
-import type { JobStatus, ReportOutput, ReportSource } from '../../../common/types';
 import type { ReportTaskParams } from '../tasks';
 import { IlmPolicyManager } from './ilm_policy_manager';
 import { indexTimestamp } from './index_timestamp';
@@ -53,7 +52,7 @@ export interface ReportRecordTimeout {
   _id: string;
   _index: string;
   _source: {
-    status: JobStatus;
+    status: JOB_STATUS;
     process_expiration?: string;
   };
 }
@@ -165,7 +164,7 @@ export class ReportingStore {
         ...sourceDoc({
           process_expiration: new Date(0).toISOString(),
           attempts: 0,
-          status: statuses.JOB_STATUS_PENDING,
+          status: JOB_STATUS.PENDING,
         }),
       },
     };
@@ -283,7 +282,7 @@ export class ReportingStore {
   ): Promise<UpdateResponse<ReportDocument>> {
     const doc = sourceDoc({
       ...processingInfo,
-      status: statuses.JOB_STATUS_PROCESSING,
+      status: JOB_STATUS.PROCESSING,
     });
 
     let body: UpdateResponse<ReportDocument>;
@@ -322,7 +321,7 @@ export class ReportingStore {
   ): Promise<UpdateResponse<ReportDocument>> {
     const doc = sourceDoc({
       ...failedInfo,
-      status: statuses.JOB_STATUS_FAILED,
+      status: JOB_STATUS.FAILED,
     });
 
     let body: UpdateResponse<ReportDocument>;
@@ -353,8 +352,8 @@ export class ReportingStore {
     const { output } = completedInfo;
     const status =
       output && output.warnings && output.warnings.length > 0
-        ? statuses.JOB_STATUS_WARNINGS
-        : statuses.JOB_STATUS_COMPLETED;
+        ? JOB_STATUS.WARNINGS
+        : JOB_STATUS.COMPLETED;
     const doc = sourceDoc({
       ...completedInfo,
       status,
@@ -383,7 +382,7 @@ export class ReportingStore {
 
   public async prepareReportForRetry(report: SavedReport): Promise<UpdateResponse<ReportDocument>> {
     const doc = sourceDoc({
-      status: statuses.JOB_STATUS_PENDING,
+      status: JOB_STATUS.PENDING,
       process_expiration: null,
     });
 
@@ -420,13 +419,13 @@ export class ReportingStore {
       bool: {
         must: [
           { range: { process_expiration: { lt: `now` } } },
-          { terms: { status: [statuses.JOB_STATUS_PROCESSING] } },
+          { terms: { status: [JOB_STATUS.PROCESSING] } },
         ],
       },
     };
     const oldVersionFilter = {
       bool: {
-        must: [{ terms: { status: [statuses.JOB_STATUS_PENDING] } }],
+        must: [{ terms: { status: [JOB_STATUS.PENDING] } }],
         must_not: [{ exists: { field: 'migration_version' } }],
       },
     };
diff --git a/x-pack/plugins/reporting/server/lib/tasks/execute_report.test.ts b/x-pack/plugins/reporting/server/lib/tasks/execute_report.test.ts
index 314fffd3527b52..90b1daacc9f0cd 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/execute_report.test.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/execute_report.test.ts
@@ -7,13 +7,14 @@
 
 import { loggingSystemMock } from '@kbn/core/server/mocks';
 import { KibanaShuttingDownError } from '@kbn/reporting-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import type { ExportType, ReportingConfigType } from '@kbn/reporting-server';
 import type { RunContext } from '@kbn/task-manager-plugin/server';
 import { taskManagerMock } from '@kbn/task-manager-plugin/server/mocks';
+
 import { ExecuteReportTask } from '.';
 import type { ReportingCore } from '../..';
-import type { ReportingConfigType } from '../../config';
-import type { ExportType } from '../../export_types/common';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
+import { createMockReportingCore } from '../../test_helpers';
 import type { SavedReport } from '../store';
 
 const logger = loggingSystemMock.createLogger();
diff --git a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
index 61818fe00ef2b2..8bc6ba0f865ec4 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
@@ -5,36 +5,38 @@
  * 2.0.
  */
 
-import { UpdateResponse } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import type { Logger } from '@kbn/core/server';
 import moment from 'moment';
 import * as Rx from 'rxjs';
 import { timeout } from 'rxjs/operators';
 import { Writable } from 'stream';
 import { finished } from 'stream/promises';
 import { setTimeout } from 'timers/promises';
+
+import { UpdateResponse } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type { Logger } from '@kbn/core/server';
+import {
+  CancellationToken,
+  KibanaShuttingDownError,
+  QueueTimeoutError,
+  ReportingError,
+  durationToNumber,
+  numberToDuration,
+} from '@kbn/reporting-common';
+import type { ReportDocument, ReportOutput, TaskRunResult } from '@kbn/reporting-common/types';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 import type {
   RunContext,
   TaskManagerStartContract,
   TaskRunCreatorFunction,
 } from '@kbn/task-manager-plugin/server';
-import {
-  CancellationToken,
-  ReportingError,
-  QueueTimeoutError,
-  KibanaShuttingDownError,
-  TaskRunResult,
-} from '@kbn/reporting-common';
-import { mapToReportingError } from '../../../common/errors/map_to_reporting_error';
+
+import { REPORTING_EXECUTE_TYPE, ReportTaskParams, ReportingTask, ReportingTaskStatus } from '.';
 import { ExportTypesRegistry, getContentStream } from '..';
 import type { ReportingCore } from '../..';
-import { durationToNumber, numberToDuration } from '../../../common/schema_utils';
-import type { ReportOutput } from '../../../common/types';
-import type { ReportingConfigType } from '../../config';
-import type { ReportDocument, ReportingStore } from '../store';
+import { mapToReportingError } from '../../../common/errors/map_to_reporting_error';
+import type { ReportingStore } from '../store';
 import { Report, SavedReport } from '../store';
 import type { ReportFailedFields, ReportProcessingFields } from '../store/store';
-import { ReportingTask, ReportingTaskStatus, REPORTING_EXECUTE_TYPE, ReportTaskParams } from '.';
 import { errorLogger } from './error_logger';
 
 type CompletedReportOutput = Omit<ReportOutput, 'content'>;
diff --git a/x-pack/plugins/reporting/server/lib/tasks/index.ts b/x-pack/plugins/reporting/server/lib/tasks/index.ts
index f60bcefd738532..54493aee6de581 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/index.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/index.ts
@@ -6,8 +6,7 @@
  */
 
 import { TaskRunCreatorFunction } from '@kbn/task-manager-plugin/server';
-import { ReportSource } from '../../../common/types';
-import { BasePayload } from '../../types';
+import { BasePayload, ReportSource } from '@kbn/reporting-common/types';
 
 export const REPORTING_EXECUTE_TYPE = 'report:execute';
 export const REPORTING_MONITOR_TYPE = 'reports:monitor';
diff --git a/x-pack/plugins/reporting/server/lib/tasks/monitor_report.test.ts b/x-pack/plugins/reporting/server/lib/tasks/monitor_report.test.ts
index 7bf6dd7e50678c..cf17fd2c652216 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/monitor_report.test.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/monitor_report.test.ts
@@ -6,12 +6,13 @@
  */
 
 import { loggingSystemMock } from '@kbn/core/server/mocks';
-import { ReportingCore } from '../..';
-import { RunContext } from '@kbn/task-manager-plugin/server';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import type { RunContext } from '@kbn/task-manager-plugin/server';
 import { taskManagerMock } from '@kbn/task-manager-plugin/server/mocks';
-import { ReportingConfigType } from '../../config';
-import { createMockConfigSchema, createMockReportingCore } from '../../test_helpers';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 import { MonitorReportsTask } from '.';
+import type { ReportingCore } from '../..';
+import { createMockReportingCore } from '../../test_helpers';
 
 const logger = loggingSystemMock.createLogger();
 
diff --git a/x-pack/plugins/reporting/server/lib/tasks/monitor_reports.ts b/x-pack/plugins/reporting/server/lib/tasks/monitor_reports.ts
index fa599d225b77d6..c42e2f8afa5b2c 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/monitor_reports.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/monitor_reports.ts
@@ -7,12 +7,14 @@
 
 import type { Logger } from '@kbn/core/server';
 import moment from 'moment';
-import { TaskManagerStartContract, TaskRunCreatorFunction } from '@kbn/task-manager-plugin/server';
+import type {
+  TaskManagerStartContract,
+  TaskRunCreatorFunction,
+} from '@kbn/task-manager-plugin/server';
+import { JOB_STATUS, numberToDuration } from '@kbn/reporting-common';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 import { ReportingStore } from '..';
 import { ReportingCore } from '../..';
-import { numberToDuration } from '../../../common/schema_utils';
-import { ReportingConfigType } from '../../config';
-import { statuses } from '../statuses';
 import { SavedReport } from '../store';
 import { ReportingTask, ReportingTaskStatus, REPORTING_MONITOR_TYPE, ReportTaskParams } from '.';
 
@@ -96,7 +98,7 @@ export class MonitorReportsTask implements ReportingTask {
             const { _id: jobId, process_expiration: processExpiration, status } = report;
             const eventLog = this.reporting.getEventLogger(report);
 
-            if (![statuses.JOB_STATUS_PENDING, statuses.JOB_STATUS_PROCESSING].includes(status)) {
+            if (![JOB_STATUS.PENDING, JOB_STATUS.PROCESSING].includes(status)) {
               const invalidStatusError = new Error(
                 `Invalid job status in the monitoring search result: ${status}`
               ); // only pending or processing jobs possibility need rescheduling
@@ -107,7 +109,7 @@ export class MonitorReportsTask implements ReportingTask {
               throw invalidStatusError;
             }
 
-            if (status === statuses.JOB_STATUS_PENDING) {
+            if (status === JOB_STATUS.PENDING) {
               const migratingJobError = new Error(
                 `${jobId} was scheduled in a previous version and left in [${status}] status. Rescheduling...`
               );
@@ -115,7 +117,7 @@ export class MonitorReportsTask implements ReportingTask {
               eventLog.logError(migratingJobError);
             }
 
-            if (status === statuses.JOB_STATUS_PROCESSING) {
+            if (status === JOB_STATUS.PROCESSING) {
               const expirationTime = moment(processExpiration);
               const overdueValue = moment().valueOf() - expirationTime.valueOf();
               const overdueExpirationError = new Error(
diff --git a/x-pack/plugins/reporting/server/mocks/index.ts b/x-pack/plugins/reporting/server/mocks/index.ts
index a6626be6ce7919..ea9d448aff1670 100644
--- a/x-pack/plugins/reporting/server/mocks/index.ts
+++ b/x-pack/plugins/reporting/server/mocks/index.ts
@@ -11,7 +11,5 @@ export const reportingMock = {
   createStart: (): ReportingStart => ({
     usesUiCapabilities: () => false,
     registerExportTypes: () => {},
-    getSpaceId: jest.fn(),
-    getScreenshots: jest.fn(),
   }),
 };
diff --git a/x-pack/plugins/reporting/server/plugin.test.ts b/x-pack/plugins/reporting/server/plugin.test.ts
index 3e57e3bf3322b8..3c4e81af540cdd 100644
--- a/x-pack/plugins/reporting/server/plugin.test.ts
+++ b/x-pack/plugins/reporting/server/plugin.test.ts
@@ -7,21 +7,16 @@
 
 import type { CoreSetup, CoreStart, Logger } from '@kbn/core/server';
 import { coreMock, loggingSystemMock } from '@kbn/core/server/mocks';
-import {
-  CSV_REPORT_TYPE,
-  CSV_REPORT_TYPE_V2,
-  PDF_REPORT_TYPE,
-  PDF_REPORT_TYPE_V2,
-  PNG_REPORT_TYPE_V2,
-} from '../common/constants';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+
+import { CSV_REPORT_TYPE, CSV_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-csv-common';
+import { PDF_REPORT_TYPE, PDF_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-pdf-common';
+import { PNG_REPORT_TYPE_V2 } from '@kbn/reporting-export-types-png-common';
+
 import type { ReportingCore, ReportingInternalStart } from './core';
 import { ExportTypesRegistry } from './lib/export_types_registry';
 import { ReportingPlugin } from './plugin';
-import {
-  createMockConfigSchema,
-  createMockPluginSetup,
-  createMockPluginStart,
-} from './test_helpers';
+import { createMockPluginSetup, createMockPluginStart } from './test_helpers';
 import type { ReportingSetupDeps } from './types';
 
 const sleep = (time: number) => new Promise((r) => setTimeout(r, time));
diff --git a/x-pack/plugins/reporting/server/plugin.ts b/x-pack/plugins/reporting/server/plugin.ts
index 3e64a5ddca85e1..b05430200c2e1f 100644
--- a/x-pack/plugins/reporting/server/plugin.ts
+++ b/x-pack/plugins/reporting/server/plugin.ts
@@ -12,20 +12,21 @@ import type {
   Plugin,
   PluginInitializerContext,
 } from '@kbn/core/server';
+import { PLUGIN_ID } from '@kbn/reporting-common';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+import { setFieldFormats } from '@kbn/reporting-server';
 import { ReportingCore } from '.';
-import { PLUGIN_ID } from '../common/constants';
-import { registerUiSettings, ReportingConfigType } from './config';
+import { registerUiSettings } from './config';
 import { registerDeprecations } from './deprecations';
 import { ReportingStore } from './lib';
 import { registerRoutes } from './routes';
-import { setFieldFormats } from './services';
 import type {
-  ReportingRequestHandlerContext,
   ReportingSetup,
   ReportingSetupDeps,
   ReportingStart,
   ReportingStartDeps,
 } from './types';
+import { ReportingRequestHandlerContext } from './types';
 import { registerReportingUsageCollector } from './usage';
 
 /*
diff --git a/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.test.ts b/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.test.ts
index b4c139e6276a44..a10718bf6376f3 100644
--- a/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.test.ts
+++ b/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.test.ts
@@ -7,10 +7,10 @@
 
 import { KibanaRequest, KibanaResponseFactory } from '@kbn/core/server';
 import { coreMock, httpServerMock } from '@kbn/core/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { ReportingCore } from '../..';
 import { ReportingInternalSetup, ReportingInternalStart } from '../../core';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.ts b/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.ts
index d4f6e4bf49ab06..ee58d27d55ea0a 100644
--- a/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.ts
+++ b/x-pack/plugins/reporting/server/routes/common/authorized_user_pre_routing.ts
@@ -6,11 +6,12 @@
  */
 
 import { RequestHandler, RouteMethod } from '@kbn/core/server';
-import { AuthenticatedUser } from '@kbn/security-plugin/server';
 import { i18n } from '@kbn/i18n';
+import { AuthenticatedUser } from '@kbn/security-plugin/server';
+
 import { ReportingCore } from '../../core';
+import { ReportingRequestHandlerContext } from '../../types';
 import { getUser } from './get_user';
-import type { ReportingRequestHandlerContext } from '../../types';
 
 const superuserRole = 'superuser';
 
diff --git a/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts b/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts
index 2ba248b17812fe..16d1107da4b567 100644
--- a/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts
+++ b/x-pack/plugins/reporting/server/routes/common/generate/request_handler.test.ts
@@ -15,21 +15,24 @@ jest.mock(
     }
 );
 
-import { KibanaRequest, KibanaResponseFactory } from '@kbn/core/server';
 import rison from '@kbn/rison';
+
+import { KibanaRequest, KibanaResponseFactory } from '@kbn/core/server';
 import { coreMock, httpServerMock, loggingSystemMock } from '@kbn/core/server/mocks';
+import { JobParamsPDFDeprecated, TaskPayloadPDFV2 } from '@kbn/reporting-export-types-pdf-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+
 import { ReportingCore } from '../../..';
-import { TaskPayloadPDFV2 } from '../../../../common/types/export_types/printable_pdf_v2';
-import { JobParamsPDFDeprecated } from '../../../export_types/printable_pdf/types';
 import { Report, ReportingStore } from '../../../lib/store';
-import { createMockConfigSchema, createMockReportingCore } from '../../../test_helpers';
+import { createMockReportingCore } from '../../../test_helpers';
 import {
   ReportingJobResponse,
   ReportingRequestHandlerContext,
   ReportingSetup,
 } from '../../../types';
 import { RequestHandler } from './request_handler';
-jest.mock('../../../lib/crypto', () => ({
+
+jest.mock('@kbn/reporting-server/crypto', () => ({
   cryptoFactory: () => ({
     encrypt: () => `hello mock cypher text`,
   }),
diff --git a/x-pack/plugins/reporting/server/routes/common/generate/request_handler.ts b/x-pack/plugins/reporting/server/routes/common/generate/request_handler.ts
index 111e4a20e4fdc9..10f368097c6867 100644
--- a/x-pack/plugins/reporting/server/routes/common/generate/request_handler.ts
+++ b/x-pack/plugins/reporting/server/routes/common/generate/request_handler.ts
@@ -6,18 +6,21 @@
  */
 
 import Boom from '@hapi/boom';
+import moment from 'moment';
+
 import { schema, TypeOf } from '@kbn/config-schema';
 import type { KibanaRequest, KibanaResponseFactory, Logger } from '@kbn/core/server';
 import { i18n } from '@kbn/i18n';
+import type { BaseParams } from '@kbn/reporting-common/types';
+import { cryptoFactory } from '@kbn/reporting-server';
 import rison from '@kbn/rison';
-import moment from 'moment';
+
 import { Counters, getCounters } from '..';
 import type { ReportingCore } from '../../..';
 import { PUBLIC_ROUTES } from '../../../../common/constants';
-import { checkParamsVersion, cryptoFactory } from '../../../lib';
+import { checkParamsVersion } from '../../../lib';
 import { Report } from '../../../lib/store';
 import type {
-  BaseParams,
   ReportingJobResponse,
   ReportingRequestHandlerContext,
   ReportingUser,
diff --git a/x-pack/plugins/reporting/server/routes/common/get_counter.ts b/x-pack/plugins/reporting/server/routes/common/get_counter.ts
index 2888bebcc5e6b9..83603d07e5ce8a 100644
--- a/x-pack/plugins/reporting/server/routes/common/get_counter.ts
+++ b/x-pack/plugins/reporting/server/routes/common/get_counter.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { API_USAGE_COUNTER_TYPE, API_USAGE_ERROR_TYPE } from '@kbn/reporting-common';
 import { UsageCounter } from '@kbn/usage-collection-plugin/server';
-import { API_USAGE_COUNTER_TYPE, API_USAGE_ERROR_TYPE } from '../../../common/constants';
 
 export type Counters = ReturnType<typeof getCounters>;
 
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.test.ts b/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.test.ts
index 8c308de4544a13..cbd5f934258475 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.test.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.test.ts
@@ -6,10 +6,15 @@
  */
 
 import { Readable } from 'stream';
-import { CSV_JOB_TYPE, PDF_JOB_TYPE, PDF_JOB_TYPE_V2 } from '../../../../common/constants';
-import { ReportApiJSON } from '../../../../common/types';
-import { ContentStream, getContentStream, statuses } from '../../../lib';
-import { createMockConfigSchema, createMockReportingCore } from '../../../test_helpers';
+
+import { JOB_STATUS } from '@kbn/reporting-common';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
+import { CSV_JOB_TYPE } from '@kbn/reporting-export-types-csv-common';
+import { PDF_JOB_TYPE, PDF_JOB_TYPE_V2 } from '@kbn/reporting-export-types-pdf-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+
+import { ContentStream, getContentStream } from '../../../lib';
+import { createMockReportingCore } from '../../../test_helpers';
 import { getDocumentPayloadFactory } from './get_document_payload';
 import { jobsQueryFactory } from './jobs_query';
 
@@ -45,7 +50,7 @@ describe('getDocumentPayload', () => {
         getDocumentPayload({
           id: 'id1',
           index: '.reporting-12345',
-          status: statuses.JOB_STATUS_COMPLETED,
+          status: JOB_STATUS.COMPLETED,
           jobtype: PDF_JOB_TYPE,
           output: {
             content_type: 'application/pdf',
@@ -71,7 +76,7 @@ describe('getDocumentPayload', () => {
         getDocumentPayload({
           id: 'id1',
           index: '.reporting-12345',
-          status: statuses.JOB_STATUS_WARNINGS,
+          status: JOB_STATUS.WARNINGS,
           jobtype: CSV_JOB_TYPE,
           output: {
             content_type: 'text/csv',
@@ -103,7 +108,7 @@ describe('getDocumentPayload', () => {
         getDocumentPayload({
           id: 'id1',
           index: '.reporting-12345',
-          status: statuses.JOB_STATUS_FAILED,
+          status: JOB_STATUS.FAILED,
           jobtype: PDF_JOB_TYPE_V2,
           output: {},
           payload: {},
@@ -127,7 +132,7 @@ describe('getDocumentPayload', () => {
         getDocumentPayload({
           id: 'id1',
           index: '.reporting-12345',
-          status: statuses.JOB_STATUS_PENDING,
+          status: JOB_STATUS.PENDING,
           jobtype: PDF_JOB_TYPE_V2,
           output: {},
           payload: {},
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.ts b/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.ts
index 92fac37bb26f27..d8a0027c42d644 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/get_document_payload.ts
@@ -5,13 +5,16 @@
  * 2.0.
  */
 
-import { ResponseHeaders } from '@kbn/core-http-server';
 import { Stream } from 'stream';
+
+import { ResponseHeaders } from '@kbn/core-http-server';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
+import { CSV_JOB_TYPE, CSV_JOB_TYPE_DEPRECATED } from '@kbn/reporting-export-types-csv-common';
+import { JOB_STATUS } from '@kbn/reporting-common';
+import { ExportType } from '@kbn/reporting-server';
+
 import { ReportingCore } from '../../..';
-import { CSV_JOB_TYPE, CSV_JOB_TYPE_DEPRECATED } from '../../../../common/constants';
-import { ReportApiJSON } from '../../../../common/types';
-import { ExportType } from '../../../export_types/common';
-import { getContentStream, statuses } from '../../../lib';
+import { getContentStream } from '../../../lib';
 import { jobsQueryFactory } from './jobs_query';
 
 export interface ErrorFromPayload {
@@ -106,11 +109,11 @@ export function getDocumentPayloadFactory(reporting: ReportingCore) {
 
   return async function getDocumentPayload(report: ReportApiJSON): Promise<Payload> {
     if (report.output) {
-      if ([statuses.JOB_STATUS_COMPLETED, statuses.JOB_STATUS_WARNINGS].includes(report.status)) {
+      if ([JOB_STATUS.COMPLETED, JOB_STATUS.WARNINGS].includes(report.status)) {
         return getCompleted(report as Required<ReportApiJSON>);
       }
 
-      if (statuses.JOB_STATUS_FAILED === report.status) {
+      if (JOB_STATUS.FAILED === report.status) {
         return getFailure(report);
       }
     }
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/get_job_routes.ts b/x-pack/plugins/reporting/server/routes/common/jobs/get_job_routes.ts
index c0d29849e94f38..ddd226187adf07 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/get_job_routes.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/get_job_routes.ts
@@ -5,17 +5,19 @@
  * 2.0.
  */
 
+import { promisify } from 'util';
+
 import { schema, TypeOf } from '@kbn/config-schema';
 import { KibanaRequest, KibanaResponseFactory } from '@kbn/core-http-server';
-import { promisify } from 'util';
+import { ALLOWED_JOB_CONTENT_TYPES } from '@kbn/reporting-common';
+
 import { getCounters } from '..';
 import { ReportingCore } from '../../..';
-import { ALLOWED_JOB_CONTENT_TYPES } from '../../../../common/constants';
 import { getContentStream } from '../../../lib';
 import { ReportingRequestHandlerContext, ReportingUser } from '../../../types';
 import { handleUnavailable } from '../generate';
-import { jobsQueryFactory } from './jobs_query';
 import { jobManagementPreRouting } from './job_management_pre_routing';
+import { jobsQueryFactory } from './jobs_query';
 
 const validate = {
   params: schema.object({
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.test.ts b/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.test.ts
index 3d4a182d0d7430..ce0f6b5697eed0 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.test.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.test.ts
@@ -6,10 +6,10 @@
  */
 
 import { httpServerMock } from '@kbn/core/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { ReportingCore } from '../../..';
 import { ReportingInternalSetup, ReportingInternalStart } from '../../../core';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.ts b/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.ts
index 79221c0c49d34e..cfe9df9cebc402 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/job_management_pre_routing.ts
@@ -6,11 +6,12 @@
  */
 
 import Boom from '@hapi/boom';
+
 import { IKibanaResponse, kibanaResponseFactory } from '@kbn/core/server';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 import { i18n } from '@kbn/i18n';
 import { Counters } from '..';
 import { ReportingCore } from '../../..';
-import { ReportApiJSON } from '../../../lib/store/report';
 import { ReportingUser } from '../../../types';
 import { jobsQueryFactory } from './jobs_query';
 
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.test.ts b/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.test.ts
index f0c656da2050aa..616079c0aa27eb 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.test.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.test.ts
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { set } from '@kbn/safer-lodash-set';
+
 import { ElasticsearchClient } from '@kbn/core/server';
 import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
-import { set } from '@kbn/safer-lodash-set';
-import { statuses } from '../../../lib';
-import { createMockConfigSchema, createMockReportingCore } from '../../../test_helpers';
+import { JOB_STATUS } from '@kbn/reporting-common';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import { createMockReportingCore } from '../../../test_helpers';
 import { jobsQueryFactory } from './jobs_query';
 
 describe('jobsQuery', () => {
@@ -184,7 +186,7 @@ describe('jobsQuery', () => {
               _id: 'id1',
               jobtype: 'pdf',
               output: { content: 'Some error' },
-              status: statuses.JOB_STATUS_FAILED,
+              status: JOB_STATUS.FAILED,
             },
           },
         ])
@@ -218,7 +220,7 @@ describe('jobsQuery', () => {
             _source: {
               _id: 'id1',
               jobtype: 'pdf',
-              status: statuses.JOB_STATUS_PENDING,
+              status: JOB_STATUS.PENDING,
             },
           },
         ])
diff --git a/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.ts b/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.ts
index 87bf38648bd2f1..9efe74a0c3aacf 100644
--- a/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.ts
+++ b/x-pack/plugins/reporting/server/routes/common/jobs/jobs_query.ts
@@ -5,13 +5,12 @@
  * 2.0.
  */
 
-import { estypes, errors, TransportResult } from '@elastic/elasticsearch';
+import { TransportResult, errors, estypes } from '@elastic/elasticsearch';
 import type { ElasticsearchClient } from '@kbn/core/server';
 import { i18n } from '@kbn/i18n';
+import { JOB_STATUS, REPORTING_SYSTEM_INDEX } from '@kbn/reporting-common';
+import { ReportApiJSON, ReportSource } from '@kbn/reporting-common/types';
 import type { ReportingCore } from '../../..';
-import { REPORTING_SYSTEM_INDEX } from '../../../../common/constants';
-import type { ReportApiJSON, ReportSource } from '../../../../common/types';
-import { statuses } from '../../../lib/statuses';
 import { Report } from '../../../lib/store';
 import { runtimeFieldKeys, runtimeFields } from '../../../lib/store/runtime_fields';
 import type { ReportingUser } from '../../../types';
@@ -192,7 +191,7 @@ export function jobsQueryFactory(reportingCore: ReportingCore): JobsQueryFactory
       const hits = response?.hits?.hits?.[0];
       const status = hits?._source?.status;
 
-      if (status !== statuses.JOB_STATUS_FAILED) {
+      if (status !== JOB_STATUS.FAILED) {
         throw new Error(`Can not get error for ${id}`);
       }
 
diff --git a/x-pack/plugins/reporting/server/routes/internal/deprecations/deprecations.ts b/x-pack/plugins/reporting/server/routes/internal/deprecations/deprecations.ts
index 04ff2474674d1e..d6322f2d60346f 100644
--- a/x-pack/plugins/reporting/server/routes/internal/deprecations/deprecations.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/deprecations/deprecations.ts
@@ -6,8 +6,9 @@
  */
 import { errors } from '@elastic/elasticsearch';
 import type { Logger, RequestHandler } from '@kbn/core/server';
-import { ILM_POLICY_NAME, INTERNAL_ROUTES } from '../../../../common/constants';
-import type { IlmPolicyStatusResponse } from '../../../../common/types';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common';
+import type { IlmPolicyStatusResponse } from '@kbn/reporting-common/url';
+import { INTERNAL_ROUTES } from '../../../../common/constants';
 import type { ReportingCore } from '../../../core';
 import { IlmPolicyManager } from '../../../lib';
 import { deprecations } from '../../../lib/deprecations';
diff --git a/x-pack/plugins/reporting/server/routes/internal/deprecations/integration_tests/deprecations.test.ts b/x-pack/plugins/reporting/server/routes/internal/deprecations/integration_tests/deprecations.test.ts
index 8b82e2bef151f8..e143216447af05 100644
--- a/x-pack/plugins/reporting/server/routes/internal/deprecations/integration_tests/deprecations.test.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/deprecations/integration_tests/deprecations.test.ts
@@ -8,11 +8,11 @@
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
 import { loggingSystemMock } from '@kbn/core/server/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { securityMock } from '@kbn/security-plugin/server/mocks';
 import supertest from 'supertest';
 import { INTERNAL_ROUTES } from '../../../../../common/constants';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/routes/internal/diagnostic/integration_tests/browser.test.ts b/x-pack/plugins/reporting/server/routes/internal/diagnostic/integration_tests/browser.test.ts
index be23298a0f0e1e..a395fab20e8d3d 100644
--- a/x-pack/plugins/reporting/server/routes/internal/diagnostic/integration_tests/browser.test.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/diagnostic/integration_tests/browser.test.ts
@@ -5,21 +5,19 @@
  * 2.0.
  */
 
+import * as Rx from 'rxjs';
+import supertest from 'supertest';
+
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
 import { docLinksServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
-import type { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
+import { ScreenshottingStart } from '@kbn/screenshotting-plugin/server';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { IUsageCounter } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counter';
-import * as Rx from 'rxjs';
-import supertest from 'supertest';
 import { ReportingCore } from '../../../..';
 import { INTERNAL_ROUTES } from '../../../../../common/constants';
 import { reportingMock } from '../../../../mocks';
-import {
-  createMockConfigSchema,
-  createMockPluginSetup,
-  createMockReportingCore,
-} from '../../../../test_helpers';
-import type { ReportingRequestHandlerContext } from '../../../../types';
+import { createMockPluginSetup, createMockReportingCore } from '../../../../test_helpers';
+import { ReportingRequestHandlerContext } from '../../../../types';
 import { registerDiagnoseBrowser } from '../browser';
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
diff --git a/x-pack/plugins/reporting/server/routes/internal/generate/csv_searchsource_immediate.ts b/x-pack/plugins/reporting/server/routes/internal/generate/csv_searchsource_immediate.ts
index 90fc2d01dba662..60e8da242ddbfc 100644
--- a/x-pack/plugins/reporting/server/routes/internal/generate/csv_searchsource_immediate.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/generate/csv_searchsource_immediate.ts
@@ -6,12 +6,16 @@
  */
 
 import Boom from '@hapi/boom';
+import moment from 'moment';
+
 import { schema } from '@kbn/config-schema';
 import type { KibanaRequest, Logger } from '@kbn/core/server';
-import moment from 'moment';
+import {
+  CSV_SEARCHSOURCE_IMMEDIATE_TYPE,
+  JobParamsDownloadCSV,
+} from '@kbn/reporting-export-types-csv-common';
 import type { ReportingCore } from '../../..';
-import { CSV_SEARCHSOURCE_IMMEDIATE_TYPE, INTERNAL_ROUTES } from '../../../../common/constants';
-import type { JobParamsDownloadCSV } from '../../../export_types/csv_searchsource_immediate/types';
+import { INTERNAL_ROUTES } from '../../../../common/constants';
 import { PassThroughStream } from '../../../lib';
 import { authorizedUserPreRouting, getCounters } from '../../common';
 
diff --git a/x-pack/plugins/reporting/server/routes/internal/generate/integration_tests/generation_from_jobparams.test.ts b/x-pack/plugins/reporting/server/routes/internal/generate/integration_tests/generation_from_jobparams.test.ts
index c36385ab5174f0..be416eab955ba3 100644
--- a/x-pack/plugins/reporting/server/routes/internal/generate/integration_tests/generation_from_jobparams.test.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/generate/integration_tests/generation_from_jobparams.test.ts
@@ -5,27 +5,29 @@
  * 2.0.
  */
 
+import { BehaviorSubject } from 'rxjs';
+import supertest from 'supertest';
+import rison from '@kbn/rison';
+
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
 import { coreMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
-import rison from '@kbn/rison';
+import { PdfExportType } from '@kbn/reporting-export-types-pdf';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { IUsageCounter } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counter';
-import { BehaviorSubject } from 'rxjs';
-import supertest from 'supertest';
+
 import { ReportingCore } from '../../../..';
 import { INTERNAL_ROUTES } from '../../../../../common/constants';
-import { PdfExportType } from '../../../../export_types/printable_pdf_v2';
 import { ReportingStore } from '../../../../lib';
 import { ExportTypesRegistry } from '../../../../lib/export_types_registry';
 import { Report } from '../../../../lib/store';
 import { reportingMock } from '../../../../mocks';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
 } from '../../../../test_helpers';
-import type { ReportingRequestHandlerContext } from '../../../../types';
+import { ReportingRequestHandlerContext } from '../../../../types';
 import { registerGenerationRoutesInternal } from '../generate_from_jobparams';
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
diff --git a/x-pack/plugins/reporting/server/routes/internal/management/integration_tests/jobs.test.ts b/x-pack/plugins/reporting/server/routes/internal/management/integration_tests/jobs.test.ts
index d77a3840cfac33..decc2300026e35 100644
--- a/x-pack/plugins/reporting/server/routes/internal/management/integration_tests/jobs.test.ts
+++ b/x-pack/plugins/reporting/server/routes/internal/management/integration_tests/jobs.test.ts
@@ -5,25 +5,28 @@
  * 2.0.
  */
 
+import { BehaviorSubject } from 'rxjs';
+import { Readable } from 'stream';
+import supertest from 'supertest';
+
 jest.mock('../../../../lib/content_stream', () => ({
   getContentStream: jest.fn(),
 }));
+
 import { estypes } from '@elastic/elasticsearch';
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
-import type { ElasticsearchClientMock } from '@kbn/core/server/mocks';
+import { ElasticsearchClientMock } from '@kbn/core/server/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
+import { ExportType } from '@kbn/reporting-server';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { IUsageCounter } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counter';
-import { BehaviorSubject } from 'rxjs';
-import { Readable } from 'stream';
-import supertest from 'supertest';
+
 import { ReportingCore } from '../../../..';
 import { INTERNAL_ROUTES } from '../../../../../common/constants';
 import { ReportingInternalSetup, ReportingInternalStart } from '../../../../core';
-import { ExportType } from '../../../../export_types/common';
 import { ContentStream, ExportTypesRegistry, getContentStream } from '../../../../lib';
 import { reportingMock } from '../../../../mocks';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/routes/public/integration_tests/generation_from_jobparams.test.ts b/x-pack/plugins/reporting/server/routes/public/integration_tests/generation_from_jobparams.test.ts
index 18883564030d10..b534583da02c5b 100644
--- a/x-pack/plugins/reporting/server/routes/public/integration_tests/generation_from_jobparams.test.ts
+++ b/x-pack/plugins/reporting/server/routes/public/integration_tests/generation_from_jobparams.test.ts
@@ -5,27 +5,28 @@
  * 2.0.
  */
 
+import rison from '@kbn/rison';
+import { BehaviorSubject } from 'rxjs';
+import supertest from 'supertest';
+
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
 import { coreMock, loggingSystemMock } from '@kbn/core/server/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
-import rison from '@kbn/rison';
+import { PdfExportType } from '@kbn/reporting-export-types-pdf';
 import { IUsageCounter } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counter';
-import { BehaviorSubject } from 'rxjs';
-import supertest from 'supertest';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { ReportingCore } from '../../..';
 import { PUBLIC_ROUTES } from '../../../../common/constants';
-import { PdfExportType } from '../../../export_types/printable_pdf_v2';
 import { ReportingStore } from '../../../lib';
 import { ExportTypesRegistry } from '../../../lib/export_types_registry';
 import { Report } from '../../../lib/store';
 import { reportingMock } from '../../../mocks';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
 } from '../../../test_helpers';
-import type { ReportingRequestHandlerContext } from '../../../types';
+import { ReportingRequestHandlerContext } from '../../../types';
 import { registerGenerationRoutesPublic } from '../generate_from_jobparams';
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
diff --git a/x-pack/plugins/reporting/server/routes/public/integration_tests/jobs.test.ts b/x-pack/plugins/reporting/server/routes/public/integration_tests/jobs.test.ts
index b268d8c089d579..b301b1546dabfd 100644
--- a/x-pack/plugins/reporting/server/routes/public/integration_tests/jobs.test.ts
+++ b/x-pack/plugins/reporting/server/routes/public/integration_tests/jobs.test.ts
@@ -8,22 +8,25 @@
 jest.mock('../../../lib/content_stream', () => ({
   getContentStream: jest.fn(),
 }));
+
+import { BehaviorSubject } from 'rxjs';
+import { Readable } from 'stream';
+import supertest from 'supertest';
+
 import { estypes } from '@elastic/elasticsearch';
 import { setupServer } from '@kbn/core-test-helpers-test-utils';
 import type { ElasticsearchClientMock } from '@kbn/core/server/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
+import type { ExportType } from '@kbn/reporting-server';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { IUsageCounter } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counter';
-import { BehaviorSubject } from 'rxjs';
-import { Readable } from 'stream';
-import supertest from 'supertest';
+
 import { ReportingCore } from '../../..';
 import { PUBLIC_ROUTES } from '../../../../common/constants';
 import { ReportingInternalSetup, ReportingInternalStart } from '../../../core';
-import { ExportType } from '../../../export_types/common';
 import { ContentStream, ExportTypesRegistry, getContentStream } from '../../../lib';
 import { reportingMock } from '../../../mocks';
 import {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/services.ts b/x-pack/plugins/reporting/server/services.ts
deleted file mode 100644
index a09442ec327934..00000000000000
--- a/x-pack/plugins/reporting/server/services.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FieldFormatsStart } from '@kbn/field-formats-plugin/server';
-import { createGetterSetter } from '@kbn/kibana-utils-plugin/server';
-
-export const [getFieldFormats, setFieldFormats] =
-  createGetterSetter<FieldFormatsStart>('FieldFormats');
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
index d96a66bc9b9fd9..eb308d9cf0e15e 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
@@ -8,6 +8,8 @@
 jest.mock('../routes');
 jest.mock('../usage');
 
+import { BehaviorSubject } from 'rxjs';
+
 import {
   coreMock,
   docLinksServiceMock,
@@ -21,16 +23,16 @@ import { featuresPluginMock } from '@kbn/features-plugin/server/mocks';
 import { FieldFormatsRegistry } from '@kbn/field-formats-plugin/common';
 import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
+import type { ReportingConfigType } from '@kbn/reporting-server';
+import { setFieldFormats } from '@kbn/reporting-server';
 import { createMockScreenshottingStart } from '@kbn/screenshotting-plugin/server/mock';
 import { securityMock } from '@kbn/security-plugin/server/mocks';
 import { taskManagerMock } from '@kbn/task-manager-plugin/server/mocks';
-import { BehaviorSubject } from 'rxjs';
-import { DeepPartial } from 'utility-types';
 import { ReportingCore } from '..';
-import { ReportingConfigType } from '../config';
+
 import { ReportingInternalSetup, ReportingInternalStart } from '../core';
 import { ReportingStore } from '../lib';
-import { setFieldFormats } from '../services';
 
 export const createMockPluginSetup = (
   setupMock: Partial<Record<keyof ReportingInternalSetup, any>>
@@ -83,44 +85,6 @@ export const createMockPluginStart = async (
   };
 };
 
-export const createMockConfigSchema = (
-  overrides: DeepPartial<ReportingConfigType> = {}
-): ReportingConfigType => {
-  // deeply merge the defaults and the provided partial schema
-  return {
-    index: '.reporting',
-    encryptionKey: 'cool-encryption-key-where-did-you-find-it',
-    ...overrides,
-    kibanaServer: {
-      hostname: 'localhost',
-      ...overrides.kibanaServer,
-    },
-    queue: {
-      indexInterval: 'week',
-      pollEnabled: true,
-      pollInterval: 3000,
-      timeout: 120000,
-      ...overrides.queue,
-    },
-    csv: {
-      scroll: { size: 500, duration: '30s' },
-      ...overrides.csv,
-    },
-    roles: {
-      enabled: false,
-      ...overrides.roles,
-    },
-    capture: { maxAttempts: 1 },
-    export_types: {
-      pdf: { enabled: true },
-      png: { enabled: true },
-      csv: { enabled: true },
-      ...overrides.export_types,
-    },
-    statefulSettings: { enabled: true },
-  } as ReportingConfigType;
-};
-
 export const createMockReportingCore = async (
   config: ReportingConfigType,
   setupDepsMock: ReportingInternalSetup | undefined = undefined,
diff --git a/x-pack/plugins/reporting/server/test_helpers/index.ts b/x-pack/plugins/reporting/server/test_helpers/index.ts
index 2ad4f4b027af25..781a074a5563e4 100644
--- a/x-pack/plugins/reporting/server/test_helpers/index.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/index.ts
@@ -6,7 +6,6 @@
  */
 
 export {
-  createMockConfigSchema,
   createMockPluginSetup,
   createMockPluginStart,
   createMockReportingCore,
diff --git a/x-pack/plugins/reporting/server/types.ts b/x-pack/plugins/reporting/server/types.ts
index d2ece5f1e2faba..8f85a75649f3f3 100644
--- a/x-pack/plugins/reporting/server/types.ts
+++ b/x-pack/plugins/reporting/server/types.ts
@@ -5,13 +5,16 @@
  * 2.0.
  */
 
-import type { CustomRequestHandlerContext, IRouter, KibanaRequest } from '@kbn/core/server';
+import { CustomRequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+import { IRouter } from '@kbn/core-http-server';
 import type { DataPluginStart } from '@kbn/data-plugin/server/plugin';
-import { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
+import type { DiscoverServerPluginStart } from '@kbn/discover-plugin/server';
 import type { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
-import { FieldFormatsStart } from '@kbn/field-formats-plugin/server';
+import type { FieldFormatsStart } from '@kbn/field-formats-plugin/server';
 import type { LicensingPluginStart } from '@kbn/licensing-plugin/server';
-import type { CancellationToken, TaskRunResult } from '@kbn/reporting-common';
+import type { UrlOrUrlLocatorTuple } from '@kbn/reporting-common/types';
+import type { ReportApiJSON } from '@kbn/reporting-common/types';
+import type { ReportingConfigType } from '@kbn/reporting-server';
 import type { ScreenshotModePluginSetup } from '@kbn/screenshot-mode-plugin/server';
 import type {
   PdfScreenshotOptions as BasePdfScreenshotOptions,
@@ -29,10 +32,7 @@ import type {
   TaskManagerStartContract,
 } from '@kbn/task-manager-plugin/server';
 import type { UsageCollectionSetup } from '@kbn/usage-collection-plugin/server';
-import type { Writable } from 'stream';
-import type { BaseParams, BasePayload, ReportApiJSON, UrlOrUrlLocatorTuple } from '../common/types';
-import type { ReportingConfigType } from './config';
-import { ReportingCore } from './core';
+
 import { ExportTypesRegistry } from './lib';
 
 /**
@@ -40,8 +40,6 @@ import { ExportTypesRegistry } from './lib';
  */
 export interface ReportingSetup {
   registerExportTypes: ExportTypesRegistry['register'];
-  getSpaceId: ReportingCore['getSpaceId'];
-  getScreenshots?: ReportingCore['getScreenshots'];
   /**
    * Used to inform plugins if Reporting config is compatible with UI Capabilities / Application Sub-Feature Controls
    */
@@ -56,47 +54,12 @@ export type ReportingUser = { username: AuthenticatedUser['username'] } | false;
 
 export type ScrollConfig = ReportingConfigType['csv']['scroll'];
 
-/**
- * Interface of a response to an HTTP request for our plugin to generate a report.
- * @public
- */
-export interface ReportingJobResponse {
-  /**
-   * Contractual field with Watcher: used to automate download of the report once it is finished
-   * @public
-   */
-  path: string;
-  /**
-   * Details of a new report job that was requested
-   * @public
-   */
-  job: ReportApiJSON;
-}
-
-/**
- * Internal Types
- */
-// standard type for create job function of any ExportType implementation
-export type CreateJobFn<JobParamsType = BaseParams, JobPayloadType = BasePayload> = (
-  jobParams: JobParamsType,
-  context: ReportingRequestHandlerContext,
-  req: KibanaRequest
-) => Promise<Omit<JobPayloadType, 'headers' | 'spaceId'>>;
-
-// standard type for run task function of any ExportType implementation
-export type RunTaskFn<TaskPayloadType = BasePayload> = (
-  jobId: string,
-  payload: TaskPayloadType,
-  cancellationToken: CancellationToken,
-  stream: Writable
-) => Promise<TaskRunResult>;
-
 export interface ReportingSetupDeps {
   features: FeaturesPluginSetup;
-  screenshotMode?: ScreenshotModePluginSetup;
+  screenshotMode: ScreenshotModePluginSetup;
+  taskManager: TaskManagerSetupContract;
   security?: SecurityPluginSetup;
   spaces?: SpacesPluginSetup;
-  taskManager: TaskManagerSetupContract;
   usageCollection?: UsageCollectionSetup;
 }
 
@@ -105,9 +68,9 @@ export interface ReportingStartDeps {
   discover: DiscoverServerPluginStart;
   fieldFormats: FieldFormatsStart;
   licensing: LicensingPluginStart;
+  taskManager: TaskManagerStartContract;
   screenshotting?: ScreenshottingStart;
   security?: SecurityPluginStart;
-  taskManager: TaskManagerStartContract;
 }
 
 export type ReportingRequestHandlerContext = CustomRequestHandlerContext<{
@@ -116,6 +79,23 @@ export type ReportingRequestHandlerContext = CustomRequestHandlerContext<{
 
 export type ReportingPluginRouter = IRouter<ReportingRequestHandlerContext>;
 
+/**
+ * Interface of a response to an HTTP request for our plugin to generate a report.
+ * @public
+ */
+export interface ReportingJobResponse {
+  /**
+   * Contractual field with Watcher: used to automate download of the report once it is finished
+   * @public
+   */
+  path: string;
+  /**
+   * Details of a new report job that was requested
+   * @public
+   */
+  job: ReportApiJSON;
+}
+
 export interface PdfScreenshotOptions extends Omit<BasePdfScreenshotOptions, 'timeouts' | 'urls'> {
   urls: UrlOrUrlLocatorTuple[];
 }
@@ -123,5 +103,3 @@ export interface PdfScreenshotOptions extends Omit<BasePdfScreenshotOptions, 'ti
 export interface PngScreenshotOptions extends Omit<BasePngScreenshotOptions, 'timeouts' | 'urls'> {
   urls: UrlOrUrlLocatorTuple[];
 }
-
-export type { BaseParams, BasePayload };
diff --git a/x-pack/plugins/reporting/server/usage/get_export_stats.test.ts b/x-pack/plugins/reporting/server/usage/get_export_stats.test.ts
index 3db82290c4671b..b901b13a98f8b0 100644
--- a/x-pack/plugins/reporting/server/usage/get_export_stats.test.ts
+++ b/x-pack/plugins/reporting/server/usage/get_export_stats.test.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import { ExportTypesRegistry } from '../lib';
-import { createMockReportingCore, createMockConfigSchema } from '../test_helpers';
+import { createMockReportingCore } from '../test_helpers';
 import { getExportStats } from './get_export_stats';
 import { getExportTypesHandler } from './get_export_type_handler';
 import { ErrorCodeStats, FeatureAvailabilityMap, MetricsStats } from './types';
diff --git a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
index c8ef2790932f66..5946e15b2dda32 100644
--- a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
+++ b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
@@ -6,9 +6,9 @@
  */
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { ElasticsearchClient } from '@kbn/core/server';
+import { REPORTING_SYSTEM_INDEX } from '@kbn/reporting-common';
 import { get, pick } from 'lodash';
 import type { GetLicense } from '.';
-import { REPORTING_SYSTEM_INDEX } from '../../common/constants';
 import type { ExportTypesRegistry } from '../lib/export_types_registry';
 import {
   FIELD_EXECUTION_TIME_MS,
diff --git a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
index 55111f23388774..d7a0492005868c 100644
--- a/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
+++ b/x-pack/plugins/reporting/server/usage/reporting_usage_collector.test.ts
@@ -5,20 +5,21 @@
  * 2.0.
  */
 
-import { loggerMock } from '@kbn/logging-mocks';
 import type { ElasticsearchClientMock } from '@kbn/core/server/mocks';
+import { loggerMock } from '@kbn/logging-mocks';
+import { createMockConfigSchema } from '@kbn/reporting-mocks-server';
 import {
   Collector,
   createCollectorFetchContextMock,
   usageCollectionPluginMock,
 } from '@kbn/usage-collection-plugin/server/mocks';
-import { createMockConfigSchema, createMockReportingCore } from '../test_helpers';
 import { FeaturesAvailability } from '.';
+import { ExportTypesRegistry } from '../lib';
+import { createMockReportingCore } from '../test_helpers';
 import {
   getReportingUsageCollector,
   registerReportingUsageCollector,
 } from './reporting_usage_collector';
-import { ExportTypesRegistry } from '../lib';
 
 const getLicenseMock =
   (licenseType = 'gold') =>
diff --git a/x-pack/plugins/reporting/tsconfig.json b/x-pack/plugins/reporting/tsconfig.json
index be183ef08a3663..53a4ab34eb1974 100644
--- a/x-pack/plugins/reporting/tsconfig.json
+++ b/x-pack/plugins/reporting/tsconfig.json
@@ -10,7 +10,6 @@
     "@kbn/discover-plugin",
     "@kbn/embeddable-plugin",
     "@kbn/kibana-react-plugin",
-    "@kbn/kibana-utils-plugin",
     "@kbn/management-plugin",
     "@kbn/screenshot-mode-plugin",
     "@kbn/share-plugin",
@@ -36,12 +35,21 @@
     "@kbn/core-http-server",
     "@kbn/core-test-helpers-test-utils",
     "@kbn/safer-lodash-set",
-    "@kbn/generate-csv",
     "@kbn/reporting-common",
     "@kbn/saved-search-plugin",
     "@kbn/core-http-router-server-internal",
+    "@kbn/reporting-server",
+    "@kbn/reporting-export-types-csv",
+    "@kbn/reporting-export-types-pdf",
+    "@kbn/reporting-export-types-png",
+    "@kbn/reporting-export-types-pdf-common",
+    "@kbn/reporting-export-types-csv-common",
     "@kbn/core-http-common",
     "@kbn/react-kibana-context-theme",
+    "@kbn/reporting-export-types-png-common",
+    "@kbn/reporting-mocks-server",
+    "@kbn/core-http-request-handler-context-server",
+    "@kbn/reporting-public",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/rollup/server/index.ts b/x-pack/plugins/rollup/server/index.ts
index 8f41f7f9cf6fe4..fd3f92e126840f 100644
--- a/x-pack/plugins/rollup/server/index.ts
+++ b/x-pack/plugins/rollup/server/index.ts
@@ -6,9 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { RollupPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
-  new RollupPlugin(pluginInitializerContext);
+export const plugin = async (pluginInitializerContext: PluginInitializerContext) => {
+  const { RollupPlugin } = await import('./plugin');
+  return new RollupPlugin(pluginInitializerContext);
+};
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index c39aeb158be745..826d0d6f23bab5 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -9,7 +9,6 @@
 /* eslint-disable @kbn/eslint/no_export_all */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { RuleRegistryPlugin } from './plugin';
 
 export type { RuleRegistryPluginSetupContract, RuleRegistryPluginStartContract } from './plugin';
 export type { IRuleDataService, RuleDataPluginService } from './rule_data_plugin_service';
@@ -37,5 +36,7 @@ export { createPersistenceRuleTypeWrapper } from './utils/create_persistence_rul
 export * from './utils/persistence_types';
 export type { AlertsClient } from './alert_data_client/alerts_client';
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new RuleRegistryPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { RuleRegistryPlugin } = await import('./plugin');
+  return new RuleRegistryPlugin(initContext);
+};
diff --git a/x-pack/plugins/saved_objects_tagging/server/index.ts b/x-pack/plugins/saved_objects_tagging/server/index.ts
index b9fcdcdbb7b4e6..8c0d4f98b69948 100644
--- a/x-pack/plugins/saved_objects_tagging/server/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/server/index.ts
@@ -6,7 +6,6 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SavedObjectTaggingPlugin } from './plugin';
 
 export { config } from './config';
 export type {
@@ -17,5 +16,7 @@ export type {
 export type { IAssignmentService } from './services';
 export type { ITagsClient } from '../common';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new SavedObjectTaggingPlugin();
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { SavedObjectTaggingPlugin } = await import('./plugin');
+  return new SavedObjectTaggingPlugin();
+};
diff --git a/x-pack/plugins/screenshotting/common/index.ts b/x-pack/plugins/screenshotting/common/index.ts
index 3e36d061cba498..cb89ef794eb91e 100644
--- a/x-pack/plugins/screenshotting/common/index.ts
+++ b/x-pack/plugins/screenshotting/common/index.ts
@@ -5,13 +5,16 @@
  * 2.0.
  */
 
+import * as errors from './errors';
+export { errors };
+
 export {
   SCREENSHOTTING_APP_ID,
   SCREENSHOTTING_EXPRESSION,
   SCREENSHOTTING_EXPRESSION_INPUT,
 } from './expression';
+
 export type { LayoutParams, LayoutType } from './layout';
-export { errors };
-import * as errors from './errors';
+export type { PerformanceMetrics } from './types';
 
 export const PLUGIN_ID = 'screenshotting';
diff --git a/x-pack/plugins/screenshotting/common/types.ts b/x-pack/plugins/screenshotting/common/types.ts
new file mode 100644
index 00000000000000..3e6ad952baf55d
--- /dev/null
+++ b/x-pack/plugins/screenshotting/common/types.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Collected performance metrics during a screenshotting session.
+ */
+export interface PerformanceMetrics {
+  /**
+   * The percentage of CPU time spent by the browser divided by number or cores.
+   */
+  cpu?: number;
+
+  /**
+   * The percentage of CPU in percent untis.
+   */
+  cpuInPercentage?: number;
+
+  /**
+   * The total amount of memory used by the browser.
+   */
+  memory?: number;
+
+  /**
+   * The total amount of memory used by the browser in megabytes.
+   */
+  memoryInMegabytes?: number;
+}
diff --git a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/index.ts b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/index.ts
index ce8b8a3a209d9a..9558b1f6a875fe 100644
--- a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/index.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/index.ts
@@ -26,13 +26,14 @@ import {
   takeUntil,
   tap,
 } from 'rxjs/operators';
+import { PerformanceMetrics } from '../../../../common/types';
 import { getChromiumDisconnectedError } from '..';
 import { errors } from '../../../../common';
 import { ConfigType } from '../../../config';
 import { safeChildProcess } from '../../safe_child_process';
 import { HeadlessChromiumDriver } from '../driver';
 import { args } from './args';
-import { getMetrics, PerformanceMetrics } from './metrics';
+import { getMetrics } from './metrics';
 
 interface CreatePageOptions {
   browserTimezone?: string;
@@ -455,5 +456,3 @@ export class HeadlessChromiumDriverFactory {
     );
   }
 }
-
-export type { PerformanceMetrics };
diff --git a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/metrics.ts b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/metrics.ts
index 6e9971324ae4b8..9c48a1e1fde2a5 100644
--- a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/metrics.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/metrics.ts
@@ -7,6 +7,7 @@
 
 import type { Metrics as PuppeteerMetrics } from 'puppeteer';
 import { cpus } from 'os';
+import { PerformanceMetrics } from '../../../../common/types';
 
 declare module 'puppeteer' {
   interface CDPSession {
@@ -29,31 +30,6 @@ interface NormalizedMetrics extends Required<PuppeteerMetrics> {
   ProcessTime: number;
 }
 
-/**
- * Collected performance metrics during a screenshotting session.
- */
-export interface PerformanceMetrics {
-  /**
-   * The percentage of CPU time spent by the browser divided by number or cores.
-   */
-  cpu: number;
-
-  /**
-   * The percentage of CPU in percent untis.
-   */
-  cpuInPercentage: number;
-
-  /**
-   * The total amount of memory used by the browser.
-   */
-  memory: number;
-
-  /**
-   * The total amount of memory used by the browser in megabytes.
-   */
-  memoryInMegabytes: number;
-}
-
 function normalizeMetrics({ metrics }: Metrics) {
   return Object.fromEntries(
     metrics.map(({ name, value }) => [name, value])
diff --git a/x-pack/plugins/screenshotting/server/browsers/chromium/index.ts b/x-pack/plugins/screenshotting/server/browsers/chromium/index.ts
index 672ea2ec5f020e..e3f96f3a7445b0 100644
--- a/x-pack/plugins/screenshotting/server/browsers/chromium/index.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/chromium/index.ts
@@ -20,6 +20,5 @@ export const getDisallowedOutgoingUrlError = (interceptedUrl: string) =>
 export { HeadlessChromiumDriver } from './driver';
 export type { Context } from './driver';
 export { DEFAULT_VIEWPORT, HeadlessChromiumDriverFactory } from './driver_factory';
-export type { PerformanceMetrics } from './driver_factory';
 export { ChromiumArchivePaths } from './paths';
 export type { PackageInfo } from './paths';
diff --git a/x-pack/plugins/screenshotting/server/browsers/index.ts b/x-pack/plugins/screenshotting/server/browsers/index.ts
index 15c8b2b2db06bb..0b6402a0bd6fb3 100644
--- a/x-pack/plugins/screenshotting/server/browsers/index.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/index.ts
@@ -7,7 +7,7 @@
 
 export { download } from './download';
 export { install } from './install';
-export type { Context, PerformanceMetrics } from './chromium';
+export type { Context } from './chromium';
 export {
   getChromiumDisconnectedError,
   ChromiumArchivePaths,
diff --git a/x-pack/plugins/screenshotting/server/index.ts b/x-pack/plugins/screenshotting/server/index.ts
index 10d445b5e0eb10..414fde21c85a9c 100755
--- a/x-pack/plugins/screenshotting/server/index.ts
+++ b/x-pack/plugins/screenshotting/server/index.ts
@@ -5,13 +5,14 @@
  * 2.0.
  */
 
-import { ScreenshottingPlugin } from './plugin';
+import { PluginInitializerContext } from '@kbn/core-plugins-server';
 
 /**
  * Screenshotting plugin entry point.
  */
-export function plugin(...args: ConstructorParameters<typeof ScreenshottingPlugin>) {
-  return new ScreenshottingPlugin(...args);
+export async function plugin(pluginInitializerContext: PluginInitializerContext) {
+  const { ScreenshottingPlugin } = await import('./plugin');
+  return new ScreenshottingPlugin(pluginInitializerContext);
 }
 
 export { config } from './config';
diff --git a/x-pack/plugins/screenshotting/server/screenshots/index.ts b/x-pack/plugins/screenshotting/server/screenshots/index.ts
index b1a0d98fe8a279..7f7882cb26b2ef 100644
--- a/x-pack/plugins/screenshotting/server/screenshots/index.ts
+++ b/x-pack/plugins/screenshotting/server/screenshots/index.ts
@@ -9,7 +9,7 @@ import type { KibanaRequest } from '@kbn/core/server';
 import type { ExpressionAstExpression } from '@kbn/expressions-plugin/common';
 import type { Optional } from '@kbn/utility-types';
 import { LayoutParams } from '../../common';
-import { PerformanceMetrics } from '../browsers';
+import { PerformanceMetrics } from '../../common/types';
 import {
   PdfScreenshotOptions,
   PdfScreenshotResult,
diff --git a/x-pack/plugins/screenshotting/tsconfig.json b/x-pack/plugins/screenshotting/tsconfig.json
index 3749a60fc4fe46..f23b380911f0f1 100644
--- a/x-pack/plugins/screenshotting/tsconfig.json
+++ b/x-pack/plugins/screenshotting/tsconfig.json
@@ -25,6 +25,7 @@
     "@kbn/core-logging-server-mocks",
     "@kbn/logging-mocks",
     "@kbn/core-http-server",
+    "@kbn/core-plugins-server",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/searchprofiler/server/index.ts b/x-pack/plugins/searchprofiler/server/index.ts
index 95f5b28435738d..53ef83285622ef 100644
--- a/x-pack/plugins/searchprofiler/server/index.ts
+++ b/x-pack/plugins/searchprofiler/server/index.ts
@@ -6,8 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SearchProfilerServerPlugin } from './plugin';
 
-export const plugin = (ctx: PluginInitializerContext) => {
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { SearchProfilerServerPlugin } = await import('./plugin');
   return new SearchProfilerServerPlugin(ctx);
 };
diff --git a/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.test.tsx b/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.test.tsx
index 2f0910627be9b8..8e11a1929ca160 100644
--- a/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.test.tsx
+++ b/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.test.tsx
@@ -89,7 +89,7 @@ describe('roleMappingsManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Mappings Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":false}
+        Role Mappings Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":false}
       </div>
     `);
 
@@ -111,7 +111,7 @@ describe('roleMappingsManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Mappings Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":true}
+        Role Mappings Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":true}
       </div>
     `);
 
@@ -136,7 +136,7 @@ describe('roleMappingsManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Mapping Edit Page: {"action":"edit","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit","search":"","hash":""}},"readOnly":false}
+        Role Mapping Edit Page: {"action":"edit","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit","search":"","hash":""}},"readOnly":false}
       </div>
     `);
 
@@ -166,7 +166,7 @@ describe('roleMappingsManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Mapping Edit Page: {"action":"edit","name":"role@mapping","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@mapping","search":"","hash":""}},"readOnly":false}
+        Role Mapping Edit Page: {"action":"edit","name":"role@mapping","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@mapping","search":"","hash":""}},"readOnly":false}
       </div>
     `);
 
@@ -197,7 +197,7 @@ describe('roleMappingsManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Mapping Edit Page: {"action":"edit","name":"role@mapping","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@mapping","search":"","hash":""}},"readOnly":true}
+        Role Mapping Edit Page: {"action":"edit","name":"role@mapping","roleMappingsAPI":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"notifications":{"toasts":{}},"docLinks":{},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@mapping","search":"","hash":""}},"readOnly":true}
       </div>
     `);
 
diff --git a/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx b/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
index 5e9d5fcc56350f..300f5e195b510a 100644
--- a/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
@@ -90,7 +90,7 @@ describe('rolesManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Roles Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":false}
+        Roles Page: {"notifications":{"toasts":{}},"rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"readOnly":false}
       </div>
     `);
 
@@ -112,7 +112,7 @@ describe('rolesManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Edit Page: {"action":"edit","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit","search":"","hash":""}}}
+        Role Edit Page: {"action":"edit","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit","search":"","hash":""}}}
       </div>
     `);
 
@@ -139,7 +139,7 @@ describe('rolesManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Edit Page: {"action":"edit","roleName":"role@name","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@name","search":"","hash":""}}}
+        Role Edit Page: {"action":"edit","roleName":"role@name","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/role@name","search":"","hash":""}}}
       </div>
     `);
 
@@ -166,7 +166,7 @@ describe('rolesManagementApp', () => {
     expect(docTitle.reset).not.toHaveBeenCalled();
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Role Edit Page: {"action":"clone","roleName":"someRoleName","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{},"externalUrl":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/clone/someRoleName","search":"","hash":""}}}
+        Role Edit Page: {"action":"clone","roleName":"someRoleName","rolesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"userAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"indicesAPIClient":{"fieldCache":{},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"privilegesAPIClient":{"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}}},"http":{"basePath":{"basePath":"","serverBasePath":"","assetsHrefBase":""},"anonymousPaths":{},"externalUrl":{},"staticAssets":{}},"notifications":{"toasts":{}},"fatalErrors":{},"license":{"features$":{}},"docLinks":{},"uiCapabilities":{"catalogue":{},"management":{},"navLinks":{},"roles":{"save":true}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/clone/someRoleName","search":"","hash":""}}}
       </div>
     `);
 
diff --git a/x-pack/plugins/security/public/nav_control/nav_control_service.test.ts b/x-pack/plugins/security/public/nav_control/nav_control_service.test.ts
index 894fb1b9b804eb..6350641bf5da30 100644
--- a/x-pack/plugins/security/public/nav_control/nav_control_service.test.ts
+++ b/x-pack/plugins/security/public/nav_control/nav_control_service.test.ts
@@ -77,6 +77,7 @@ describe('SecurityNavControlService', () => {
       <div>
         <div
           css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+          data-test-subj="kbnRedirectAppLink"
         >
           <div
             class="euiPopover emotion-euiPopover"
diff --git a/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts b/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
index 7f3f0d57d449ce..202d1b2d578c69 100644
--- a/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
+++ b/x-pack/plugins/security/public/session/unauthorized_response_http_interceptor.test.ts
@@ -8,6 +8,7 @@
 // @ts-ignore
 import fetchMock from 'fetch-mock/es5/client';
 
+import type { HttpSetup } from '@kbn/core/public';
 import { applicationServiceMock } from '@kbn/core/public/mocks';
 import { setup } from '@kbn/core-test-helpers-http-setup-browser';
 
@@ -30,7 +31,7 @@ const setupHttp = (basePath: string) => {
   const { http } = setup((injectedMetadata) => {
     injectedMetadata.getBasePath.mockReturnValue(basePath);
   });
-  return http;
+  return http as HttpSetup;
 };
 const tenant = '';
 const application = applicationServiceMock.createStartContract();
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.ts b/x-pack/plugins/security/server/authorization/check_privileges.ts
index 0e842da4e48511..abc0b791dd49a7 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.ts
@@ -144,13 +144,11 @@ export function checkPrivilegesFactory(
       const indexPrivileges = Object.entries(hasPrivilegesResponse.index ?? {}).reduce<
         CheckPrivilegesResponse['privileges']['elasticsearch']['index']
       >((acc, [index, indexResponse]) => {
-        return {
-          ...acc,
-          [index]: Object.entries(indexResponse).map(([privilege, authorized]) => ({
-            privilege,
-            authorized,
-          })),
-        };
+        acc[index] = Object.entries(indexResponse).map(([privilege, authorized]) => ({
+          privilege,
+          authorized,
+        }));
+        return acc;
       }, {});
 
       // we need to filter out the non requested privileges from the response
diff --git a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
index e3cd51bc77015b..7283b955e906cc 100644
--- a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
+++ b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts
@@ -37,10 +37,8 @@ export function disableUICapabilitiesFactory(
   const elasticsearchFeatureMap = elasticsearchFeatures.reduce<
     Record<string, RecursiveReadonlyArray<FeatureElasticsearchPrivileges>>
   >((acc, esFeature) => {
-    return {
-      ...acc,
-      [esFeature.id]: esFeature.privileges,
-    };
+    acc[esFeature.id] = esFeature.privileges;
+    return acc;
   }, {});
 
   const allRequiredClusterPrivileges = Array.from(
@@ -59,11 +57,9 @@ export function disableUICapabilitiesFactory(
       return {
         ...acc,
         ...Object.entries(p.requiredIndexPrivileges!).reduce((acc2, [indexName, privileges]) => {
-          return {
-            ...acc2,
-            [indexName]: [...(acc[indexName] ?? []), ...privileges],
-          };
-        }, {}),
+          acc2[indexName] = [...(acc[indexName] ?? []), ...privileges];
+          return acc2;
+        }, {} as Record<string, string[]>),
       };
     }, {});
 
@@ -157,14 +153,16 @@ export function disableUICapabilitiesFactory(
     }
 
     const uiActions = Object.entries(uiCapabilities).reduce<string[]>(
-      (acc, [featureId, featureUICapabilities]) => [
-        ...acc,
-        ...flatten(
-          Object.entries(featureUICapabilities).map(([uiCapability, value]) => {
-            return getActionsForFeatureCapability(featureId, uiCapability, value);
-          })
-        ),
-      ],
+      (acc, [featureId, featureUICapabilities]) => {
+        acc.push(
+          ...flatten(
+            Object.entries(featureUICapabilities).map(([uiCapability, value]) => {
+              return getActionsForFeatureCapability(featureId, uiCapability, value);
+            })
+          )
+        );
+        return acc;
+      },
       []
     );
 
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
index 72cc28f5570b53..ef84f8696a2123 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
@@ -18,7 +18,8 @@ export class FeaturePrivilegeManagementBuilder extends BaseFeaturePrivilegeBuild
     }
 
     return Object.entries(managementSections).reduce((acc, [sectionId, items]) => {
-      return [...acc, ...items.map((item) => this.actions.ui.get('management', sectionId, item))];
+      acc.push(...items.map((item) => this.actions.ui.get('management', sectionId, item)));
+      return acc;
     }, [] as string[]);
   }
 }
diff --git a/x-pack/plugins/security/server/authorization/privileges/privileges.ts b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
index 20de4011c39f42..e3e151052f0562 100644
--- a/x-pack/plugins/security/server/authorization/privileges/privileges.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
@@ -37,8 +37,8 @@ export function privilegesFactory(
         (feature) => !feature.excludeFromBasePrivileges
       );
 
-      let allActions: string[] = [];
-      let readActions: string[] = [];
+      const allActionsSet = new Set<string>();
+      const readActionsSet = new Set<string>();
 
       basePrivilegeFeatures.forEach((feature) => {
         for (const { privilegeId, privilege } of featuresService.featurePrivilegeIterator(feature, {
@@ -47,15 +47,17 @@ export function privilegesFactory(
           predicate: (pId, featurePrivilege) => !featurePrivilege.excludeFromBasePrivileges,
         })) {
           const privilegeActions = featurePrivilegeBuilder.getActions(privilege, feature);
-          allActions = [...allActions, ...privilegeActions];
-          if (privilegeId === 'read') {
-            readActions = [...readActions, ...privilegeActions];
-          }
+          privilegeActions.forEach((action) => {
+            allActionsSet.add(action);
+            if (privilegeId === 'read') {
+              readActionsSet.add(action);
+            }
+          });
         }
       });
 
-      allActions = uniq(allActions);
-      readActions = uniq(readActions);
+      const allActions = [...allActionsSet];
+      const readActions = [...readActionsSet];
 
       const featurePrivileges: Record<string, Record<string, string[]>> = {};
       for (const feature of features) {
diff --git a/x-pack/plugins/security/server/index.ts b/x-pack/plugins/security/server/index.ts
index 4cf199ef6d686d..3d5cd022b4c966 100644
--- a/x-pack/plugins/security/server/index.ts
+++ b/x-pack/plugins/security/server/index.ts
@@ -16,7 +16,6 @@ import type { RecursiveReadonly } from '@kbn/utility-types';
 import { ConfigSchema } from './config';
 import { securityConfigDeprecationProvider } from './config_deprecations';
 import type { PluginSetupDependencies, SecurityPluginSetup, SecurityPluginStart } from './plugin';
-import { SecurityPlugin } from './plugin';
 
 // These exports are part of public Security plugin contract, any change in signature of exported
 // functions or removal of exports should be considered as a breaking change.
@@ -63,4 +62,7 @@ export const plugin: PluginInitializer<
   RecursiveReadonly<SecurityPluginSetup>,
   RecursiveReadonly<SecurityPluginStart>,
   PluginSetupDependencies
-> = (initializerContext: PluginInitializerContext) => new SecurityPlugin(initializerContext);
+> = async (initializerContext: PluginInitializerContext) => {
+  const { SecurityPlugin } = await import('./plugin');
+  return new SecurityPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/security/server/routes/authorization/privileges/get.ts b/x-pack/plugins/security/server/routes/authorization/privileges/get.ts
index 8817fca4831ae4..1d278aa676ac38 100644
--- a/x-pack/plugins/security/server/routes/authorization/privileges/get.ts
+++ b/x-pack/plugins/security/server/routes/authorization/privileges/get.ts
@@ -38,12 +38,10 @@ export function defineGetPrivilegesRoutes({ router, authz }: RouteDefinitionPara
             space: Object.keys(privileges.space),
             features: Object.entries(privileges.features).reduce(
               (acc, [featureId, featurePrivileges]) => {
-                return {
-                  ...acc,
-                  [featureId]: Object.keys(featurePrivileges),
-                };
+                acc[featureId] = Object.keys(featurePrivileges);
+                return acc;
               },
-              {}
+              {} as Record<string, string[]>
             ),
             reserved: Object.keys(privileges.reserved),
           };
diff --git a/x-pack/plugins/security/server/saved_objects/ensure_authorized.ts b/x-pack/plugins/security/server/saved_objects/ensure_authorized.ts
index e945848d711054..79e15be6507732 100644
--- a/x-pack/plugins/security/server/saved_objects/ensure_authorized.ts
+++ b/x-pack/plugins/security/server/saved_objects/ensure_authorized.ts
@@ -104,7 +104,10 @@ export async function ensureAuthorized<T extends string>(
 
   // Neither fully nor partially authorized. Bail with error.
   const uniqueUnauthorizedPrivileges = [...missingPrivileges.entries()].reduce(
-    (acc, [, privilegeSet]) => new Set([...acc, ...privilegeSet]),
+    (acc, [, privilegeSet]) => {
+      privilegeSet.forEach((entry) => acc.add(entry));
+      return acc;
+    },
     new Set<string>()
   );
   const targetTypesAndActions = [...uniqueUnauthorizedPrivileges]
diff --git a/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.ts b/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.ts
index 18c6ae824584c9..1e9e25b6b800d8 100644
--- a/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.ts
+++ b/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.ts
@@ -81,10 +81,13 @@ export class SecureSpacesClientWrapper implements ISpacesClient {
 
     // Collect all privileges which need to be checked
     const allPrivileges = Object.entries(PURPOSE_PRIVILEGE_MAP).reduce(
-      (acc, [getSpacesPurpose, privilegeFactory]) =>
-        !includeAuthorizedPurposes && getSpacesPurpose !== purpose
-          ? acc
-          : { ...acc, [getSpacesPurpose]: privilegeFactory(this.authorization) },
+      (acc, [getSpacesPurpose, privilegeFactory]) => {
+        if (!includeAuthorizedPurposes && getSpacesPurpose !== purpose) {
+          return acc;
+        }
+        acc[getSpacesPurpose as GetAllSpacesPurpose] = privilegeFactory(this.authorization);
+        return acc;
+      },
       {} as Record<GetAllSpacesPurpose, string[]>
     );
 
@@ -117,7 +120,8 @@ export class SecureSpacesClientWrapper implements ISpacesClient {
             const requiredActions = privilegeFactory(this.authorization);
             const hasAllRequired = checkHasAllRequired(space, requiredActions);
             hasAnyAuthorization = hasAnyAuthorization || hasAllRequired;
-            return { ...acc, [purposeKey]: hasAllRequired };
+            acc[purposeKey as GetAllSpacesPurpose] = hasAllRequired;
+            return acc;
           },
           {} as Record<GetAllSpacesPurpose, boolean>
         );
diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts
index f73ac0bbb25a3b..58599433914424 100644
--- a/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts
+++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts
@@ -160,12 +160,7 @@ export function registerSecurityUsageCollector({ usageCollection, config, licens
       const loginSelectorEnabled = config.authc.selector.enabled;
       const authProviderCount = config.authc.sortedProviders.length;
       const enabledAuthProviders = [
-        ...new Set(
-          config.authc.sortedProviders.reduce(
-            (acc, provider) => [...acc, provider.type],
-            [] as string[]
-          )
-        ),
+        ...new Set(config.authc.sortedProviders.map((provider) => provider.type)),
       ];
       const accessAgreementEnabled =
         allowAccessAgreement &&
diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/model/schemas.ts b/x-pack/plugins/security_solution/common/api/detection_engine/model/schemas.ts
index 35a394edcb6adf..bfbba49bb80ea5 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/model/schemas.ts
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/model/schemas.ts
@@ -8,7 +8,7 @@
 /* eslint-disable @typescript-eslint/naming-convention */
 
 import * as t from 'io-ts';
-import { IsoDateString, PositiveInteger } from '@kbn/securitysolution-io-ts-types';
+import { PositiveInteger } from '@kbn/securitysolution-io-ts-types';
 
 export const file_name = t.string;
 export type FileName = t.TypeOf<typeof file_name>;
@@ -42,13 +42,6 @@ export const signal_status_query = t.object;
 export const alert_tag_ids = t.array(t.string);
 export type AlertTagIds = t.TypeOf<typeof alert_tag_ids>;
 
-export const created_at = IsoDateString;
-export const updated_at = IsoDateString;
-export const created_by = t.string;
-export const updated_by = t.string;
-
-export const revision = PositiveInteger;
-
 export const indexRecord = t.record(
   t.string,
   t.type({
diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.mock.ts b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.mock.ts
index cec58d1c5fdc6a..6161e2a00f9607 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.mock.ts
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.mock.ts
@@ -16,6 +16,7 @@ export const getImportRulesSchemaMock = (ruleId = 'rule-1'): RuleToImport => ({
   risk_score: 55,
   language: 'kuery',
   rule_id: ruleId,
+  immutable: false,
 });
 
 export const getImportRulesWithIdSchemaMock = (ruleId = 'rule-1'): RuleToImport => ({
@@ -28,6 +29,7 @@ export const getImportRulesWithIdSchemaMock = (ruleId = 'rule-1'): RuleToImport
   risk_score: 55,
   language: 'kuery',
   rule_id: ruleId,
+  immutable: false,
 });
 
 /**
@@ -79,6 +81,7 @@ export const getImportThreatMatchRulesSchemaMock = (ruleId = 'rule-1'): RuleToIm
       },
     },
   ],
+  immutable: false,
 });
 
 export const webHookConnector = {
diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.test.ts b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.test.ts
index 29ad45c10bf843..f53f67757ccdbd 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.test.ts
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.test.ts
@@ -5,11 +5,9 @@
  * 2.0.
  */
 
-import { left } from 'fp-ts/lib/Either';
-import { pipe } from 'fp-ts/lib/pipeable';
-import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
-
+import { expectParseError, expectParseSuccess, stringifyZodError } from '@kbn/zod-helpers';
 import { getListArrayMock } from '../../../../detection_engine/schemas/types/lists.mock';
+import type { RuleToImportInput } from './rule_to_import';
 import { RuleToImport } from './rule_to_import';
 import {
   getImportRulesSchemaMock,
@@ -18,193 +16,72 @@ import {
 
 describe('RuleToImport', () => {
   test('empty objects do not validate', () => {
-    const payload: Partial<RuleToImport> = {};
+    const payload: Partial<RuleToImportInput> = {};
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "description"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "name"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "rule_id"'
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"name: Required, description: Required, risk_score: Required, severity: Required, rule_id: Required, and 25 more"`
     );
-    expect(message.schema).toEqual({});
   });
 
-  test('made up values do not validate', () => {
-    const payload: RuleToImport & { madeUp: string } = {
+  test('extra properties are removed', () => {
+    const payload: RuleToImportInput & { madeUp: string } = {
       ...getImportRulesSchemaMock(),
       madeUp: 'hi',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['invalid keys "madeUp"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseSuccess(result);
+
+    expect(result.data).toEqual(getImportRulesSchemaMock());
   });
 
   test('[rule_id] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "description"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "name"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"name: Required, description: Required, risk_score: Required, severity: Required, type: Invalid literal value, expected \\"eql\\", and 24 more"`
     );
-    expect(message.schema).toEqual({});
   });
 
   test('[rule_id, description] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
       description: 'some description',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "name"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"name: Required, risk_score: Required, severity: Required, type: Invalid literal value, expected \\"eql\\", query: Required, and 23 more"`
     );
-    expect(message.schema).toEqual({});
   });
 
   test('[rule_id, description, from] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
       description: 'some description',
       from: 'now-5m',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "name"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
-    );
-    expect(message.schema).toEqual({});
-  });
-
-  test('[rule_id, description, from, to] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
-      rule_id: 'rule-1',
-      description: 'some description',
-      from: 'now-5m',
-      to: 'now',
-    };
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "name"'
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"name: Required, risk_score: Required, severity: Required, type: Invalid literal value, expected \\"eql\\", query: Required, and 23 more"`
     );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
-    );
-    expect(message.schema).toEqual({});
-  });
-
-  test('[rule_id, description, from, to, name] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
-      rule_id: 'rule-1',
-      description: 'some description',
-      from: 'now-5m',
-      to: 'now',
-      name: 'some-name',
-    };
-
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "severity"'
-    );
-    expect(message.schema).toEqual({});
-  });
-
-  test('[rule_id, description, from, to, name, severity] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
-      rule_id: 'rule-1',
-      description: 'some description',
-      from: 'now-5m',
-      to: 'now',
-      name: 'some-name',
-      severity: 'low',
-    };
-
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toContain(
-      'Invalid value "undefined" supplied to "risk_score"'
-    );
-    expect(message.schema).toEqual({});
-  });
-
-  test('[rule_id, description, from, to, name, severity, type] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
-      rule_id: 'rule-1',
-      description: 'some description',
-      from: 'now-5m',
-      to: 'now',
-      name: 'some-name',
-      severity: 'low',
-      type: 'query',
-    };
-
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "risk_score"',
-    ]);
-    expect(message.schema).toEqual({});
   });
 
   test('[rule_id, description, from, to, name, severity, type, interval] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
       description: 'some description',
       from: 'now-5m',
@@ -215,17 +92,14 @@ describe('RuleToImport', () => {
       type: 'query',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "risk_score"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"risk_score: Required"`);
   });
 
   test('[rule_id, description, from, to, name, severity, type, interval, index] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
       description: 'some description',
       from: 'now-5m',
@@ -237,17 +111,14 @@ describe('RuleToImport', () => {
       index: ['index-1'],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "risk_score"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"risk_score: Required"`);
   });
 
   test('[rule_id, description, from, to, name, severity, type, query, index, interval] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       risk_score: 50,
       description: 'some description',
@@ -261,14 +132,13 @@ describe('RuleToImport', () => {
       interval: '5m',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, query, language] does not validate', () => {
-    const payload: Partial<RuleToImport> = {
+    const payload: Partial<RuleToImportInput> = {
       rule_id: 'rule-1',
       description: 'some description',
       from: 'now-5m',
@@ -282,17 +152,14 @@ describe('RuleToImport', () => {
       language: 'kuery',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "risk_score"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"risk_score: Required"`);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       risk_score: 50,
       description: 'some description',
@@ -307,14 +174,13 @@ describe('RuleToImport', () => {
       language: 'kuery',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score, output_index] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       output_index: '.siem-signals',
       risk_score: 50,
@@ -330,14 +196,13 @@ describe('RuleToImport', () => {
       language: 'kuery',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       description: 'some description',
       from: 'now-5m',
@@ -350,14 +215,13 @@ describe('RuleToImport', () => {
       risk_score: 50,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       output_index: '.siem-signals',
       risk_score: 50,
@@ -371,26 +235,24 @@ describe('RuleToImport', () => {
       type: 'query',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You can send in an empty array to threat', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       threat: [],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index, threat] does validate', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       rule_id: 'rule-1',
       output_index: '.siem-signals',
       risk_score: 50,
@@ -421,81 +283,78 @@ describe('RuleToImport', () => {
       ],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('allows references to be sent as valid', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       references: ['index-1'],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('defaults references to an array if it is not sent in', () => {
     const { references, ...noReferences } = getImportRulesSchemaMock();
-    const decoded = RuleToImport.decode(noReferences);
-    const checked = exactCheck(noReferences, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(noReferences);
+
+    expectParseSuccess(result);
   });
 
   test('references cannot be numbers', () => {
-    const payload: Omit<RuleToImport, 'references'> & { references: number[] } = {
+    const payload: Omit<RuleToImportInput, 'references'> & { references: number[] } = {
       ...getImportRulesSchemaMock(),
       references: [5],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "5" supplied to "references"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"references.0: Expected string, received number"`
+    );
   });
 
   test('indexes cannot be numbers', () => {
-    const payload: Omit<RuleToImport, 'index'> & { index: number[] } = {
+    const payload: Omit<RuleToImportInput, 'index'> & { index: number[] } = {
       ...getImportRulesSchemaMock(),
       index: [5],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "5" supplied to "index"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"type: Invalid literal value, expected \\"eql\\", language: Invalid literal value, expected \\"eql\\", index.0: Expected string, received number, index.0: Expected string, received number, type: Invalid literal value, expected \\"saved_query\\", and 20 more"`
+    );
   });
 
   test('defaults interval to 5 min', () => {
     const { interval, ...noInterval } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noInterval,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('defaults max signals to 100', () => {
     // eslint-disable-next-line @typescript-eslint/naming-convention
     const { max_signals, ...noMaxSignals } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noMaxSignals,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('saved_query type can have filters with it', () => {
@@ -504,25 +363,23 @@ describe('RuleToImport', () => {
       filters: [],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('filters cannot be a string', () => {
-    const payload: Omit<RuleToImport, 'filters'> & { filters: string } = {
+    const payload: Omit<RuleToImportInput, 'filters'> & { filters: string } = {
       ...getImportRulesSchemaMock(),
       filters: 'some string',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "some string" supplied to "filters"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"type: Invalid literal value, expected \\"eql\\", language: Invalid literal value, expected \\"eql\\", filters: Expected array, received string, filters: Expected array, received string, type: Invalid literal value, expected \\"saved_query\\", and 20 more"`
+    );
   });
 
   test('language validates with kuery', () => {
@@ -531,10 +388,9 @@ describe('RuleToImport', () => {
       language: 'kuery',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('language validates with lucene', () => {
@@ -543,99 +399,92 @@ describe('RuleToImport', () => {
       language: 'lucene',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('language does not validate with something made up', () => {
-    const payload: Omit<RuleToImport, 'language'> & { language: string } = {
+    const payload: Omit<RuleToImportInput, 'language'> & { language: string } = {
       ...getImportRulesSchemaMock(),
       language: 'something-made-up',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "something-made-up" supplied to "language"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"type: Invalid literal value, expected \\"eql\\", language: Invalid literal value, expected \\"eql\\", language: Invalid enum value. Expected 'kuery' | 'lucene', received 'something-made-up', type: Invalid literal value, expected \\"saved_query\\", saved_id: Required, and 19 more"`
+    );
   });
 
   test('max_signals cannot be negative', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       max_signals: -1,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "-1" supplied to "max_signals"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"max_signals: Number must be greater than or equal to 1"`
+    );
   });
 
   test('max_signals cannot be zero', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       max_signals: 0,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "0" supplied to "max_signals"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"max_signals: Number must be greater than or equal to 1"`
+    );
   });
 
   test('max_signals can be 1', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       max_signals: 1,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You can optionally send in an array of tags', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       tags: ['tag_1', 'tag_2'],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot send in an array of tags that are numbers', () => {
-    const payload: Omit<RuleToImport, 'tags'> & { tags: number[] } = {
+    const payload: Omit<RuleToImportInput, 'tags'> & { tags: number[] } = {
       ...getImportRulesSchemaMock(),
       tags: [0, 1, 2],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "0" supplied to "tags"',
-      'Invalid value "1" supplied to "tags"',
-      'Invalid value "2" supplied to "tags"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"tags.0: Expected string, received number, tags.1: Expected string, received number, tags.2: Expected string, received number"`
+    );
   });
 
   test('You cannot send in an array of threat that are missing "framework"', () => {
-    const payload: Omit<RuleToImport, 'threat'> & {
-      threat: Array<Partial<Omit<RuleToImport['threat'], 'framework'>>>;
+    const payload: Omit<RuleToImportInput, 'threat'> & {
+      threat: Array<Partial<Omit<RuleToImportInput['threat'], 'framework'>>>;
     } = {
       ...getImportRulesSchemaMock(),
       threat: [
@@ -656,18 +505,15 @@ describe('RuleToImport', () => {
       ],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "threat,framework"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"threat.0.framework: Required"`);
   });
 
   test('You cannot send in an array of threat that are missing "tactic"', () => {
-    const payload: Omit<RuleToImport, 'threat'> & {
-      threat: Array<Partial<Omit<RuleToImport['threat'], 'tactic'>>>;
+    const payload: Omit<RuleToImportInput, 'threat'> & {
+      threat: Array<Partial<Omit<RuleToImportInput['threat'], 'tactic'>>>;
     } = {
       ...getImportRulesSchemaMock(),
       threat: [
@@ -684,18 +530,15 @@ describe('RuleToImport', () => {
       ],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "threat,tactic"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"threat.0.tactic: Required"`);
   });
 
   test('You can send in an array of threat that are missing "technique"', () => {
-    const payload: Omit<RuleToImport, 'threat'> & {
-      threat: Array<Partial<Omit<RuleToImport['threat'], 'technique'>>>;
+    const payload: Omit<RuleToImportInput, 'threat'> & {
+      threat: Array<Partial<Omit<RuleToImportInput['threat'], 'technique'>>>;
     } = {
       ...getImportRulesSchemaMock(),
       threat: [
@@ -710,206 +553,194 @@ describe('RuleToImport', () => {
       ],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You can optionally send in an array of false positives', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       false_positives: ['false_1', 'false_2'],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot send in an array of false positives that are numbers', () => {
-    const payload: Omit<RuleToImport, 'false_positives'> & { false_positives: number[] } = {
+    const payload: Omit<RuleToImportInput, 'false_positives'> & { false_positives: number[] } = {
       ...getImportRulesSchemaMock(),
       false_positives: [5, 4],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "5" supplied to "false_positives"',
-      'Invalid value "4" supplied to "false_positives"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"false_positives.0: Expected string, received number, false_positives.1: Expected string, received number"`
+    );
   });
 
   test('You cannot set the immutable to a number when trying to create a rule', () => {
-    const payload: Omit<RuleToImport, 'immutable'> & { immutable: number } = {
+    const payload: Omit<RuleToImportInput, 'immutable'> & { immutable: number } = {
       ...getImportRulesSchemaMock(),
       immutable: 5,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "5" supplied to "immutable"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"immutable: Invalid literal value, expected false"`
+    );
   });
 
   test('You can optionally set the immutable to be false', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       immutable: false,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot set the immutable to be true', () => {
-    const payload: RuleToImport = {
+    const payload: Omit<RuleToImportInput, 'immutable'> & { immutable: true } = {
       ...getImportRulesSchemaMock(),
       immutable: true,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "true" supplied to "immutable"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"immutable: Invalid literal value, expected false"`
+    );
   });
 
   test('You cannot set the immutable to be a number', () => {
-    const payload: Omit<RuleToImport, 'immutable'> & { immutable: number } = {
+    const payload: Omit<RuleToImportInput, 'immutable'> & { immutable: number } = {
       ...getImportRulesSchemaMock(),
       immutable: 5,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "5" supplied to "immutable"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"immutable: Invalid literal value, expected false"`
+    );
   });
 
   test('You cannot set the risk_score to 101', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       risk_score: 101,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "101" supplied to "risk_score"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"risk_score: Number must be less than or equal to 100"`
+    );
   });
 
   test('You cannot set the risk_score to -1', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       risk_score: -1,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "-1" supplied to "risk_score"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"risk_score: Number must be greater than or equal to 0"`
+    );
   });
 
   test('You can set the risk_score to 0', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       risk_score: 0,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You can set the risk_score to 100', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       risk_score: 100,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You can set meta to any object you want', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       meta: {
         somethingMadeUp: { somethingElse: true },
       },
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot create meta as a string', () => {
-    const payload: Omit<RuleToImport, 'meta'> & { meta: string } = {
+    const payload: Omit<RuleToImportInput, 'meta'> & { meta: string } = {
       ...getImportRulesSchemaMock(),
       meta: 'should not work',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "should not work" supplied to "meta"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"meta: Expected object, received string"`
+    );
   });
 
   test('validates with timeline_id and timeline_title', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       timeline_id: 'timeline-id',
       timeline_title: 'timeline-title',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('rule_id is required and you cannot get by with just id', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       id: 'c4e80a0d-e20f-4efc-84c1-08112da5a612',
     };
     // @ts-expect-error
     delete payload.rule_id;
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "rule_id"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"rule_id: Required"`);
   });
 
   test('it validates with created_at, updated_at, created_by, updated_by values', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       created_at: '2020-01-09T06:15:24.749Z',
       updated_at: '2020-01-09T06:15:24.749Z',
@@ -917,153 +748,134 @@ describe('RuleToImport', () => {
       updated_by: 'Evan Hassanabad',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('it does not validate with epoch strings for created_at', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       created_at: '1578550728650',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "1578550728650" supplied to "created_at"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"created_at: Invalid datetime"`);
   });
 
   test('it does not validate with epoch strings for updated_at', () => {
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...getImportRulesSchemaMock(),
       updated_at: '1578550728650',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "1578550728650" supplied to "updated_at"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"updated_at: Invalid datetime"`);
   });
 
   test('The default for "from" will be "now-6m"', () => {
     const { from, ...noFrom } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noFrom,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('The default for "to" will be "now"', () => {
     const { to, ...noTo } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noTo,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot set the severity to a value other than low, medium, high, or critical', () => {
-    const payload: Omit<RuleToImport, 'severity'> & { severity: string } = {
+    const payload: Omit<RuleToImportInput, 'severity'> & { severity: string } = {
       ...getImportRulesSchemaMock(),
       severity: 'junk',
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual(['Invalid value "junk" supplied to "severity"']);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"severity: Invalid enum value. Expected 'low' | 'medium' | 'high' | 'critical', received 'junk'"`
+    );
   });
 
   test('The default for "actions" will be an empty array', () => {
     const { actions, ...noActions } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noActions,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+
+    expectParseSuccess(result);
   });
 
   test('You cannot send in an array of actions that are missing "group"', () => {
-    const payload: Omit<RuleToImport['actions'], 'group'> = {
+    const payload: Omit<RuleToImportInput['actions'], 'group'> = {
       ...getImportRulesSchemaMock(),
       actions: [{ id: 'id', action_type_id: 'action_type_id', params: {} }],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "actions,group"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"actions.0.group: Required"`);
   });
 
   test('You cannot send in an array of actions that are missing "id"', () => {
-    const payload: Omit<RuleToImport['actions'], 'id'> = {
+    const payload: Omit<RuleToImportInput['actions'], 'id'> = {
       ...getImportRulesSchemaMock(),
       actions: [{ group: 'group', action_type_id: 'action_type_id', params: {} }],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "actions,id"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"actions.0.id: Required"`);
   });
 
   test('You cannot send in an array of actions that are missing "action_type_id"', () => {
-    const payload: Omit<RuleToImport['actions'], 'action_type_id'> = {
+    const payload: Omit<RuleToImportInput['actions'], 'action_type_id'> = {
       ...getImportRulesSchemaMock(),
       actions: [{ group: 'group', id: 'id', params: {} }],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "actions,action_type_id"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"actions.0.action_type_id: Required"`
+    );
   });
 
   test('You cannot send in an array of actions that are missing "params"', () => {
-    const payload: Omit<RuleToImport['actions'], 'params'> = {
+    const payload: Omit<RuleToImportInput['actions'], 'params'> = {
       ...getImportRulesSchemaMock(),
       actions: [{ group: 'group', id: 'id', action_type_id: 'action_type_id' }],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "actions,params"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(`"actions.0.params: Required"`);
   });
 
   test('You cannot send in an array of actions that are including "actionTypeId"', () => {
-    const payload: Omit<RuleToImport['actions'], 'actions'> = {
+    const payload: Omit<RuleToImportInput['actions'], 'actions'> = {
       ...getImportRulesSchemaMock(),
       actions: [
         {
@@ -1075,25 +887,22 @@ describe('RuleToImport', () => {
       ],
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([
-      'Invalid value "undefined" supplied to "actions,action_type_id"',
-    ]);
-    expect(message.schema).toEqual({});
+    const result = RuleToImport.safeParse(payload);
+    expectParseError(result);
+
+    expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+      `"actions.0.action_type_id: Required"`
+    );
   });
 
   test('The default for "throttle" will be null', () => {
     const { throttle, ...noThrottle } = getImportRulesSchemaMock();
-    const payload: RuleToImport = {
+    const payload: RuleToImportInput = {
       ...noThrottle,
     };
 
-    const decoded = RuleToImport.decode(payload);
-    const checked = exactCheck(payload, decoded);
-    const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
+    const result = RuleToImport.safeParse(payload);
+    expectParseSuccess(result);
   });
 
   describe('note', () => {
@@ -1103,43 +912,38 @@ describe('RuleToImport', () => {
         note: '# documentation markdown here',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     test('You can set note to an empty string', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         ...getImportRulesSchemaMock(),
         note: '',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     test('You cannot create note as an object', () => {
-      const payload: Omit<RuleToImport, 'note'> & { note: {} } = {
+      const payload: Omit<RuleToImportInput, 'note'> & { note: {} } = {
         ...getImportRulesSchemaMock(),
         note: {
           somethingHere: 'something else',
         },
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "{"somethingHere":"something else"}" supplied to "note"',
-      ]);
-      expect(message.schema).toEqual({});
+      const result = RuleToImport.safeParse(payload);
+      expectParseError(result);
+
+      expect(stringifyZodError(result.error)).toMatchInlineSnapshot(
+        `"note: Expected string, received object"`
+      );
     });
 
     test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note] does validate', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         description: 'some description',
         from: 'now-5m',
@@ -1153,16 +957,14 @@ describe('RuleToImport', () => {
         note: '# some markdown',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
   });
 
   describe('exception_list', () => {
     test('[rule_id, description, from, to, index, name, severity, interval, type, filters, risk_score, note, and exceptions_list] does validate', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         description: 'some description',
         from: 'now-5m',
@@ -1178,14 +980,12 @@ describe('RuleToImport', () => {
         exceptions_list: getListArrayMock(),
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and empty exceptions_list] does validate', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         description: 'some description',
         from: 'now-5m',
@@ -1201,10 +1001,8 @@ describe('RuleToImport', () => {
         exceptions_list: [],
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     test('rule_id, description, from, to, index, name, severity, interval, type, filters, risk_score, note, and invalid exceptions_list] does NOT validate', () => {
@@ -1224,19 +1022,16 @@ describe('RuleToImport', () => {
         exceptions_list: [{ id: 'uuid_here', namespace_type: 'not a namespace type' }],
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "undefined" supplied to "exceptions_list,list_id"',
-        'Invalid value "undefined" supplied to "exceptions_list,type"',
-        'Invalid value "not a namespace type" supplied to "exceptions_list,namespace_type"',
-      ]);
-      expect(message.schema).toEqual({});
+      const result = RuleToImport.safeParse(payload);
+      expectParseError(result);
+
+      expect(stringifyZodError(result.error)).toEqual(
+        "exceptions_list.0.list_id: Required, exceptions_list.0.type: Required, exceptions_list.0.namespace_type: Invalid enum value. Expected 'agnostic' | 'single', received 'not a namespace type'"
+      );
     });
 
     test('[rule_id, description, from, to, index, name, severity, interval, type, filters, risk_score, note, and non-existent exceptions_list] does validate with empty exceptions_list', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         description: 'some description',
         from: 'now-5m',
@@ -1251,26 +1046,22 @@ describe('RuleToImport', () => {
         note: '# some markdown',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
   });
 
   describe('threat_mapping', () => {
     test('You can set a threat query, index, mapping, filters on an imported rule', () => {
       const payload = getImportThreatMatchRulesSchemaMock();
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
   });
 
   describe('data_view_id', () => {
     test('Defined data_view_id and empty index does validate', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         risk_score: 50,
         description: 'some description',
@@ -1285,15 +1076,13 @@ describe('RuleToImport', () => {
         interval: '5m',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     // Both can be defined, but if a data_view_id is defined, rule will use that one
     test('Defined data_view_id and index does validate', () => {
-      const payload: RuleToImport = {
+      const payload: RuleToImportInput = {
         rule_id: 'rule-1',
         risk_score: 50,
         description: 'some description',
@@ -1308,25 +1097,20 @@ describe('RuleToImport', () => {
         interval: '5m',
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([]);
+      const result = RuleToImport.safeParse(payload);
+      expectParseSuccess(result);
     });
 
     test('data_view_id cannot be a number', () => {
-      const payload: Omit<RuleToImport, 'data_view_id'> & { data_view_id: number } = {
+      const payload: Omit<RuleToImportInput, 'data_view_id'> & { data_view_id: number } = {
         ...getImportRulesSchemaMock(),
         data_view_id: 5,
       };
 
-      const decoded = RuleToImport.decode(payload);
-      const checked = exactCheck(payload, decoded);
-      const message = pipe(checked, foldLeftRight);
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "5" supplied to "data_view_id"',
-      ]);
-      expect(message.schema).toEqual({});
+      const result = RuleToImport.safeParse(payload);
+      expectParseError(result);
+
+      expect(stringifyZodError(result.error)).toContain('data_view_id: Expected string');
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts
index d494461d2cdb1e..5c9514943ac411 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts
@@ -5,21 +5,13 @@
  * 2.0.
  */
 
-import * as t from 'io-ts';
-import { OnlyFalseAllowed } from '@kbn/securitysolution-io-ts-types';
-
-// TODO https://github.com/elastic/security-team/issues/7491
-// eslint-disable-next-line no-restricted-imports
+import * as z from 'zod';
 import {
-  RelatedIntegrationArray,
-  RequiredFieldArray,
-  RuleObjectId,
-  RuleSignatureId,
-  SetupGuide,
   BaseCreateProps,
+  ResponseRequiredFields,
+  RuleSignatureId,
   TypeSpecificCreateProps,
-} from '../../model/rule_schema_legacy';
-import { created_at, updated_at, created_by, updated_by, revision } from '../../model';
+} from '../../model/rule_schema';
 
 /**
  * Differences from this and the createRulesSchema are
@@ -31,23 +23,11 @@ import { created_at, updated_at, created_by, updated_by, revision } from '../../
  *   - created_by is optional (but ignored in the import code)
  *   - updated_by is optional (but ignored in the import code)
  */
-export type RuleToImport = t.TypeOf<typeof RuleToImport>;
-export const RuleToImport = t.intersection([
-  BaseCreateProps,
-  TypeSpecificCreateProps,
-  t.exact(t.type({ rule_id: RuleSignatureId })),
-  t.exact(
-    t.partial({
-      id: RuleObjectId,
-      immutable: OnlyFalseAllowed,
-      updated_at,
-      updated_by,
-      created_at,
-      created_by,
-      related_integrations: RelatedIntegrationArray,
-      required_fields: RequiredFieldArray,
-      revision,
-      setup: SetupGuide,
-    })
-  ),
-]);
+export type RuleToImport = z.infer<typeof RuleToImport>;
+export type RuleToImportInput = z.input<typeof RuleToImport>;
+export const RuleToImport = BaseCreateProps.and(TypeSpecificCreateProps).and(
+  ResponseRequiredFields.partial().extend({
+    rule_id: RuleSignatureId,
+    immutable: z.literal(false).default(false),
+  })
+);
diff --git a/x-pack/plugins/security_solution/common/endpoint/data_loaders/utils.ts b/x-pack/plugins/security_solution/common/endpoint/data_loaders/utils.ts
index c27fb5fc7154d5..0586aca1d0c767 100644
--- a/x-pack/plugins/security_solution/common/endpoint/data_loaders/utils.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_loaders/utils.ts
@@ -8,6 +8,7 @@
 import { mergeWith } from 'lodash';
 import type { ToolingLogTextWriterConfig } from '@kbn/tooling-log';
 import { ToolingLog } from '@kbn/tooling-log';
+import type { Flags } from '@kbn/dev-cli-runner';
 
 export const RETRYABLE_TRANSIENT_ERRORS: Readonly<Array<string | RegExp>> = [
   'no_shard_available_action_exception',
@@ -117,12 +118,20 @@ interface CreateLoggerInterface {
    * on input.
    */
   defaultLogLevel: ToolingLogTextWriterConfig['level'];
+
+  /**
+   * Set the default logging level based on the flag arguments provide to a CLI script that runs
+   * via `@kbn/dev-cli-runner`
+   * @param flags
+   */
+  setDefaultLogLevelFromCliFlags: (flags: Flags) => void;
 }
 
 /**
  * Creates an instance of `ToolingLog` that outputs to `stdout`.
- * The default log `level` for all instances can be set by setting the function's `defaultLogLevel`.
- * Log level can also be explicitly set on input.
+ * The default log `level` for all instances can be set by setting the function's `defaultLogLevel`
+ * property. Default logging level can also be set from CLI scripts that use the `@kbn/dev-cli-runner`
+ * by calling the `setDefaultLogLevelFromCliFlags(flags)` and passing in the `flags` property.
  *
  * @param level
  *
@@ -137,3 +146,14 @@ export const createToolingLogger: CreateLoggerInterface = (level): ToolingLog =>
   });
 };
 createToolingLogger.defaultLogLevel = 'info';
+createToolingLogger.setDefaultLogLevelFromCliFlags = (flags) => {
+  createToolingLogger.defaultLogLevel = flags.verbose
+    ? 'verbose'
+    : flags.debug
+    ? 'debug'
+    : flags.silent
+    ? 'silent'
+    : flags.quiet
+    ? 'error'
+    : 'info';
+};
diff --git a/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts b/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
index 2822a48669b32d..954f4fd0b74bcb 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kibana/__mocks__/index.ts
@@ -37,6 +37,7 @@ export const KibanaServices = {
   }),
   getKibanaVersion: jest.fn(() => '8.0.0'),
   getKibanaBranch: jest.fn(() => 'main'),
+  getBuildFlavor: jest.fn(() => 'traditional'),
   getPrebuiltRulesPackageVersion: jest.fn(() => undefined),
 };
 export const useKibana = jest.fn().mockReturnValue({
diff --git a/x-pack/plugins/security_solution/public/common/lib/kibana/services.ts b/x-pack/plugins/security_solution/public/common/lib/kibana/services.ts
index 695245a85e746a..fff266b8a5cdab 100644
--- a/x-pack/plugins/security_solution/public/common/lib/kibana/services.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/kibana/services.ts
@@ -12,6 +12,7 @@ type GlobalServices = Pick<CoreStart, 'application' | 'http' | 'uiSettings' | 'n
   Pick<StartPlugins, 'data' | 'unifiedSearch' | 'expressions'>;
 
 export class KibanaServices {
+  private static buildFlavor?: string;
   private static kibanaBranch?: string;
   private static kibanaVersion?: string;
   private static prebuiltRulesPackageVersion?: string;
@@ -24,6 +25,7 @@ export class KibanaServices {
     unifiedSearch,
     kibanaBranch,
     kibanaVersion,
+    buildFlavor,
     prebuiltRulesPackageVersion,
     uiSettings,
     notifications,
@@ -31,6 +33,7 @@ export class KibanaServices {
   }: GlobalServices & {
     kibanaBranch: string;
     kibanaVersion: string;
+    buildFlavor: string;
     prebuiltRulesPackageVersion?: string;
   }) {
     this.services = {
@@ -44,6 +47,7 @@ export class KibanaServices {
     };
     this.kibanaBranch = kibanaBranch;
     this.kibanaVersion = kibanaVersion;
+    this.buildFlavor = buildFlavor;
     this.prebuiltRulesPackageVersion = prebuiltRulesPackageVersion;
   }
 
@@ -75,6 +79,13 @@ export class KibanaServices {
     return this.prebuiltRulesPackageVersion;
   }
 
+  public static getBuildFlavor(): string {
+    if (!this.buildFlavor) {
+      this.throwUninitializedError();
+    }
+    return this.buildFlavor;
+  }
+
   private static throwUninitializedError(): never {
     throw new Error(
       'Kibana services not initialized - are you trying to import this module from outside of the SIEM app?'
diff --git a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
index 575c159d29d728..c8c2b805062106 100644
--- a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
@@ -313,6 +313,7 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
     ...startServices,
     kibanaVersion: '8.0.0',
     kibanaBranch: 'main',
+    buildFlavor: 'traditional',
   };
 
   if (jest.isMockFunction(KibanaServices.get)) {
diff --git a/x-pack/plugins/security_solution/public/common/store/inputs/selectors.ts b/x-pack/plugins/security_solution/public/common/store/inputs/selectors.ts
index aee7d1957841d9..b6ef6b08675041 100644
--- a/x-pack/plugins/security_solution/public/common/store/inputs/selectors.ts
+++ b/x-pack/plugins/security_solution/public/common/store/inputs/selectors.ts
@@ -13,6 +13,15 @@ import type { State } from '../types';
 
 import type { InputsModel, InputsRange, GlobalQuery } from './model';
 
+const defaultQuery = {
+  id: 'kql',
+  inspect: null,
+  isInspected: false,
+  loading: false,
+  refetch: null,
+  selectedInspectIndex: 0,
+};
+
 const selectInputs = (state: State): InputsModel => state.inputs;
 
 const selectGlobal = (state: State): InputsRange => state.inputs.global;
@@ -24,25 +33,12 @@ const selectSocTrends = (state: State): InputsState['socTrends'] | undefined =>
   state.inputs.socTrends;
 
 const selectGlobalQuery = (state: State, id: string): GlobalQuery =>
-  state.inputs.global.queries.find((q) => q.id === id) || {
-    id: 'kql',
-    inspect: null,
-    isInspected: false,
-    loading: false,
-    refetch: null,
-    selectedInspectIndex: 0,
-  };
+  state.inputs.global.queries.find((q) => q.id === id) || defaultQuery;
 
 const selectTimelineQuery = (state: State, id: string): GlobalQuery =>
   state.inputs.timeline.queries.find((q) => q.id === id) ||
-  state.inputs.global.queries.find((q) => q.id === id) || {
-    id: 'kql',
-    inspect: null,
-    isInspected: false,
-    loading: false,
-    refetch: null,
-    selectedInspectIndex: 0,
-  };
+  state.inputs.global.queries.find((q) => q.id === id) ||
+  defaultQuery;
 
 export const inputsSelector = () => createSelector(selectInputs, (inputs) => inputs);
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_secuirty_packages.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_secuirty_packages.test.tsx
index dd01465b8875ab..9454a1c4dfb169 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_secuirty_packages.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_secuirty_packages.test.tsx
@@ -26,6 +26,7 @@ const mockGetPrebuiltRulesPackageVersion =
   KibanaServices.getPrebuiltRulesPackageVersion as jest.Mock;
 const mockGetKibanaVersion = KibanaServices.getKibanaVersion as jest.Mock;
 const mockGetKibanaBranch = KibanaServices.getKibanaBranch as jest.Mock;
+const mockBuildFlavor = KibanaServices.getBuildFlavor as jest.Mock;
 const useKibanaMock = useKibana as jest.MockedFunction<typeof useKibana>;
 
 describe('When using the `useUpgradeSecurityPackages()` hook', () => {
@@ -51,9 +52,50 @@ describe('When using the `useUpgradeSecurityPackages()` hook', () => {
     );
   });
 
-  it('should send upgrade request with prerelease:false if branch is not `main` and build does not include `-SNAPSHOT`', async () => {
+  it('should send upgrade request with prerelease:false if in serverless', async () => {
+    mockGetKibanaVersion.mockReturnValue('8.0.0');
+    mockGetKibanaBranch.mockReturnValue('main');
+    mockBuildFlavor.mockReturnValue('serverless');
+
+    const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
+      wrapper: TestProviders,
+    });
+
+    await waitFor(() => (useKibanaMock().services.http.post as jest.Mock).mock.calls.length > 0);
+
+    expect(useKibanaMock().services.http.post).toHaveBeenCalledWith(
+      `${epmRouteService.getBulkInstallPath()}`,
+      expect.objectContaining({
+        body: '{"packages":["endpoint","security_detection_engine"]}',
+        query: expect.objectContaining({ prerelease: false }),
+      })
+    );
+  });
+
+  it('should send upgrade request with prerelease:false if in serverless SNAPSHOT', async () => {
+    mockGetKibanaVersion.mockReturnValue('8.0.0-SNAPSHOT');
+    mockGetKibanaBranch.mockReturnValue('main');
+    mockBuildFlavor.mockReturnValue('serverless');
+
+    const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
+      wrapper: TestProviders,
+    });
+
+    await waitFor(() => (useKibanaMock().services.http.post as jest.Mock).mock.calls.length > 0);
+
+    expect(useKibanaMock().services.http.post).toHaveBeenCalledWith(
+      `${epmRouteService.getBulkInstallPath()}`,
+      expect.objectContaining({
+        body: '{"packages":["endpoint","security_detection_engine"]}',
+        query: expect.objectContaining({ prerelease: false }),
+      })
+    );
+  });
+
+  it('should send upgrade request with prerelease:false if build does not include `-SNAPSHOT`', async () => {
     mockGetKibanaVersion.mockReturnValue('8.0.0');
     mockGetKibanaBranch.mockReturnValue('release');
+    mockBuildFlavor.mockReturnValue('traditional');
 
     const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
       wrapper: TestProviders,
@@ -70,9 +112,10 @@ describe('When using the `useUpgradeSecurityPackages()` hook', () => {
     );
   });
 
-  it('should send upgrade request with prerelease:true if branch is `main` AND build includes `-SNAPSHOT`', async () => {
+  it('should send upgrade request with prerelease:true if not serverless and branch is `main` AND build includes `-SNAPSHOT`', async () => {
     mockGetKibanaVersion.mockReturnValue('8.0.0-SNAPSHOT');
     mockGetKibanaBranch.mockReturnValue('main');
+    mockBuildFlavor.mockReturnValue('traditional');
 
     const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
       wrapper: TestProviders,
@@ -92,6 +135,7 @@ describe('When using the `useUpgradeSecurityPackages()` hook', () => {
   it('should send upgrade request with prerelease:true if branch is `release` and build includes `-SNAPSHOT`', async () => {
     mockGetKibanaVersion.mockReturnValue('8.0.0-SNAPSHOT');
     mockGetKibanaBranch.mockReturnValue('release');
+    mockBuildFlavor.mockReturnValue('traditional');
 
     const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
       wrapper: TestProviders,
@@ -111,6 +155,7 @@ describe('When using the `useUpgradeSecurityPackages()` hook', () => {
   it('should send upgrade request with prerelease:true if branch is `main` and build does not include `-SNAPSHOT`', async () => {
     mockGetKibanaVersion.mockReturnValue('8.0.0');
     mockGetKibanaBranch.mockReturnValue('main');
+    mockBuildFlavor.mockReturnValue('traditional');
 
     const { waitFor } = renderHook(() => useUpgradeSecurityPackages(), {
       wrapper: TestProviders,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_security_packages.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_security_packages.ts
index f48d4464823162..8ad266169231dd 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_security_packages.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/use_upgrade_security_packages.ts
@@ -38,10 +38,11 @@ export const useUpgradeSecurityPackages = () => {
       // Make sure fleet is initialized first
       await context.services.fleet?.isInitialized();
 
-      // Always install the latest package if in dev env or snapshot build
+      // Install the latest prerelease if in non-production non-serverless environments
       const prerelease =
-        KibanaServices.getKibanaVersion().includes('-SNAPSHOT') ||
-        KibanaServices.getKibanaBranch() === 'main';
+        KibanaServices.getBuildFlavor() === 'traditional' &&
+        (KibanaServices.getKibanaVersion().includes('-SNAPSHOT') ||
+          KibanaServices.getKibanaBranch() === 'main');
 
       const prebuiltRulesPackageVersion = KibanaServices.getPrebuiltRulesPackageVersion();
       // ignore the response for now since we aren't notifying the user
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.test.ts
new file mode 100644
index 00000000000000..7129448e762cb5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.test.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
+import { getNumOfCoveredSubtechniques } from './mitre_subtechnique';
+import type { CoverageOverviewMitreTechnique } from './mitre_technique';
+import {
+  getMockCoverageOverviewMitreSubTechnique,
+  getMockCoverageOverviewMitreTechnique,
+} from './__mocks__';
+
+describe('mitre_subtechniques', () => {
+  describe('getNumOfCoveredSubtechniques', () => {
+    it('returns 0 when no subtechniques are present', () => {
+      const payload: CoverageOverviewMitreTechnique = getMockCoverageOverviewMitreTechnique();
+      expect(getNumOfCoveredSubtechniques(payload)).toEqual(0);
+    });
+
+    it('returns total number of unique enabled and disabled subtechniques when no filter is passed', () => {
+      const payload: CoverageOverviewMitreTechnique = {
+        ...getMockCoverageOverviewMitreTechnique(),
+        subtechniques: [
+          getMockCoverageOverviewMitreSubTechnique(),
+          { ...getMockCoverageOverviewMitreSubTechnique(), id: 'test-id' },
+        ],
+      };
+      expect(getNumOfCoveredSubtechniques(payload)).toEqual(2);
+    });
+
+    it('returns total number of unique enabled and disabled subtechniques when both filters are passed', () => {
+      const payload: CoverageOverviewMitreTechnique = {
+        ...getMockCoverageOverviewMitreTechnique(),
+        subtechniques: [
+          getMockCoverageOverviewMitreSubTechnique(),
+          { ...getMockCoverageOverviewMitreSubTechnique(), id: 'test-id' },
+        ],
+      };
+      expect(
+        getNumOfCoveredSubtechniques(payload, [
+          CoverageOverviewRuleActivity.Enabled,
+          CoverageOverviewRuleActivity.Disabled,
+        ])
+      ).toEqual(2);
+    });
+
+    it('returns total number of enabled subtechniques when enabled filter is passed', () => {
+      const payload: CoverageOverviewMitreTechnique = {
+        ...getMockCoverageOverviewMitreTechnique(),
+        subtechniques: [
+          {
+            ...getMockCoverageOverviewMitreSubTechnique(),
+            enabledRules: [],
+          },
+          getMockCoverageOverviewMitreSubTechnique(),
+        ],
+      };
+      expect(getNumOfCoveredSubtechniques(payload, [CoverageOverviewRuleActivity.Enabled])).toEqual(
+        1
+      );
+    });
+
+    it('returns total number of disabled subtechniques when disabled filter is passed', () => {
+      const payload: CoverageOverviewMitreTechnique = {
+        ...getMockCoverageOverviewMitreTechnique(),
+        subtechniques: [
+          {
+            ...getMockCoverageOverviewMitreSubTechnique(),
+            disabledRules: [],
+          },
+          getMockCoverageOverviewMitreSubTechnique(),
+        ],
+      };
+      expect(
+        getNumOfCoveredSubtechniques(payload, [CoverageOverviewRuleActivity.Disabled])
+      ).toEqual(1);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.ts
index 622213c7e7a6f4..0b0e8af2d8a998 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_subtechnique.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
+import type { CoverageOverviewMitreTechnique } from './mitre_technique';
 import type { CoverageOverviewRule } from './rule';
 
 export interface CoverageOverviewMitreSubTechnique {
@@ -18,3 +20,26 @@ export interface CoverageOverviewMitreSubTechnique {
   disabledRules: CoverageOverviewRule[];
   availableRules: CoverageOverviewRule[];
 }
+
+export const getNumOfCoveredSubtechniques = (
+  technique: CoverageOverviewMitreTechnique,
+  activity?: CoverageOverviewRuleActivity[]
+): number => {
+  const coveredSubtechniques = new Set();
+  for (const subtechnique of technique.subtechniques) {
+    if (
+      (!activity || activity.includes(CoverageOverviewRuleActivity.Enabled)) &&
+      subtechnique.enabledRules.length
+    ) {
+      coveredSubtechniques.add(subtechnique.id);
+    }
+
+    if (
+      (!activity || activity.includes(CoverageOverviewRuleActivity.Disabled)) &&
+      subtechnique.disabledRules.length
+    ) {
+      coveredSubtechniques.add(subtechnique.id);
+    }
+  }
+  return coveredSubtechniques.size;
+};
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.test.ts
index 01794b34c8ee7d..9a89867225ba84 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.test.ts
@@ -6,27 +6,52 @@
  */
 
 import { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
-import { getTotalRuleCount } from './mitre_technique';
-import { getMockCoverageOverviewMitreTechnique } from './__mocks__';
+import type { CoverageOverviewMitreTactic } from './mitre_tactic';
+import type { CoverageOverviewMitreTechnique } from './mitre_technique';
+import { getNumOfCoveredTechniques, getTotalRuleCount } from './mitre_technique';
+import {
+  getMockCoverageOverviewMitreTactic,
+  getMockCoverageOverviewMitreTechnique,
+} from './__mocks__';
 
-describe('getTotalRuleCount', () => {
-  it('returns count of all rules when no activity filter is present', () => {
-    const payload = getMockCoverageOverviewMitreTechnique();
-    expect(getTotalRuleCount(payload)).toEqual(2);
-  });
+describe('mitre_technique', () => {
+  describe('getTotalRuleCount', () => {
+    it('returns count of all rules when no activity filter is present', () => {
+      const payload: CoverageOverviewMitreTechnique = getMockCoverageOverviewMitreTechnique();
+      expect(getTotalRuleCount(payload)).toEqual(2);
+    });
+
+    it('returns count of one rule type when an activity filter is present', () => {
+      const payload: CoverageOverviewMitreTechnique = getMockCoverageOverviewMitreTechnique();
+      expect(getTotalRuleCount(payload, [CoverageOverviewRuleActivity.Disabled])).toEqual(1);
+    });
 
-  it('returns count of one rule type when an activity filter is present', () => {
-    const payload = getMockCoverageOverviewMitreTechnique();
-    expect(getTotalRuleCount(payload, [CoverageOverviewRuleActivity.Disabled])).toEqual(1);
+    it('returns count of multiple rule type when multiple activity filter is present', () => {
+      const payload = getMockCoverageOverviewMitreTechnique();
+      expect(
+        getTotalRuleCount(payload, [
+          CoverageOverviewRuleActivity.Enabled,
+          CoverageOverviewRuleActivity.Disabled,
+        ])
+      ).toEqual(2);
+    });
   });
 
-  it('returns count of multiple rule type when multiple activity filter is present', () => {
-    const payload = getMockCoverageOverviewMitreTechnique();
-    expect(
-      getTotalRuleCount(payload, [
-        CoverageOverviewRuleActivity.Enabled,
-        CoverageOverviewRuleActivity.Disabled,
-      ])
-    ).toEqual(2);
+  describe('getNumOfCoveredTechniques', () => {
+    it('returns 0 when no techniques are present', () => {
+      const payload: CoverageOverviewMitreTactic = getMockCoverageOverviewMitreTactic();
+      expect(getNumOfCoveredTechniques(payload)).toEqual(0);
+    });
+
+    it('returns number of techniques when present', () => {
+      const payload: CoverageOverviewMitreTactic = {
+        ...getMockCoverageOverviewMitreTactic(),
+        techniques: [
+          getMockCoverageOverviewMitreTechnique(),
+          getMockCoverageOverviewMitreTechnique(),
+        ],
+      };
+      expect(getNumOfCoveredTechniques(payload)).toEqual(2);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.ts
index 589629d643810b..23f57497d7d7d9 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management/model/coverage_overview/mitre_technique.ts
@@ -7,6 +7,7 @@
 
 import { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
 import type { CoverageOverviewMitreSubTechnique } from './mitre_subtechnique';
+import type { CoverageOverviewMitreTactic } from './mitre_tactic';
 import type { CoverageOverviewRule } from './rule';
 
 export interface CoverageOverviewMitreTechnique {
@@ -38,3 +39,6 @@ export const getTotalRuleCount = (
   }
   return totalRuleCount;
 };
+
+export const getNumOfCoveredTechniques = (tactic: CoverageOverviewMitreTactic): number =>
+  tactic.techniques.filter((technique) => technique.enabledRules.length !== 0).length;
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.test.ts
index 5a1aee424352aa..39e0b9d7bbb536 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.test.ts
@@ -7,56 +7,10 @@
 
 import type { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
 import { getCoverageOverviewFilterMock } from '../../../../../common/api/detection_engine/rule_management/coverage_overview/coverage_overview_route.mock';
-import {
-  getMockCoverageOverviewMitreSubTechnique,
-  getMockCoverageOverviewMitreTactic,
-  getMockCoverageOverviewMitreTechnique,
-} from '../../../rule_management/model/coverage_overview/__mocks__';
 import { ruleActivityFilterDefaultOptions } from './constants';
-import {
-  extractSelected,
-  getNumOfCoveredSubtechniques,
-  getNumOfCoveredTechniques,
-  populateSelected,
-} from './helpers';
+import { extractSelected, populateSelected } from './helpers';
 
 describe('helpers', () => {
-  describe('getNumOfCoveredTechniques', () => {
-    it('returns 0 when no techniques are present', () => {
-      const payload = getMockCoverageOverviewMitreTactic();
-      expect(getNumOfCoveredTechniques(payload)).toEqual(0);
-    });
-
-    it('returns number of techniques when present', () => {
-      const payload = {
-        ...getMockCoverageOverviewMitreTactic(),
-        techniques: [
-          getMockCoverageOverviewMitreTechnique(),
-          getMockCoverageOverviewMitreTechnique(),
-        ],
-      };
-      expect(getNumOfCoveredTechniques(payload)).toEqual(2);
-    });
-  });
-
-  describe('getNumOfCoveredSubtechniques', () => {
-    it('returns 0 when no subtechniques are present', () => {
-      const payload = getMockCoverageOverviewMitreTechnique();
-      expect(getNumOfCoveredSubtechniques(payload)).toEqual(0);
-    });
-
-    it('returns number of subtechniques when present', () => {
-      const payload = {
-        ...getMockCoverageOverviewMitreTechnique(),
-        subtechniques: [
-          getMockCoverageOverviewMitreSubTechnique(),
-          getMockCoverageOverviewMitreSubTechnique(),
-        ],
-      };
-      expect(getNumOfCoveredSubtechniques(payload)).toEqual(2);
-    });
-  });
-
   describe('extractSelected', () => {
     it('returns empty array when no options are checked', () => {
       const payload = ruleActivityFilterDefaultOptions;
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.ts
index 82d50e7b9721b9..ecd67546e76272 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/helpers.ts
@@ -10,16 +10,8 @@ import type {
   CoverageOverviewRuleActivity,
   CoverageOverviewRuleSource,
 } from '../../../../../common/api/detection_engine';
-import type { CoverageOverviewMitreTactic } from '../../../rule_management/model/coverage_overview/mitre_tactic';
-import type { CoverageOverviewMitreTechnique } from '../../../rule_management/model/coverage_overview/mitre_technique';
 import { coverageOverviewCardColorThresholds } from './constants';
 
-export const getNumOfCoveredTechniques = (tactic: CoverageOverviewMitreTactic): number =>
-  tactic.techniques.filter((technique) => technique.enabledRules.length !== 0).length;
-
-export const getNumOfCoveredSubtechniques = (technique: CoverageOverviewMitreTechnique): number =>
-  technique.subtechniques.filter((subtechnique) => subtechnique.enabledRules.length !== 0).length;
-
 export const getCardBackgroundColor = (value: number) => {
   for (const { threshold, color } of coverageOverviewCardColorThresholds) {
     if (value >= threshold) {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/tactic_panel.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/tactic_panel.tsx
index e1d1749ca264fd..64ef73c8259c9d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/tactic_panel.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/tactic_panel.tsx
@@ -11,9 +11,9 @@ import React, { memo, useMemo } from 'react';
 import { euiThemeVars } from '@kbn/ui-theme';
 import type { CoverageOverviewMitreTactic } from '../../../rule_management/model/coverage_overview/mitre_tactic';
 import { coverageOverviewPanelWidth } from './constants';
-import { getNumOfCoveredTechniques } from './helpers';
 import * as i18n from './translations';
 import { CoverageOverviewPanelRuleStats } from './shared_components/panel_rule_stats';
+import { getNumOfCoveredTechniques } from '../../../rule_management/model/coverage_overview/mitre_technique';
 
 export interface CoverageOverviewTacticPanelProps {
   tactic: CoverageOverviewMitreTactic;
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/technique_panel_popover.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/technique_panel_popover.tsx
index f5fc71b08b055c..9e026e9912b466 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/technique_panel_popover.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/pages/coverage_overview/technique_panel_popover.tsx
@@ -23,12 +23,12 @@ import { css, cx } from '@emotion/css';
 import React, { memo, useCallback, useMemo, useState } from 'react';
 import { useUserData } from '../../../../detections/components/user_info';
 import type { CoverageOverviewMitreTechnique } from '../../../rule_management/model/coverage_overview/mitre_technique';
-import { getNumOfCoveredSubtechniques } from './helpers';
 import { CoverageOverviewRuleListHeader } from './shared_components/popover_list_header';
 import { CoverageOverviewMitreTechniquePanel } from './technique_panel';
 import * as i18n from './translations';
 import { RuleLink } from '../../components/rules_table/use_columns';
 import { useCoverageOverviewDashboardContext } from './coverage_overview_dashboard_context';
+import { getNumOfCoveredSubtechniques } from '../../../rule_management/model/coverage_overview/mitre_subtechnique';
 
 export interface CoverageOverviewMitreTechniquePanelPopoverProps {
   technique: CoverageOverviewMitreTechnique;
@@ -41,7 +41,6 @@ const CoverageOverviewMitreTechniquePanelPopoverComponent = ({
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
   const closePopover = useCallback(() => setIsPopoverOpen(false), []);
-  const coveredSubtechniques = useMemo(() => getNumOfCoveredSubtechniques(technique), [technique]);
   const isEnableButtonDisabled = useMemo(
     () => !canUserCRUD || technique.disabledRules.length === 0,
     [canUserCRUD, technique.disabledRules.length]
@@ -53,10 +52,18 @@ const CoverageOverviewMitreTechniquePanelPopoverComponent = ({
   );
 
   const {
-    state: { showExpandedCells },
+    state: {
+      showExpandedCells,
+      filter: { activity },
+    },
     actions: { enableAllDisabled },
   } = useCoverageOverviewDashboardContext();
 
+  const coveredSubtechniques = useMemo(
+    () => getNumOfCoveredSubtechniques(technique, activity),
+    [activity, technique]
+  );
+
   const handleEnableAllDisabled = useCallback(async () => {
     setIsLoading(true);
     const ruleIds = technique.disabledRules.map((rule) => rule.id);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 4be4595e19afec..97d86deed7a486 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -75,9 +75,11 @@ const EuiDataGridContainer = styled.div<GridContainerProps>`
     display: flex;
     align-items: center;
   }
+  div .euiDataGridRowCell__content {
+    width: 100%;
+  }
   div .euiDataGridRowCell--lastColumn .euiDataGridRowCell__content {
     flex-grow: 0;
-    width: 100%;
   }
   div .siemEventsTable__trSupplement--summary {
     display: block;
@@ -269,6 +271,7 @@ export const AlertsTableComponent: FC<DetectionEngineAlertTableProps> = ({
         showColumnSelector: !isEventRenderedView,
         showSortSelector: !isEventRenderedView,
       },
+      dynamicRowHeight: isEventRenderedView,
     }),
     [
       triggersActionsUi.alertsTableConfigurationRegistry,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index cb20b7910a929a..741039c09e0e22 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -9,8 +9,7 @@ import React, { useCallback, useMemo, useState } from 'react';
 
 import { EuiButtonIcon, EuiContextMenu, EuiPopover, EuiToolTip } from '@elastic/eui';
 import { indexOf } from 'lodash';
-import type { ConnectedProps } from 'react-redux';
-import { connect } from 'react-redux';
+import { useSelector } from 'react-redux';
 import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 import { get } from 'lodash/fp';
 import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
@@ -63,7 +62,7 @@ interface AlertContextMenuProps {
   refetch: (() => void) | undefined;
 }
 
-const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux> = ({
+const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
   ariaLabel = i18n.MORE_ACTIONS,
   ariaRowindex,
   columnValues,
@@ -71,8 +70,6 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
   ecsRowData,
   onRuleChange,
   scopeId,
-  globalQuery,
-  timelineQuery,
   refetch,
 }) => {
   const [isPopoverOpen, setPopover] = useState(false);
@@ -82,6 +79,11 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
     setPopover(false);
   }, []);
 
+  const getGlobalQueries = useMemo(() => inputsSelectors.globalQuery(), []);
+  const getTimelineQuery = useMemo(() => inputsSelectors.timelineQueryByIdSelector(), []);
+  const globalQuery = useSelector((state: State) => getGlobalQueries(state));
+  const timelineQuery = useSelector((state: State) => getTimelineQuery(state, scopeId));
+
   const getAlertId = () => (ecsRowData?.kibana?.alert ? ecsRowData?._id : null);
   const alertId = getAlertId();
   const ruleId = get(0, ecsRowData?.kibana?.alert?.rule?.uuid);
@@ -323,23 +325,7 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
   );
 };
 
-const makeMapStateToProps = () => {
-  const getGlobalQueries = inputsSelectors.globalQuery();
-  const getTimelineQuery = inputsSelectors.timelineQueryByIdSelector();
-  const mapStateToProps = (state: State, { scopeId }: AlertContextMenuProps) => {
-    return {
-      globalQuery: getGlobalQueries(state),
-      timelineQuery: getTimelineQuery(state, scopeId),
-    };
-  };
-  return mapStateToProps;
-};
-
-const connector = connect(makeMapStateToProps);
-
-type PropsFromRedux = ConnectedProps<typeof connector>;
-
-export const AlertContextMenu = connector(React.memo(AlertContextMenuComponent));
+export const AlertContextMenu = React.memo(AlertContextMenuComponent);
 
 type AddExceptionFlyoutWrapperProps = Omit<
   AddExceptionFlyoutProps,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/subtechnique_fields.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/subtechnique_fields.tsx
index efc542f9757a12..7645bc2c2c5790 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/subtechnique_fields.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/subtechnique_fields.tsx
@@ -13,7 +13,6 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
 } from '@elastic/eui';
-import { camelCase } from 'lodash/fp';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import styled from 'styled-components';
 
@@ -110,9 +109,9 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
   }, [field, onFieldChange, techniqueIndex, technique, threatIndex]);
 
   const updateSubtechnique = useCallback(
-    (index: number, value: string) => {
+    (index: number, optionId: string) => {
       const threats = [...(field.value as Threats)];
-      const { id, reference, name } = subtechniquesOptions.find((t) => t.value === value) || {
+      const { id, reference, name } = subtechniquesOptions.find((t) => t.id === optionId) ?? {
         id: '',
         name: '',
         reference: '',
@@ -170,7 +169,7 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
                 : []),
               ...options.map((option) => ({
                 inputDisplay: <>{option.label}</>,
-                value: option.value,
+                value: option.id,
                 disabled,
               })),
             ]}
@@ -178,7 +177,7 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
             aria-label=""
             onChange={updateSubtechnique.bind(null, index)}
             fullWidth={true}
-            valueOfSelected={camelCase(subtechnique.name)}
+            valueOfSelected={subtechnique.id}
             data-test-subj="mitreAttackSubtechnique"
             disabled={disabled}
             placeholder={i18n.SUBTECHNIQUE_PLACEHOLDER}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/technique_fields.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/technique_fields.tsx
index 0215204a98cbdd..bb677801ecaa90 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/technique_fields.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/technique_fields.tsx
@@ -13,7 +13,7 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
 } from '@elastic/eui';
-import { kebabCase, camelCase } from 'lodash/fp';
+import { kebabCase } from 'lodash/fp';
 import React, { useCallback, useEffect, useState } from 'react';
 import styled, { css } from 'styled-components';
 
@@ -105,9 +105,9 @@ export const MitreAttackTechniqueFields: React.FC<AddTechniqueProps> = ({
   }, [field, threatIndex, onFieldChange]);
 
   const updateTechnique = useCallback(
-    (index: number, value: string) => {
+    (index: number, optionId: string) => {
       const threats = [...(field.value as Threats)];
-      const { id, reference, name } = techniquesOptions.find((t) => t.value === value) || {
+      const { id, reference, name } = techniquesOptions.find((t) => t.id === optionId) ?? {
         id: '',
         name: '',
         reference: '',
@@ -153,7 +153,7 @@ export const MitreAttackTechniqueFields: React.FC<AddTechniqueProps> = ({
                 : []),
               ...options.map((option) => ({
                 inputDisplay: <>{option.label}</>,
-                value: option.value,
+                value: option.id,
                 disabled,
               })),
             ]}
@@ -161,7 +161,7 @@ export const MitreAttackTechniqueFields: React.FC<AddTechniqueProps> = ({
             aria-label=""
             onChange={updateTechnique.bind(null, index)}
             fullWidth={true}
-            valueOfSelected={camelCase(technique.name)}
+            valueOfSelected={technique.id}
             data-test-subj="mitreAttackTechnique"
             disabled={disabled}
             placeholder={i18n.TECHNIQUE_PLACEHOLDER}
diff --git a/x-pack/plugins/security_solution/public/flyout/README.md b/x-pack/plugins/security_solution/public/flyout/README.md
index dbce8ba6fad18a..be70c3ca0ebec1 100644
--- a/x-pack/plugins/security_solution/public/flyout/README.md
+++ b/x-pack/plugins/security_solution/public/flyout/README.md
@@ -56,6 +56,7 @@ Here's a non-exhaustive list of the reusable component in the top-level `shared`
 
  - [FlyoutNavigation](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_navigation.tsx): navigation menu on the **right panel** only, with expand/collapse button and option to pass in a list of actions to be displayed on top. Works best when used in combination with the header component below. 
  - [FlyoutHeader](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_header.tsx): wrapper of `EuiFlyoutHeader`, setting the recommended `16px` padding using a EuiPanel.
+ - [FlyoutTitle](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.tsx): title component with optional icon to indicate the type of document, works when the title is link or pure text
  - [FlyoutHeaderTabs](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_header_tabs.tsx): Wrapper of `EuiTabs`, setting bottom margin to align with the flyout header divider
  - [FlyoutBody](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_body.tsx): wrapper of `EuiFlyoutHeader`, setting the recommended `16px` padding using a EuiPanel. 
  - [FlyoutFooter](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_footer.tsx): wrapper of `EuiFlyoutFooter`, setting the recommended `16px` padding using a EuiPanel. 
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/test_ids.ts b/x-pack/plugins/security_solution/public/flyout/document_details/left/test_ids.ts
index 3c0ba8b2a1c0c9..beb7971b3a8614 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/test_ids.ts
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/test_ids.ts
@@ -7,7 +7,7 @@
 
 import { PREFIX } from '../../shared/test_ids';
 
-export const VISUALIZE_TAB_TEST_ID = `${PREFIX}FlyoutVisualizeTab` as const;
-export const INSIGHTS_TAB_TEST_ID = `${PREFIX}FlyoutInsightsTab` as const;
-export const INVESTIGATION_TAB_TEST_ID = `${PREFIX}FlyoutInvestigationTab` as const;
-export const RESPONSE_TAB_TEST_ID = `${PREFIX}FlyoutResponseTab` as const;
+export const VISUALIZE_TAB_TEST_ID = `${PREFIX}VisualizeTab` as const;
+export const INSIGHTS_TAB_TEST_ID = `${PREFIX}InsightsTab` as const;
+export const INVESTIGATION_TAB_TEST_ID = `${PREFIX}InvestigationTab` as const;
+export const RESPONSE_TAB_TEST_ID = `${PREFIX}ResponseTab` as const;
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.test.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.test.tsx
index e7a7d769b57022..ec7f85be212c98 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.test.tsx
@@ -10,8 +10,9 @@ import { render, fireEvent } from '@testing-library/react';
 import { ExpandableFlyoutContext } from '@kbn/expandable-flyout/src/context';
 import { copyToClipboard } from '@elastic/eui';
 import { RightPanelContext } from '../context';
-import { SHARE_BUTTON_TEST_ID } from './test_ids';
+import { SHARE_BUTTON_TEST_ID, CHAT_BUTTON_TEST_ID } from './test_ids';
 import { HeaderActions } from './header_actions';
+import { useAssistant } from '../hooks/use_assistant';
 import { mockGetFieldsData } from '../../shared/mocks/mock_get_fields_data';
 import { mockDataFormattedForFieldBrowser } from '../../shared/mocks/mock_data_formatted_for_field_browser';
 import { TestProvidersComponent } from '../../../../common/mock';
@@ -19,6 +20,7 @@ import { useGetAlertDetailsFlyoutLink } from '../../../../timelines/components/s
 import { FLYOUT_URL_PARAM } from '../../shared/hooks/url/use_sync_flyout_state_with_url';
 
 jest.mock('../../../../common/lib/kibana');
+jest.mock('../hooks/use_assistant');
 jest.mock(
   '../../../../timelines/components/side_panel/event_details/use_get_alert_details_flyout_link'
 );
@@ -50,6 +52,7 @@ const renderHeaderActions = (contextValue: RightPanelContext) =>
 describe('<HeaderAction />', () => {
   beforeEach(() => {
     jest.mocked(useGetAlertDetailsFlyoutLink).mockReturnValue(alertUrl);
+    jest.mocked(useAssistant).mockReturnValue({ showAssistant: true, promptContextId: '' });
   });
 
   describe('Share alert url action', () => {
@@ -87,5 +90,19 @@ describe('<HeaderAction />', () => {
       });
       expect(queryByTestId(SHARE_BUTTON_TEST_ID)).not.toBeInTheDocument();
     });
+
+    it('should render chat button in the title', () => {
+      const { getByTestId } = renderHeaderActions(mockContextValue);
+
+      expect(getByTestId(CHAT_BUTTON_TEST_ID)).toBeInTheDocument();
+    });
+
+    it('should not render chat button in the title if should not be shown', () => {
+      jest.mocked(useAssistant).mockReturnValue({ showAssistant: false, promptContextId: '' });
+
+      const { queryByTestId } = renderHeaderActions(mockContextValue);
+
+      expect(queryByTestId(CHAT_BUTTON_TEST_ID)).not.toBeInTheDocument();
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.tsx
index 0b60555b28f15d..2862aed53501b6 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_actions.tsx
@@ -7,12 +7,18 @@
 
 import type { VFC } from 'react';
 import React, { memo } from 'react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiButtonIcon, EuiCopy, EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { NewChatById } from '@kbn/elastic-assistant';
+import { copyFunction } from '../../../shared/utils/copy_to_clipboard';
 import { FLYOUT_URL_PARAM } from '../../shared/hooks/url/use_sync_flyout_state_with_url';
-import { CopyToClipboard } from '../../../shared/components/copy_to_clipboard';
 import { useGetAlertDetailsFlyoutLink } from '../../../../timelines/components/side_panel/event_details/use_get_alert_details_flyout_link';
 import { useBasicDataFromDetailsData } from '../../../../timelines/components/side_panel/event_details/helpers';
+import { useAssistant } from '../hooks/use_assistant';
+import {
+  ALERT_SUMMARY_CONVERSATION_ID,
+  EVENT_SUMMARY_CONVERSATION_ID,
+} from '../../../../common/components/event_details/translations';
 import { useRightPanelContext } from '../context';
 import { SHARE_BUTTON_TEST_ID } from './test_ids';
 
@@ -31,26 +37,57 @@ export const HeaderActions: VFC = memo(() => {
 
   const showShareAlertButton = isAlert && alertDetailsLink;
 
+  const modifier = (value: string) => {
+    const query = new URLSearchParams(window.location.search);
+    return `${value}&${FLYOUT_URL_PARAM}=${query.get(FLYOUT_URL_PARAM)}`;
+  };
+
+  const { showAssistant, promptContextId } = useAssistant({
+    dataFormattedForFieldBrowser,
+    isAlert,
+  });
+
   return (
-    <EuiFlexGroup direction="row" justifyContent="flexEnd">
+    <EuiFlexGroup
+      direction="row"
+      justifyContent="flexEnd"
+      alignItems="center"
+      gutterSize="none"
+      responsive={false}
+    >
+      {showAssistant && (
+        <EuiFlexItem grow={false}>
+          <NewChatById
+            conversationId={isAlert ? ALERT_SUMMARY_CONVERSATION_ID : EVENT_SUMMARY_CONVERSATION_ID}
+            promptContextId={promptContextId}
+            iconOnly
+          />
+        </EuiFlexItem>
+      )}
       {showShareAlertButton && (
         <EuiFlexItem grow={false}>
-          <CopyToClipboard
-            rawValue={alertDetailsLink}
-            modifier={(value: string) => {
-              const query = new URLSearchParams(window.location.search);
-              return `${value}&${FLYOUT_URL_PARAM}=${query.get(FLYOUT_URL_PARAM)}`;
-            }}
-            iconType={'share'}
-            color={'text'}
-            ariaLabel={i18n.translate(
-              'xpack.securitySolution.flyout.right.header.shareButtonAriaLabel',
-              {
-                defaultMessage: 'Share Alert',
-              }
+          <EuiToolTip
+            content={i18n.translate(
+              'xpack.securitySolution.flyout.right.header.shareButtonToolTip',
+              { defaultMessage: 'Share alert' }
             )}
-            data-test-subj={SHARE_BUTTON_TEST_ID}
-          />
+          >
+            <EuiCopy textToCopy={alertDetailsLink}>
+              {(copy) => (
+                <EuiButtonIcon
+                  iconType={'share'}
+                  color={'text'}
+                  aria-label={i18n.translate(
+                    'xpack.securitySolution.flyout.right.header.shareButtonAriaLabel',
+                    { defaultMessage: 'Share alert' }
+                  )}
+                  data-test-subj={SHARE_BUTTON_TEST_ID}
+                  onClick={() => copyFunction(copy, alertDetailsLink, modifier)}
+                  onKeyDown={() => copyFunction(copy, alertDetailsLink, modifier)}
+                />
+              )}
+            </EuiCopy>
+          </EuiToolTip>
         </EuiFlexItem>
       )}
     </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_title.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_title.tsx
index b9e517a4188933..d67253061d1d1f 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_title.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/header_title.tsx
@@ -7,19 +7,9 @@
 
 import type { FC } from 'react';
 import React, { memo, useMemo } from 'react';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiTitle,
-  useEuiTheme,
-  EuiTextColor,
-  EuiIcon,
-  EuiToolTip,
-} from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { isEmpty } from 'lodash';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { css } from '@emotion/react';
 import { DocumentStatus } from './status';
 import { DocumentSeverity } from './severity';
 import { RiskScore } from './risk_score';
@@ -29,6 +19,7 @@ import { PreferenceFormattedDate } from '../../../../common/components/formatted
 import { RenderRuleName } from '../../../../timelines/components/timeline/body/renderers/formatted_field_helpers';
 import { SIGNAL_RULE_NAME_FIELD_NAME } from '../../../../timelines/components/timeline/body/renderers/constants';
 import { FLYOUT_HEADER_TITLE_TEST_ID } from './test_ids';
+import { FlyoutTitle } from '../../../shared/components/flyout_title';
 
 /**
  * Document details flyout right section header
@@ -38,55 +29,29 @@ export const HeaderTitle: FC = memo(() => {
   const { isAlert, ruleName, timestamp, ruleId } = useBasicDataFromDetailsData(
     dataFormattedForFieldBrowser
   );
-  const { euiTheme } = useEuiTheme();
+
   const ruleTitle = useMemo(
     () => (
-      <EuiToolTip content={ruleName}>
-        <RenderRuleName
-          contextId={scopeId}
-          eventId={eventId}
-          fieldName={SIGNAL_RULE_NAME_FIELD_NAME}
-          fieldType={'string'}
-          isAggregatable={false}
-          isDraggable={false}
-          linkValue={ruleId}
-          value={ruleName}
-          openInNewTab
-        >
-          <div
-            css={css`
-              word-break: break-word;
-              display: -webkit-box;
-              -webkit-line-clamp: 3;
-              -webkit-box-orient: vertical;
-              overflow: hidden;
-              text-overflow: ellipsis;
-              margin-right: ${euiTheme.size.base};
-            `}
-          >
-            <EuiIcon type={'warning'} size="m" className="eui-alignBaseline" />
-            &nbsp;
-            <EuiTitle size="s">
-              <EuiTextColor color={euiTheme.colors.primaryText}>
-                <span data-test-subj={FLYOUT_HEADER_TITLE_TEST_ID}>{ruleName}</span>
-              </EuiTextColor>
-            </EuiTitle>
-            &nbsp;
-            <EuiIcon
-              type={'popout'}
-              size="m"
-              css={css`
-                display: inline;
-                position: absolute;
-                bottom: ${euiTheme.size.xs};
-                right: 0;
-              `}
-            />
-          </div>
-        </RenderRuleName>
-      </EuiToolTip>
+      <RenderRuleName
+        contextId={scopeId}
+        eventId={eventId}
+        fieldName={SIGNAL_RULE_NAME_FIELD_NAME}
+        fieldType={'string'}
+        isAggregatable={false}
+        isDraggable={false}
+        linkValue={ruleId}
+        value={ruleName}
+        openInNewTab
+      >
+        <FlyoutTitle
+          title={ruleName}
+          iconType={'warning'}
+          isLink
+          data-test-subj={FLYOUT_HEADER_TITLE_TEST_ID}
+        />
+      </RenderRuleName>
     ),
-    [ruleName, ruleId, eventId, scopeId, euiTheme.colors.primaryText, euiTheme.size]
+    [ruleName, ruleId, eventId, scopeId]
   );
 
   const eventTitle = (
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/test_ids.ts b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/test_ids.ts
index 08c20e38f0e283..28d76c040ebbbf 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/test_ids.ts
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/test_ids.ts
@@ -125,15 +125,12 @@ export const PREVALENCE_TEST_ID = `${PREFIX}InsightsPrevalence` as const;
 
 /* Visualizations section */
 
-const VISUALIZATIONS_TEST_ID = `${PREFIX}Visualizations` as const;
-export const VISUALIZATIONS_SECTION_TEST_ID = `${VISUALIZATIONS_TEST_ID}Title` as const;
-export const VISUALIZATIONS_SECTION_HEADER_TEST_ID =
-  `${VISUALIZATIONS_TEST_ID}TitleHeader` as const;
+export const VISUALIZATIONS_TEST_ID = `${PREFIX}Visualizations` as const;
+export const VISUALIZATIONS_SECTION_HEADER_TEST_ID = `${VISUALIZATIONS_TEST_ID}Header` as const;
 export const ANALYZER_PREVIEW_TEST_ID = `${PREFIX}AnalyzerPreview` as const;
 export const ANALYZER_PREVIEW_LOADING_TEST_ID = `${ANALYZER_PREVIEW_TEST_ID}Loading` as const;
 
 export const SESSION_PREVIEW_TEST_ID = `${PREFIX}SessionPreview` as const;
-export const SESSION_PREVIEW_UPSELL_TEST_ID = `${SESSION_PREVIEW_TEST_ID}UpSell` as const;
 
 /* Response section */
 
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/visualizations_section.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/visualizations_section.tsx
index 4b53911bea590b..000e1c11528cc7 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/visualizations_section.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/visualizations_section.tsx
@@ -11,7 +11,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { AnalyzerPreviewContainer } from './analyzer_preview_container';
 import { SessionPreviewContainer } from './session_preview_container';
 import { ExpandableSection } from './expandable_section';
-import { VISUALIZATIONS_SECTION_TEST_ID } from './test_ids';
+import { VISUALIZATIONS_TEST_ID } from './test_ids';
 
 export interface VisualizationsSectionProps {
   /**
@@ -35,7 +35,7 @@ export const VisualizationsSection: React.FC<VisualizationsSectionProps> = ({
           defaultMessage="Visualizations"
         />
       }
-      data-test-subj={VISUALIZATIONS_SECTION_TEST_ID}
+      data-test-subj={VISUALIZATIONS_TEST_ID}
     >
       <SessionPreviewContainer />
 
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/tabs/json_tab.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/tabs/json_tab.tsx
index f29a1486819cb5..6d329811f72283 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/tabs/json_tab.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/tabs/json_tab.tsx
@@ -8,10 +8,10 @@
 import type { FC } from 'react';
 import React, { memo, useEffect, useRef, useState } from 'react';
 import { JsonCodeEditor } from '@kbn/unified-doc-viewer-plugin/public';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiButtonEmpty, EuiCopy, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { CopyToClipboard } from '../../../shared/components/copy_to_clipboard';
+import { copyFunction } from '../../../shared/utils/copy_to_clipboard';
 import { JSON_TAB_CONTENT_TEST_ID, JSON_TAB_COPY_TO_CLIPBOARD_BUTTON_TEST_ID } from './test_ids';
 import { useRightPanelContext } from '../context';
 
@@ -48,31 +48,35 @@ export const JsonTab: FC = memo(() => {
   return (
     <EuiFlexGroup
       ref={flexGroupElement}
-      direction={'column'}
-      gutterSize={'none'}
+      direction="column"
+      gutterSize="none"
       data-test-subj={JSON_TAB_CONTENT_TEST_ID}
     >
       <EuiFlexItem>
         <EuiFlexGroup justifyContent={'flexEnd'}>
           <EuiFlexItem grow={false}>
-            <CopyToClipboard
-              rawValue={jsonValue}
-              text={
-                <FormattedMessage
-                  id="xpack.securitySolution.flyout.right.jsonTab.copyToClipboardButtonLabel"
-                  defaultMessage="Copy to clipboard"
-                />
-              }
-              iconType={'copyClipboard'}
-              size={'xs'}
-              ariaLabel={i18n.translate(
-                'xpack.securitySolution.flyout.right.jsonTab.copyToClipboardButtonAriaLabel',
-                {
-                  defaultMessage: 'Copy to clipboard',
-                }
+            <EuiCopy textToCopy={jsonValue}>
+              {(copy) => (
+                <EuiButtonEmpty
+                  iconType={'copyClipboard'}
+                  size={'xs'}
+                  aria-label={i18n.translate(
+                    'xpack.securitySolution.flyout.right.jsonTab.copyToClipboardButtonAriaLabel',
+                    {
+                      defaultMessage: 'Copy to clipboard',
+                    }
+                  )}
+                  data-test-subj={JSON_TAB_COPY_TO_CLIPBOARD_BUTTON_TEST_ID}
+                  onClick={() => copyFunction(copy, jsonValue)}
+                  onKeyDown={() => copyFunction(copy, jsonValue)}
+                >
+                  <FormattedMessage
+                    id="xpack.securitySolution.flyout.right.jsonTab.copyToClipboardButtonLabel"
+                    defaultMessage="Copy to clipboard"
+                  />
+                </EuiButtonEmpty>
               )}
-              data-test-subj={JSON_TAB_COPY_TO_CLIPBOARD_BUTTON_TEST_ID}
-            />
+            </EuiCopy>
           </EuiFlexItem>
         </EuiFlexGroup>
       </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.stories.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.stories.tsx
deleted file mode 100644
index 16519305d2a009..00000000000000
--- a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.stories.tsx
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import type { Story } from '@storybook/react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { CopyToClipboard } from './copy_to_clipboard';
-
-export default {
-  component: CopyToClipboard,
-  title: 'Flyout/CopyToClipboard',
-};
-
-const json = JSON.stringify({
-  foo: 'bar',
-});
-
-export const Default: Story<void> = () => {
-  return (
-    <CopyToClipboard
-      rawValue={json}
-      text={<p>{'Copy'}</p>}
-      iconType={'copyClipboard'}
-      ariaLabel={'Copy'}
-    />
-  );
-};
-
-export const WithModifier: Story<void> = () => {
-  return (
-    <CopyToClipboard
-      rawValue={json}
-      modifier={(value) => {
-        window.alert('modifier');
-        return value;
-      }}
-      text={<p>{'Copy'}</p>}
-      iconType={'copyClipboard'}
-      ariaLabel={'Copy'}
-    />
-  );
-};
-
-export const MultipleSizes: Story<void> = () => {
-  return (
-    <EuiFlexGroup direction="column" gutterSize="none">
-      <EuiFlexItem grow={false}>
-        <CopyToClipboard
-          rawValue={json}
-          text={<p>{'xs size'}</p>}
-          iconType={'copyClipboard'}
-          size={'xs'}
-          ariaLabel={'Copy'}
-        />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <CopyToClipboard
-          rawValue={json}
-          text={<p>{'s size'}</p>}
-          iconType={'copyClipboard'}
-          size={'s'}
-          ariaLabel={'Copy'}
-        />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <CopyToClipboard
-          rawValue={json}
-          text={<p>{'m size'}</p>}
-          iconType={'copyClipboard'}
-          size={'m'}
-          ariaLabel={'Copy'}
-        />
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-};
-
-export const ButtonOnly: Story<void> = () => {
-  return (
-    <CopyToClipboard
-      rawValue={json}
-      modifier={(value) => {
-        window.alert('modifier');
-        return value;
-      }}
-      iconType={'copyClipboard'}
-      ariaLabel={'Copy'}
-    />
-  );
-};
-
-export const CustomColor: Story<void> = () => {
-  return (
-    <CopyToClipboard
-      rawValue={json}
-      modifier={(value) => {
-        window.alert('modifier');
-        return value;
-      }}
-      iconType={'copyClipboard'}
-      ariaLabel={'Copy'}
-      text={<p>{'showing custom color'}</p>}
-      color={'accent'}
-    />
-  );
-};
-
-export const CustomIcon: Story<void> = () => {
-  return (
-    <CopyToClipboard
-      rawValue={json}
-      modifier={(value) => {
-        window.alert('modifier');
-        return value;
-      }}
-      iconType={'share'}
-      ariaLabel={'Share'}
-      text={<p>{'custom icon'}</p>}
-    />
-  );
-};
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.test.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.test.tsx
deleted file mode 100644
index 1f9c5976f18a9c..00000000000000
--- a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.test.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
-import { render } from '@testing-library/react';
-import React from 'react';
-import type { CopyToClipboardProps } from './copy_to_clipboard';
-import { CopyToClipboard } from './copy_to_clipboard';
-
-jest.mock('@elastic/eui', () => ({
-  ...jest.requireActual('@elastic/eui'),
-  copyToClipboard: jest.fn(),
-  EuiCopy: jest.fn(({ children: functionAsChild }) => functionAsChild(jest.fn())),
-}));
-
-const renderShareButton = (props: CopyToClipboardProps) =>
-  render(
-    <IntlProvider locale="en">
-      <CopyToClipboard {...props} />
-    </IntlProvider>
-  );
-
-describe('ShareButton', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  it('should render the copy to clipboard button', () => {
-    const text = 'text';
-
-    const props = {
-      rawValue: 'rawValue',
-      text: <span>{text}</span>,
-      iconType: 'iconType',
-      ariaLabel: 'ariaLabel',
-      'data-test-subj': 'data-test-subj',
-    };
-    const { getByTestId, getByText } = renderShareButton(props);
-
-    const button = getByTestId('data-test-subj');
-
-    expect(button).toBeInTheDocument();
-    expect(button).toHaveAttribute('aria-label', props.ariaLabel);
-    expect(button).toHaveAttribute('type', 'button');
-
-    expect(getByText(text)).toBeInTheDocument();
-  });
-
-  it('should use modifier if provided', () => {
-    const modifiedFc = jest.fn();
-
-    const props = {
-      rawValue: 'rawValue',
-      modifier: modifiedFc,
-      text: <span>{'text'}</span>,
-      iconType: 'iconType',
-      ariaLabel: 'ariaLabel',
-      'data-test-subj': 'data-test-subj',
-    };
-    const { getByTestId } = renderShareButton(props);
-
-    const button = getByTestId('data-test-subj');
-
-    button.click();
-
-    expect(modifiedFc).toHaveBeenCalledWith(props.rawValue);
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.tsx
deleted file mode 100644
index 0727349543d8eb..00000000000000
--- a/x-pack/plugins/security_solution/public/flyout/shared/components/copy_to_clipboard.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { EuiButtonEmptyProps } from '@elastic/eui';
-import { copyToClipboard, EuiButtonEmpty, EuiCopy } from '@elastic/eui';
-import type { FC, ReactElement } from 'react';
-import React from 'react';
-
-export interface CopyToClipboardProps {
-  /**
-   * Value to save to the clipboard
-   */
-  rawValue: string;
-  /**
-   * Function to modify the raw value before saving to the clipboard
-   */
-  modifier?: (rawValue: string) => string;
-  /**
-   * Button main text (next to icon)
-   */
-  text?: ReactElement;
-  /**
-   * Icon name (value coming from EUI)
-   */
-  iconType: EuiButtonEmptyProps['iconType'];
-  /**
-   * Button size (values coming from EUI)
-   */
-  size?: EuiButtonEmptyProps['size'];
-  /**
-   * Optional button color
-   */
-  color?: EuiButtonEmptyProps['color'];
-  /**
-   * Aria label value for the button
-   */
-  ariaLabel: string;
-  /**
-   Data test subject string for testing
-   */
-  ['data-test-subj']?: string;
-}
-
-/**
- * Copy to clipboard component
- */
-export const CopyToClipboard: FC<CopyToClipboardProps> = ({
-  rawValue,
-  modifier,
-  text,
-  iconType,
-  size = 'm',
-  color = 'primary',
-  ariaLabel,
-  'data-test-subj': dataTestSubj,
-}) => {
-  return (
-    <EuiCopy textToCopy={rawValue}>
-      {(copy) => (
-        <EuiButtonEmpty
-          onClick={() => {
-            copy();
-
-            if (modifier) {
-              const modifiedCopyValue = modifier(rawValue);
-              copyToClipboard(modifiedCopyValue);
-            } else {
-              copyToClipboard(rawValue);
-            }
-          }}
-          iconType={iconType}
-          size={size}
-          color={color}
-          aria-label={ariaLabel}
-          data-test-subj={dataTestSubj}
-        >
-          {text}
-        </EuiButtonEmpty>
-      )}
-    </EuiCopy>
-  );
-};
-
-CopyToClipboard.displayName = 'CopyToClipboard';
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_navigation.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_navigation.tsx
index 3629a711b92d0b..820b0ac5efcd95 100644
--- a/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_navigation.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_navigation.tsx
@@ -24,7 +24,7 @@ import {
   EXPAND_DETAILS_BUTTON_TEST_ID,
 } from './test_ids';
 
-export interface PanelNavigationProps {
+export interface FlyoutNavigationProps {
   /**
    * If true, the expand detail button will be displayed
    */
@@ -39,7 +39,11 @@ export interface PanelNavigationProps {
   actions?: React.ReactElement;
 }
 
-export const FlyoutNavigation: FC<PanelNavigationProps> = memo(
+/**
+ * Navigation menu on the right panel only, with expand/collapse button and option to
+ * pass in a list of actions to be displayed on top.
+ */
+export const FlyoutNavigation: FC<FlyoutNavigationProps> = memo(
   ({ flyoutIsExpandable = false, expandDetails, actions }) => {
     const { euiTheme } = useEuiTheme();
     const { closeLeftPanel, panels } = useExpandableFlyoutContext();
@@ -105,7 +109,7 @@ export const FlyoutNavigation: FC<PanelNavigationProps> = memo(
           responsive={false}
           css={css`
             padding-left: ${euiTheme.size.s};
-            padding-right: ${euiTheme.size.l};
+            padding-right: ${euiTheme.size.xl};
             height: ${euiTheme.size.xxl};
           `}
         >
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.stories.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.stories.tsx
new file mode 100644
index 00000000000000..063e9fe9ef38fb
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.stories.tsx
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import type { Story } from '@storybook/react';
+import { EuiLink } from '@elastic/eui';
+import styled from 'styled-components';
+import { FlyoutTitle } from './flyout_title';
+
+const FixWidthWrapper = styled.div`
+  width: 350px;
+`;
+
+const FixWidthLinkWrapper = styled(EuiLink)`
+  width: 350px;
+`;
+
+export default {
+  component: FlyoutTitle,
+  title: 'Flyout/Title',
+};
+
+export const Default: Story<void> = () => {
+  return (
+    <FixWidthWrapper>
+      <FlyoutTitle title={'Title'} iconType={'warning'} data-test-subj={'test-title'} />
+    </FixWidthWrapper>
+  );
+};
+
+export const WithoutIcon: Story<void> = () => {
+  return (
+    <FixWidthWrapper>
+      <FlyoutTitle title={'Title'} data-test-subj={'test-title'} />
+    </FixWidthWrapper>
+  );
+};
+
+export const MultipleLines: Story<void> = () => {
+  return (
+    <FixWidthWrapper>
+      <FlyoutTitle
+        title={'Very long title should wrap to multiple lines'}
+        iconType={'discuss'}
+        data-test-subj={'test-title'}
+      />
+    </FixWidthWrapper>
+  );
+};
+
+export const MoreThanThreeLines: Story<void> = () => {
+  return (
+    <FixWidthWrapper>
+      <FlyoutTitle
+        title={
+          'Title longer than three lines should be clamped with eclipses and capped at three lines. blah blah blah'
+        }
+        iconType={'document'}
+        data-test-subj={'test-title'}
+      />
+    </FixWidthWrapper>
+  );
+};
+
+export const TitleInLink: Story<void> = () => {
+  return (
+    <FixWidthLinkWrapper>
+      <FlyoutTitle title={'Title'} iconType={'warning'} data-test-subj={'test-title'} isLink />
+    </FixWidthLinkWrapper>
+  );
+};
+
+export const MultipleLinesInLink: Story<void> = () => {
+  return (
+    <FixWidthLinkWrapper>
+      <FlyoutTitle
+        title={'Very long title should wrap to multiple lines'}
+        iconType={'discuss'}
+        data-test-subj={'test-title'}
+        isLink
+      />
+    </FixWidthLinkWrapper>
+  );
+};
+
+export const MoreThanThreeLinesInLink: Story<void> = () => {
+  return (
+    <FixWidthLinkWrapper>
+      <FlyoutTitle
+        title={
+          'Title longer than three lines should be clamped with eclipses and capped at three lines. blah blah blah'
+        }
+        iconType={'document'}
+        data-test-subj={'test-title'}
+        isLink
+      />
+    </FixWidthLinkWrapper>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.test.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.test.tsx
new file mode 100644
index 00000000000000..8668f727201de6
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.test.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { FlyoutTitle } from './flyout_title';
+import {
+  FLYOUT_TITLE_TEST_ID,
+  TITLE_HEADER_ICON_TEST_ID,
+  TITLE_LINK_ICON_TEST_ID,
+} from './test_ids';
+
+const title = 'test title';
+
+describe('<FlyoutTitle />', () => {
+  it('should render title and icon', () => {
+    const { getByTestId, queryByTestId } = render(
+      <FlyoutTitle title={title} iconType={'warning'} />
+    );
+
+    expect(getByTestId(FLYOUT_TITLE_TEST_ID)).toHaveTextContent(title);
+    expect(
+      getByTestId(FLYOUT_TITLE_TEST_ID).querySelector('[data-euiicon-type="warning"]')
+    ).toBeInTheDocument();
+    expect(queryByTestId(TITLE_LINK_ICON_TEST_ID)).not.toBeInTheDocument();
+  });
+
+  it('should not render icon if iconType is not passed', () => {
+    const { getByTestId, queryByTestId } = render(<FlyoutTitle title={title} />);
+
+    expect(getByTestId(FLYOUT_TITLE_TEST_ID)).toBeInTheDocument();
+    expect(queryByTestId(TITLE_HEADER_ICON_TEST_ID)).not.toBeInTheDocument();
+    expect(queryByTestId(TITLE_LINK_ICON_TEST_ID)).not.toBeInTheDocument();
+  });
+
+  it('should render popout icon if title is a link', () => {
+    const { getByTestId } = render(<FlyoutTitle title={title} isLink />);
+
+    expect(getByTestId(FLYOUT_TITLE_TEST_ID)).toHaveTextContent(title);
+    expect(getByTestId(TITLE_LINK_ICON_TEST_ID)).toBeInTheDocument();
+    expect(
+      getByTestId(FLYOUT_TITLE_TEST_ID).querySelector('[data-euiicon-type="popout"]')
+    ).toBeInTheDocument();
+  });
+
+  it('should render title with custom data test subject', () => {
+    const { getByTestId } = render(<FlyoutTitle title={title} data-test-subj={'test-title'} />);
+    expect(getByTestId('test-title')).toHaveTextContent(title);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.tsx b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.tsx
new file mode 100644
index 00000000000000..d9e9d280d38cce
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/shared/components/flyout_title.tsx
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { FC } from 'react';
+import React, { memo, useMemo } from 'react';
+import type { EuiButtonEmptyProps } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  useEuiTheme,
+  EuiToolTip,
+  EuiTitle,
+  EuiIcon,
+  EuiTextColor,
+} from '@elastic/eui';
+import { css } from '@emotion/react';
+import {
+  FLYOUT_TITLE_TEST_ID,
+  TITLE_HEADER_ICON_TEST_ID,
+  TITLE_LINK_ICON_TEST_ID,
+} from './test_ids';
+
+export interface FlyoutTitleProps {
+  /**
+   * Title text
+   */
+  title: string;
+  /**
+   * Optional icon type. If null, no icon is displayed
+   */
+  iconType?: EuiButtonEmptyProps['iconType'];
+  /**
+   * Optional boolean to indicate if title is a link. If true, a popout icon is appended
+   * and the title text is changed to link color
+   */
+  isLink?: boolean;
+  /**
+   * Optional data test subject string
+   */
+  'data-test-subj'?: string;
+}
+
+/**
+ * Title component with optional icon to indicate the type of document, can be used for text or a link
+ */
+export const FlyoutTitle: FC<FlyoutTitleProps> = memo(
+  ({ title, iconType, isLink = false, 'data-test-subj': dataTestSubj = FLYOUT_TITLE_TEST_ID }) => {
+    const { euiTheme } = useEuiTheme();
+
+    const titleIcon = useMemo(() => {
+      return iconType ? (
+        <EuiIcon
+          type={iconType}
+          size="m"
+          className="eui-alignBaseline"
+          data-test-subj={TITLE_HEADER_ICON_TEST_ID}
+          css={css`
+            margin-right: ${euiTheme.size.xs};
+          `}
+        />
+      ) : null;
+    }, [iconType, euiTheme.size.xs]);
+
+    const titleComponent = useMemo(() => {
+      return (
+        <EuiTitle size="s">
+          <EuiTextColor color={isLink ? euiTheme.colors.primaryText : undefined}>
+            <span>{title}</span>
+          </EuiTextColor>
+        </EuiTitle>
+      );
+    }, [title, isLink, euiTheme.colors.primaryText]);
+
+    const linkIcon = useMemo(() => {
+      return (
+        <EuiIcon
+          type={'popout'}
+          size="m"
+          css={css`
+            margin-bottom: ${euiTheme.size.xs};
+          `}
+          data-test-subj={TITLE_LINK_ICON_TEST_ID}
+        />
+      );
+    }, [euiTheme.size.xs]);
+
+    return (
+      <EuiToolTip content={title}>
+        <EuiFlexGroup
+          alignItems="flexEnd"
+          gutterSize="xs"
+          data-test-subj={dataTestSubj}
+          responsive={false}
+        >
+          <EuiFlexItem>
+            <div
+              css={css`
+                word-break: break-word;
+                display: -webkit-box;
+                -webkit-line-clamp: 3;
+                -webkit-box-orient: vertical;
+                overflow: hidden;
+                text-overflow: ellipsis;
+              `}
+            >
+              {titleIcon}
+              {titleComponent}
+            </div>
+          </EuiFlexItem>
+          {isLink && <EuiFlexItem grow={false}>{linkIcon}</EuiFlexItem>}
+        </EuiFlexGroup>
+      </EuiToolTip>
+    );
+  }
+);
+
+FlyoutTitle.displayName = 'FlyoutTitle';
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/components/test_ids.ts b/x-pack/plugins/security_solution/public/flyout/shared/components/test_ids.ts
index 737b8afb5fd805..2871cefc93cf88 100644
--- a/x-pack/plugins/security_solution/public/flyout/shared/components/test_ids.ts
+++ b/x-pack/plugins/security_solution/public/flyout/shared/components/test_ids.ts
@@ -32,3 +32,7 @@ export const EXPAND_DETAILS_BUTTON_TEST_ID =
 export const COLLAPSE_DETAILS_BUTTON_TEST_ID =
   `${FLYOUT_NAVIGATION_TEST_ID}CollapseDetailButton` as const;
 export const HEADER_ACTIONS_TEST_ID = `${FLYOUT_NAVIGATION_TEST_ID}Actions` as const;
+
+export const FLYOUT_TITLE_TEST_ID = `${PREFIX}Title` as const;
+export const TITLE_HEADER_ICON_TEST_ID = `${FLYOUT_TITLE_TEST_ID}Icon` as const;
+export const TITLE_LINK_ICON_TEST_ID = `${FLYOUT_TITLE_TEST_ID}LinkIcon` as const;
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.test.tsx b/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.test.tsx
new file mode 100644
index 00000000000000..07816046aa4e1f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.test.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { copyFunction } from './copy_to_clipboard';
+
+jest.mock('@elastic/eui', () => ({
+  ...jest.requireActual('@elastic/eui'),
+  copyToClipboard: jest.fn(),
+  EuiCopy: jest.fn(({ children: functionAsChild }) => functionAsChild(jest.fn())),
+}));
+
+describe('copyFunction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  const rawValue = 'rawValue';
+
+  it('should call copy function', () => {
+    const euiCopy = jest.fn();
+
+    copyFunction(euiCopy, rawValue);
+
+    expect(euiCopy).toHaveBeenCalled();
+  });
+
+  it('should call modifier function if passed', () => {
+    const euiCopy = jest.fn();
+    const modifiedFc = jest.fn();
+
+    copyFunction(euiCopy, rawValue, modifiedFc);
+
+    expect(modifiedFc).toHaveBeenCalledWith(rawValue);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.tsx b/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.tsx
new file mode 100644
index 00000000000000..efc3523edac34f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/shared/utils/copy_to_clipboard.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { copyToClipboard } from '@elastic/eui';
+
+/**
+ * Copy to clipboard wrapper component. It allows adding a copy to clipboard functionality to any element.
+ * It expects the value to be copied with an optional function to modify the value if necessary.
+ *
+ * @param copy the copy method from EuiCopy
+ * @param rawValue the value to save to the clipboard
+ * @param modifier  a function to modify the raw value before saving to the clipboard
+ */
+export const copyFunction = (
+  copy: Function,
+  rawValue: string,
+  modifier?: (rawValue: string) => string
+) => {
+  copy();
+
+  if (modifier) {
+    const modifiedCopyValue = modifier(rawValue);
+    copyToClipboard(modifiedCopyValue);
+  } else {
+    copyToClipboard(rawValue);
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/get_processes_action.tsx b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/get_processes_action.tsx
index fee7a2b73e815c..095710e50466ae 100644
--- a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/get_processes_action.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/get_processes_action.tsx
@@ -22,16 +22,20 @@ const StyledEuiBasicTable = styled(EuiBasicTable)`
   table {
     background-color: transparent;
   }
+
   .euiTableHeaderCell {
     border-bottom: ${(props) => props.theme.eui.euiBorderThin};
+
     .euiTableCellContent__text {
       font-weight: ${(props) => props.theme.eui.euiFontWeightRegular};
     }
   }
+
   .euiTableRow {
     &:hover {
       background-color: ${({ theme: { eui } }) => eui.euiColorEmptyShade} !important;
     }
+
     .euiTableRowCell {
       border-top: none !important;
       border-bottom: none !important;
@@ -71,6 +75,7 @@ export const GetProcessesActionResult = memo<ActionRequestComponentProps>(
       () => [
         {
           field: 'user',
+          'data-test-subj': 'process_list_user',
           name: i18n.translate(
             'xpack.securitySolution.endpointResponseActions.getProcesses.table.header.user',
             { defaultMessage: 'USER' }
@@ -79,6 +84,7 @@ export const GetProcessesActionResult = memo<ActionRequestComponentProps>(
         },
         {
           field: 'pid',
+          'data-test-subj': 'process_list_pid',
           name: i18n.translate(
             'xpack.securitySolution.endpointResponseActions.getProcesses.table.header.pid',
             { defaultMessage: 'PID' }
@@ -87,6 +93,7 @@ export const GetProcessesActionResult = memo<ActionRequestComponentProps>(
         },
         {
           field: 'entity_id',
+          'data-test-subj': 'process_list_entity_id',
           name: i18n.translate(
             'xpack.securitySolution.endpointResponseActions.getProcesses.table.header.enityId',
             { defaultMessage: 'ENTITY ID' }
@@ -96,6 +103,7 @@ export const GetProcessesActionResult = memo<ActionRequestComponentProps>(
 
         {
           field: 'command',
+          'data-test-subj': 'process_list_command',
           name: i18n.translate(
             'xpack.securitySolution.endpointResponseActions.getProcesses.table.header.command',
             { defaultMessage: 'COMMAND' }
@@ -120,7 +128,11 @@ export const GetProcessesActionResult = memo<ActionRequestComponentProps>(
     // Show results
     return (
       <ResultComponent data-test-subj="getProcessesSuccessCallout" showTitle={false}>
-        <StyledEuiBasicTable items={[...tableEntries]} columns={columns} />
+        <StyledEuiBasicTable
+          data-test-subj={'getProcessListTable'}
+          items={[...tableEntries]}
+          columns={columns}
+        />
       </ResultComponent>
     );
   }
diff --git a/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts b/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
index bd4c34b36de59e..0ae9db14cbce33 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/cypress.d.ts
@@ -24,6 +24,7 @@ import type {
   CreateUserAndRoleCyTaskOptions,
   UninstallAgentFromHostTaskOptions,
   IsAgentAndEndpointUninstalledFromHostTaskOptions,
+  LogItTaskOptions,
 } from './types';
 import type {
   DeleteIndexedFleetEndpointPoliciesResponse,
@@ -86,13 +87,15 @@ declare global {
        * or fail if `timeout` is reached.
        * @param fn
        * @param options
+       * @param message
        */
       waitUntil(
         fn: (subject?: any) => boolean | Promise<boolean> | Chainable<boolean>,
         options?: Partial<{
           interval: number;
           timeout: number;
-        }>
+        }>,
+        message?: string
       ): Chainable<Subject>;
 
       task(
@@ -217,6 +220,12 @@ declare global {
         arg: IsAgentAndEndpointUninstalledFromHostTaskOptions,
         options?: Partial<Loggable & Timeoutable>
       ): Chainable<boolean>;
+
+      task(
+        name: 'logIt',
+        arg: LogItTaskOptions,
+        options?: Partial<Loggable & Timeoutable>
+      ): Chainable<null>;
     }
   }
 }
diff --git a/x-pack/plugins/security_solution/public/management/cypress/cypress_base.config.ts b/x-pack/plugins/security_solution/public/management/cypress/cypress_base.config.ts
index 8938f1a4ec7b0c..6ed65f031d714e 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/cypress_base.config.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/cypress_base.config.ts
@@ -56,6 +56,11 @@ export const getCypressBaseConfig = (
         // to `debug` or `verbose` when wanting to debug tooling used by tests (ex. data indexer functions).
         TOOLING_LOG_LEVEL: 'info',
 
+        // Variable works in conjunction with the Cypress parallel runner. When set to true, fleet server
+        // will be setup right after the Kibana stack, so that by the time cypress tests `.run()`/`.open()`,
+        // the env. will be all setup and we don't have to explicitly setup fleet from a test file
+        WITH_FLEET_SERVER: true,
+
         // grep related configs
         grepFilterSpecs: true,
         grepOmitFiltered: true,
@@ -69,11 +74,12 @@ export const getCypressBaseConfig = (
         experimentalRunAllSpecs: true,
         experimentalMemoryManagement: true,
         experimentalInteractiveRunEvents: true,
-        setupNodeEvents: (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions) => {
+        setupNodeEvents: async (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions) => {
           // IMPORTANT: setting the log level should happen before any tooling is called
           setupToolingLogLevel(config);
 
           dataLoaders(on, config);
+
           // Data loaders specific to "real" Endpoint testing
           dataLoadersForRealEndpoints(on, config);
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
index 50bcefc65ab956..1948434b39c9f5 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
@@ -20,8 +20,7 @@ import { createEndpointHost } from '../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../tasks/delete_all_endpoint_data';
 import { enableAllPolicyProtections } from '../../tasks/endpoint_policy';
 
-// FLAKY: https://github.com/elastic/kibana/issues/168340
-describe.skip(
+describe(
   'Automated Response Actions',
   {
     tags: [
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts
index 3cfa2a5c9287d3..ae79f3d47b4a56 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts
@@ -39,8 +39,8 @@ describe(
       describe('Renders and saves protection updates', () => {
         let indexedPolicy: IndexedFleetEndpointPolicyResponse;
         let policy: PolicyData;
-        const today = moment.utc();
-        const formattedToday = today.format('MMMM DD, YYYY');
+        const defaultDate = moment.utc().subtract(1, 'days');
+        const formattedDefaultDate = defaultDate.format('MMMM DD, YYYY');
 
         beforeEach(() => {
           login();
@@ -73,7 +73,7 @@ describe(
           cy.getByTestSubj('protection-updates-deployed-version').contains('latest');
           cy.getByTestSubj('protection-updates-manifest-name-version-to-deploy-title');
           cy.getByTestSubj('protection-updates-version-to-deploy-picker').within(() => {
-            cy.get('input').should('have.value', formattedToday);
+            cy.get('input').should('have.value', formattedDefaultDate);
           });
           cy.getByTestSubj('protection-updates-manifest-name-note-title');
           cy.getByTestSubj('protection-updates-manifest-note');
@@ -91,7 +91,7 @@ describe(
           cy.getByTestSubj('protectionUpdatesSaveButton').click();
           cy.wait('@policy').then(({ request, response }) => {
             expect(request.body.inputs[0].config.policy.value.global_manifest_version).to.equal(
-              today.format('YYYY-MM-DD')
+              defaultDate.format('YYYY-MM-DD')
             );
             expect(response?.statusCode).to.equal(200);
           });
@@ -102,7 +102,7 @@ describe(
           });
 
           cy.getByTestSubj('protectionUpdatesSuccessfulMessage');
-          cy.getByTestSubj('protection-updates-deployed-version').contains(formattedToday);
+          cy.getByTestSubj('protection-updates-deployed-version').contains(formattedDefaultDate);
           cy.getByTestSubj('protection-updates-manifest-note').contains(testNote);
           cy.getByTestSubj('protectionUpdatesSaveButton').should('be.disabled');
         });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
index a50bdf394a9a17..c7120ded692b94 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/response_console/process_operations.cy.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { getRunningProcesses } from '../../../tasks/response_actions';
 import type { PolicyData } from '../../../../../../common/endpoint/types';
 import type { CreateAndEnrollEndpointHostResponse } from '../../../../../../scripts/endpoint/common/endpoint_host_services';
 import {
@@ -23,16 +24,12 @@ import { enableAllPolicyProtections } from '../../../tasks/endpoint_policy';
 import { createEndpointHost } from '../../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_data';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170563
-describe.skip('Response console', { tags: ['@ess', '@serverless'] }, () => {
+describe('Response console', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
   });
 
   describe('Processes operations:', () => {
-    let cronPID: string;
-    let newCronPID: string;
-
     let indexedPolicy: IndexedFleetEndpointPolicyResponse;
     let policy: PolicyData;
     let createdHost: CreateAndEnrollEndpointHostResponse;
@@ -70,58 +67,47 @@ describe.skip('Response console', { tags: ['@ess', '@serverless'] }, () => {
     it('"processes" - should obtain a list of processes', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       openResponseConsoleFromEndpointList();
+
+      // get running processes
       performCommandInputChecks('processes');
       submitCommand();
       cy.contains('Action pending.').should('exist');
-      cy.getByTestSubj('getProcessesSuccessCallout', { timeout: 120000 }).within(() => {
+
+      // on success
+      cy.getByTestSubj('getProcessListTable', { timeout: 120000 }).within(() => {
         ['USER', 'PID', 'ENTITY ID', 'COMMAND'].forEach((header) => {
           cy.contains(header);
         });
 
         cy.get('tbody > tr').should('have.length.greaterThan', 0);
-        cy.get('tbody > tr > td').should('contain', '/usr/sbin/cron');
-        cy.get('tbody > tr > td')
-          .contains('/usr/sbin/cron')
-          .parents('td')
-          .siblings('td')
-          .eq(1)
-          .find('span')
-          .then((span) => {
-            cronPID = span.text();
-          });
+        cy.get('tbody > tr > td').should('contain', '/components/filebeat');
       });
     });
 
     it('"kill-process --pid" - should kill a process', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       openResponseConsoleFromEndpointList();
-      inputConsoleCommand(`kill-process --pid ${cronPID}`);
-      submitCommand();
-      waitForCommandToBeExecuted('kill-process');
-
-      performCommandInputChecks('processes');
-      submitCommand();
 
-      cy.getByTestSubj('getProcessesSuccessCallout', { timeout: 120000 }).within(() => {
-        cy.get('tbody > tr > td')
-          .contains('/usr/sbin/cron')
-          .parents('td')
-          .siblings('td')
-          .eq(1)
-          .find('span')
-          .then((span) => {
-            newCronPID = span.text();
-          });
+      // get running processes
+      getRunningProcesses('/components/filebeat').then((pid) => {
+        // kill the process using PID
+        inputConsoleCommand(`kill-process --pid ${pid}`);
+        submitCommand();
+        waitForCommandToBeExecuted('kill-process');
       });
-      expect(newCronPID).to.not.equal(cronPID);
     });
 
     it('"suspend-process --pid" - should suspend a process', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       openResponseConsoleFromEndpointList();
-      inputConsoleCommand(`suspend-process --pid ${newCronPID}`);
-      submitCommand();
-      waitForCommandToBeExecuted('suspend-process');
+
+      // get running processes
+      getRunningProcesses('/components/filebeat').then((pid) => {
+        // suspend the process using PID
+        inputConsoleCommand(`suspend-process --pid ${pid}`);
+        submitCommand();
+        waitForCommandToBeExecuted('suspend-process');
+      });
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/enabled/unenroll_agent_from_fleet.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/enabled/unenroll_agent_from_fleet.cy.ts
index f2aef24ad5e12f..17cb52c2cb0424 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/enabled/unenroll_agent_from_fleet.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/enabled/unenroll_agent_from_fleet.cy.ts
@@ -20,8 +20,7 @@ import { login } from '../../../tasks/login';
 import { createEndpointHost } from '../../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_data';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170706
-describe.skip(
+describe(
   'Unenroll agent from fleet when agent tamper protection is enabled',
   { tags: ['@ess'] },
   () => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_disabled_to_enabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_disabled_to_enabled.cy.ts
index b03608c9c52f2f..3d92528c2eee72 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_disabled_to_enabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_disabled_to_enabled.cy.ts
@@ -14,7 +14,7 @@ import {
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
   unenrollAgent,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
 } from '../../../tasks/fleet';
 
 import { login } from '../../../tasks/login';
@@ -22,8 +22,7 @@ import { enableAllPolicyProtections } from '../../../tasks/endpoint_policy';
 import { createEndpointHost } from '../../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_data';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170811
-describe.skip(
+describe(
   'Unenroll agent from fleet when agent tamper protection is disabled but then is switched to a policy with it enabled',
   { tags: ['@ess'] },
   () => {
@@ -80,10 +79,9 @@ describe.skip(
     it('should unenroll from fleet without issues', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       // Change agent policy and wait for action to be completed
-      changeAgentPolicy(
+      reAssignFleetAgentToPolicy(
         createdHost.agentId,
-        policyWithAgentTamperProtectionEnabled.policy_id,
-        3
+        policyWithAgentTamperProtectionEnabled.policy_id
       ).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
         unenrollAgent(createdHost.agentId).then((isUnenrolled) => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_disabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_disabled.cy.ts
index 59c70d85118dd1..a9508a13f719b3 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_disabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_disabled.cy.ts
@@ -14,7 +14,7 @@ import {
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
   unenrollAgent,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
 } from '../../../tasks/fleet';
 
 import { login } from '../../../tasks/login';
@@ -79,7 +79,7 @@ describe(
     it('should unenroll from fleet without issues', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       // Change agent policy and wait for action to be completed
-      changeAgentPolicy(createdHost.agentId, policy.policy_id, 3).then((hasChanged) => {
+      reAssignFleetAgentToPolicy(createdHost.agentId, policy.policy_id).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
         unenrollAgent(createdHost.agentId).then((isUnenrolled) => {
           expect(isUnenrolled).to.eql(true);
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_enabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_enabled.cy.ts
index 3a897bc544ea8a..a5654734c15e43 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_enabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/unenroll_agent_from_fleet_changing_policy_from_enabled_to_enabled.cy.ts
@@ -14,7 +14,7 @@ import {
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
   unenrollAgent,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
 } from '../../../tasks/fleet';
 
 import { login } from '../../../tasks/login';
@@ -81,10 +81,9 @@ describe(
     it('should unenroll from fleet without issues', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
       // Change agent policy and wait for action to be completed
-      changeAgentPolicy(
+      reAssignFleetAgentToPolicy(
         createdHost.agentId,
-        secondPolicyWithAgentTamperProtectionEnabled.policy_id,
-        3
+        secondPolicyWithAgentTamperProtectionEnabled.policy_id
       ).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
         unenrollAgent(createdHost.agentId).then((isUnenrolled) => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_disabled_to_enabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_disabled_to_enabled.cy.ts
index 056191ad2bd7fe..bbb675cf56d5ed 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_disabled_to_enabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_disabled_to_enabled.cy.ts
@@ -14,7 +14,7 @@ import {
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
   getUninstallToken,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
   isAgentAndEndpointUninstalledFromHost,
   uninstallAgentFromHost,
 } from '../../../tasks/fleet';
@@ -24,8 +24,7 @@ import { enableAllPolicyProtections } from '../../../tasks/endpoint_policy';
 import { createEndpointHost } from '../../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_data';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170794
-describe.skip(
+describe(
   'Uninstall agent from host changing agent policy when agent tamper protection is disabled but then is switched to a policy with it enabled',
   { tags: ['@ess'] },
   () => {
@@ -83,10 +82,9 @@ describe.skip(
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
 
       // Change agent policy and wait for action to be completed
-      changeAgentPolicy(
+      reAssignFleetAgentToPolicy(
         createdHost.agentId,
-        policyWithAgentTamperProtectionEnabled.policy_id,
-        3
+        policyWithAgentTamperProtectionEnabled.policy_id
       ).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_disabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_disabled.cy.ts
index e949851677f2a1..f5665d830eb4aa 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_disabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_disabled.cy.ts
@@ -13,7 +13,7 @@ import {
   getEndpointIntegrationVersion,
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
   isAgentAndEndpointUninstalledFromHost,
   uninstallAgentFromHost,
 } from '../../../tasks/fleet';
@@ -81,7 +81,7 @@ describe.skip(
     it('should uninstall from host without issues', () => {
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
 
-      changeAgentPolicy(createdHost.agentId, policy.policy_id, 3).then((hasChanged) => {
+      reAssignFleetAgentToPolicy(createdHost.agentId, policy.policy_id).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
         uninstallAgentFromHost(createdHost.hostname).then((responseWithoutToken) => {
           expect(responseWithoutToken).to.not.match(/(.*)Invalid uninstall token(.*)/);
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_enabled.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_enabled.cy.ts
index 6dca6af07a53ab..d8630a50a83b99 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_enabled.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/tamper_protection/switching_policies/uninstall_agent_from_host_changing_policy_from_enabled_to_enabled.cy.ts
@@ -14,7 +14,7 @@ import {
   createAgentPolicyTask,
   enableAgentTamperProtectionFeatureFlagInPolicy,
   getUninstallToken,
-  changeAgentPolicy,
+  reAssignFleetAgentToPolicy,
   isAgentAndEndpointUninstalledFromHost,
   uninstallAgentFromHost,
 } from '../../../tasks/fleet';
@@ -23,8 +23,7 @@ import { login } from '../../../tasks/login';
 import { createEndpointHost } from '../../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../../tasks/delete_all_endpoint_data';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170812
-describe.skip(
+describe(
   'Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled',
   { tags: ['@ess'] },
   () => {
@@ -86,10 +85,9 @@ describe.skip(
       waitForEndpointListPageToBeLoaded(createdHost.hostname);
 
       // Change agent policy and wait for action to be completed
-      changeAgentPolicy(
+      reAssignFleetAgentToPolicy(
         createdHost.agentId,
-        secondPolicyWithAgentTamperProtectionEnabled.policy_id,
-        3
+        secondPolicyWithAgentTamperProtectionEnabled.policy_id
       ).then((hasChanged) => {
         expect(hasChanged).to.eql(true);
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/agent_actions.ts b/x-pack/plugins/security_solution/public/management/cypress/support/agent_actions.ts
index 11a8b30a5e187a..5ad564aaa14bae 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/agent_actions.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/agent_actions.ts
@@ -6,10 +6,8 @@
  */
 
 // / <reference types="cypress" />
-import type { ExecaReturnValue } from 'execa';
-import execa from 'execa';
 
-import { VAGRANT_CWD } from '../../../../scripts/endpoint/common/endpoint_host_services';
+import { getHostVmClient } from '../../../../scripts/endpoint/common/vm_services';
 
 export const agentActions = (on: Cypress.PluginEvents): void => {
   on('task', {
@@ -20,40 +18,19 @@ export const agentActions = (on: Cypress.PluginEvents): void => {
       hostname: string;
       uninstallToken?: string;
     }): Promise<string> => {
-      let result;
+      const hostVmClient = getHostVmClient(hostname);
+
       try {
-        if (process.env.CI) {
-          result = await execa(
-            'vagrant',
-            [
-              'ssh',
-              '--',
-              `sudo elastic-agent uninstall -f ${
-                uninstallToken ? `--uninstall-token ${uninstallToken}` : ''
-              }`,
-            ],
-            {
-              env: {
-                VAGRANT_CWD,
-              },
-            }
-          );
-        } else {
-          result = await execa(`multipass`, [
-            'exec',
-            hostname,
-            '--',
-            'sh',
-            '-c',
+        return (
+          await hostVmClient.exec(
             `sudo elastic-agent uninstall -f ${
               uninstallToken ? `--uninstall-token ${uninstallToken}` : ''
-            }`,
-          ]);
-        }
+            }`
+          )
+        ).stdout;
       } catch (err) {
         return err.stderr;
       }
-      return result.stdout;
     },
 
     isAgentAndEndpointUninstalledFromHost: async ({
@@ -62,25 +39,10 @@ export const agentActions = (on: Cypress.PluginEvents): void => {
       hostname: string;
       uninstallToken?: string;
     }): Promise<boolean> => {
-      let execaReturnValue: ExecaReturnValue<string>;
-      if (process.env.CI) {
-        execaReturnValue = await execa('vagrant', ['ssh', '--', `ls /opt/Elastic`], {
-          env: {
-            VAGRANT_CWD,
-          },
-        });
-      } else {
-        execaReturnValue = await execa(`multipass`, [
-          'exec',
-          hostname,
-          '--',
-          'sh',
-          '-c',
-          `ls /opt/Elastic`,
-        ]);
-      }
+      const hostVmClient = getHostVmClient(hostname);
+      const lsOutput = await hostVmClient.exec('ls /opt/Elastic');
 
-      if (execaReturnValue.stdout === '') {
+      if (lsOutput.stdout === '') {
         return true;
       }
 
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/common.ts b/x-pack/plugins/security_solution/public/management/cypress/support/common.ts
new file mode 100644
index 00000000000000..c356536cc03d46
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/common.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { prefixedOutputLogger } from '../../../../scripts/endpoint/common/utils';
+import type { RuntimeServices } from '../../../../scripts/endpoint/common/stack_services';
+import { createRuntimeServices } from '../../../../scripts/endpoint/common/stack_services';
+
+const RUNTIME_SERVICES_CACHE = new WeakMap<Cypress.PluginConfigOptions, RuntimeServices>();
+
+export const setupStackServicesUsingCypressConfig = async (config: Cypress.PluginConfigOptions) => {
+  if (RUNTIME_SERVICES_CACHE.has(config)) {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    return RUNTIME_SERVICES_CACHE.get(config)!;
+  }
+
+  const stackServices = await createRuntimeServices({
+    kibanaUrl: config.env.KIBANA_URL,
+    elasticsearchUrl: config.env.ELASTICSEARCH_URL,
+    fleetServerUrl: config.env.FLEET_SERVER_URL,
+    username: config.env.KIBANA_USERNAME,
+    password: config.env.KIBANA_PASSWORD,
+    esUsername: config.env.ELASTICSEARCH_USERNAME,
+    esPassword: config.env.ELASTICSEARCH_PASSWORD,
+    asSuperuser: true,
+  }).then(({ log, ...others }) => {
+    return {
+      ...others,
+      log: prefixedOutputLogger('cy.dfw', log),
+    };
+  });
+
+  RUNTIME_SERVICES_CACHE.set(config, stackServices);
+
+  return stackServices;
+};
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts b/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
index fcead968801afa..99ea877053c916 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/data_loaders.ts
@@ -11,14 +11,14 @@ import type { CasePostRequest } from '@kbn/cases-plugin/common';
 import execa from 'execa';
 import type { KbnClient } from '@kbn/test';
 import type { ToolingLog } from '@kbn/tooling-log';
+import { getHostVmClient } from '../../../../scripts/endpoint/common/vm_services';
+import { setupStackServicesUsingCypressConfig } from './common';
 import type { KibanaKnownUserAccounts } from '../common/constants';
 import { KIBANA_KNOWN_DEFAULT_ACCOUNTS } from '../common/constants';
 import type { EndpointSecurityRoleNames } from '../../../../scripts/endpoint/common/roles_users';
 import { SECURITY_SERVERLESS_ROLE_NAMES } from '../../../../scripts/endpoint/common/roles_users';
 import type { LoadedRoleAndUser } from '../../../../scripts/endpoint/common/role_and_user_loader';
 import { EndpointSecurityTestRolesLoader } from '../../../../scripts/endpoint/common/role_and_user_loader';
-import { startRuntimeServices } from '../../../../scripts/endpoint/endpoint_agent_runner/runtime';
-import { runFleetServerIfNeeded } from '../../../../scripts/endpoint/endpoint_agent_runner/fleet_server';
 import {
   sendEndpointActionResponse,
   sendFleetActionResponse,
@@ -35,7 +35,6 @@ import {
   destroyEndpointHost,
   startEndpointHost,
   stopEndpointHost,
-  VAGRANT_CWD,
 } from '../../../../scripts/endpoint/common/endpoint_host_services';
 import type { IndexedEndpointPolicyResponse } from '../../../../common/endpoint/data_loaders/index_endpoint_policy_response';
 import {
@@ -47,6 +46,7 @@ import type {
   IndexEndpointHostsCyTaskOptions,
   LoadUserAndRoleCyTaskOptions,
   CreateUserAndRoleCyTaskOptions,
+  LogItTaskOptions,
 } from '../types';
 import type {
   DeletedIndexedEndpointRuleAlerts,
@@ -60,7 +60,6 @@ import type { IndexedHostsAndAlertsResponse } from '../../../../common/endpoint/
 import { deleteIndexedHostsAndAlerts } from '../../../../common/endpoint/index_data';
 import type { IndexedCase } from '../../../../common/endpoint/data_loaders/index_case';
 import { deleteIndexedCase, indexCase } from '../../../../common/endpoint/data_loaders/index_case';
-import { createRuntimeServices } from '../../../../scripts/endpoint/common/stack_services';
 import type { IndexedFleetEndpointPolicyResponse } from '../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
 import {
   deleteIndexedFleetEndpointPolicies,
@@ -128,18 +127,7 @@ export const dataLoaders = (
 ): void => {
   // Env. variable is set by `cypress_serverless.config.ts`
   const isServerless = config.env.IS_SERVERLESS;
-
-  const stackServicesPromise = createRuntimeServices({
-    kibanaUrl: config.env.KIBANA_URL,
-    elasticsearchUrl: config.env.ELASTICSEARCH_URL,
-    fleetServerUrl: config.env.FLEET_SERVER_URL,
-    username: config.env.KIBANA_USERNAME,
-    password: config.env.KIBANA_PASSWORD,
-    esUsername: config.env.ELASTICSEARCH_USERNAME,
-    esPassword: config.env.ELASTICSEARCH_PASSWORD,
-    asSuperuser: true,
-  });
-
+  const stackServicesPromise = setupStackServicesUsingCypressConfig(config);
   const roleAndUserLoaderPromise: Promise<TestRoleAndUserLoader> = stackServicesPromise.then(
     ({ kbnClient, log }) => {
       return new TestRoleAndUserLoader(kbnClient, log, isServerless);
@@ -147,6 +135,14 @@ export const dataLoaders = (
   );
 
   on('task', {
+    logIt: async ({ level = 'info', data }: LogItTaskOptions): Promise<null> => {
+      return stackServicesPromise
+        .then(({ log }) => {
+          log[level](data);
+        })
+        .then(() => null);
+    },
+
     indexFleetEndpointPolicy: async ({
       policyName,
       endpointPackageVersion,
@@ -290,42 +286,7 @@ export const dataLoadersForRealEndpoints = (
   on: Cypress.PluginEvents,
   config: Cypress.PluginConfigOptions
 ): void => {
-  let fleetServerContainerId: string | undefined;
-
-  const stackServicesPromise = createRuntimeServices({
-    kibanaUrl: config.env.KIBANA_URL,
-    elasticsearchUrl: config.env.ELASTICSEARCH_URL,
-    fleetServerUrl: config.env.FLEET_SERVER_URL,
-    username: config.env.KIBANA_USERNAME,
-    password: config.env.KIBANA_PASSWORD,
-    esUsername: config.env.ELASTICSEARCH_USERNAME,
-    esPassword: config.env.ELASTICSEARCH_PASSWORD,
-    asSuperuser: true,
-  });
-
-  on('before:run', async () => {
-    await startRuntimeServices({
-      kibanaUrl: config.env.KIBANA_URL,
-      elasticUrl: config.env.ELASTICSEARCH_URL,
-      fleetServerUrl: config.env.FLEET_SERVER_URL,
-      username: config.env.KIBANA_USERNAME,
-      password: config.env.KIBANA_PASSWORD,
-      asSuperuser: true,
-    });
-    const data = await runFleetServerIfNeeded();
-    fleetServerContainerId = data?.fleetServerContainerId;
-  });
-
-  on('after:run', async () => {
-    const { log } = await stackServicesPromise;
-    if (fleetServerContainerId) {
-      try {
-        execa.sync('docker', ['kill', fleetServerContainerId]);
-      } catch (error) {
-        log.error(error);
-      }
-    }
-  });
+  const stackServicesPromise = setupStackServicesUsingCypressConfig(config);
 
   on('task', {
     createEndpointHost: async (
@@ -383,15 +344,7 @@ export const dataLoadersForRealEndpoints = (
       path: string;
       content: string;
     }): Promise<null> => {
-      if (process.env.CI) {
-        await execa('vagrant', ['ssh', '--', `echo ${content} > ${path}`], {
-          env: {
-            VAGRANT_CWD,
-          },
-        });
-      } else {
-        await execa(`multipass`, ['exec', hostname, '--', 'sh', '-c', `echo ${content} > ${path}`]);
-      }
+      await getHostVmClient(hostname).exec(`echo ${content} > ${path}`);
       return null;
     },
 
@@ -404,16 +357,7 @@ export const dataLoadersForRealEndpoints = (
       srcPath: string;
       destPath: string;
     }): Promise<null> => {
-      if (process.env.CI) {
-        await execa('vagrant', ['upload', srcPath, destPath], {
-          env: {
-            VAGRANT_CWD,
-          },
-        });
-      } else {
-        await execa(`multipass`, ['transfer', srcPath, `${hostname}:${destPath}`]);
-      }
-
+      await getHostVmClient(hostname).transfer(srcPath, destPath);
       return null;
     },
 
@@ -444,38 +388,19 @@ export const dataLoadersForRealEndpoints = (
       path: string;
       password?: string;
     }): Promise<string> => {
-      let result;
-
-      if (process.env.CI) {
-        result = await execa(
-          `vagrant`,
-          ['ssh', '--', `unzip -p ${password ? `-P ${password} ` : ''}${path}`],
-          {
-            env: {
-              VAGRANT_CWD,
-            },
-          }
-        );
-      } else {
-        result = await execa(`multipass`, [
-          'exec',
-          hostname,
-          '--',
-          'sh',
-          '-c',
-          `unzip -p ${password ? `-P ${password} ` : ''}${path}`,
-        ]);
-      }
-
-      return result.stdout;
+      return (
+        await getHostVmClient(hostname).exec(`unzip -p ${password ? `-P ${password} ` : ''}${path}`)
+      ).stdout;
     },
 
     stopEndpointHost: async (hostName) => {
-      return stopEndpointHost(hostName);
+      await stopEndpointHost(hostName);
+      return null;
     },
 
     startEndpointHost: async (hostName) => {
-      return startEndpointHost(hostName);
+      await startEndpointHost(hostName);
+      return null;
     },
   });
 };
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/e2e.ts b/x-pack/plugins/security_solution/public/management/cypress/support/e2e.ts
index 29173c03c3c778..38abf64ce202ed 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/e2e.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/e2e.ts
@@ -64,7 +64,7 @@ Cypress.Commands.addQuery<'findByTestSubj'>(
 Cypress.Commands.add(
   'waitUntil',
   { prevSubject: 'optional' },
-  (subject, fn, { interval = 500, timeout = 30000 } = {}) => {
+  (subject, fn, { interval = 500, timeout = 30000 } = {}, msg = 'waitUntil()') => {
     let attempts = Math.floor(timeout / interval);
 
     const completeOrRetry = (result: boolean) => {
@@ -72,7 +72,7 @@ Cypress.Commands.add(
         return result;
       }
       if (attempts < 1) {
-        throw new Error(`Timed out while retrying, last result was: {${result}}`);
+        throw new Error(`${msg}: Timed out while retrying - last result was: [${result}]`);
       }
       cy.wait(interval, { log: false }).then(() => {
         attempts--;
@@ -90,7 +90,7 @@ Cypress.Commands.add(
         return result.then(completeOrRetry);
       } else {
         throw new Error(
-          `Unknown return type from callback: ${Object.prototype.toString.call(result)}`
+          `${msg}: Unknown return type from callback: ${Object.prototype.toString.call(result)}`
         );
       }
     };
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/response_actions.ts b/x-pack/plugins/security_solution/public/management/cypress/support/response_actions.ts
index baaf0e12c10e2d..d0d9befddd6a1a 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/response_actions.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/response_actions.ts
@@ -9,25 +9,18 @@
 
 import { get } from 'lodash';
 
+import { setupStackServicesUsingCypressConfig } from './common';
 import {
   getLatestActionDoc,
   updateActionDoc,
   waitForNewActionDoc,
 } from '../../../../scripts/endpoint/common/response_actions';
-import { createRuntimeServices } from '../../../../scripts/endpoint/common/stack_services';
 
 export const responseActionTasks = (
   on: Cypress.PluginEvents,
   config: Cypress.PluginConfigOptions
 ): void => {
-  const stackServicesPromise = createRuntimeServices({
-    kibanaUrl: config.env.KIBANA_URL,
-    elasticsearchUrl: config.env.ELASTICSEARCH_URL,
-    fleetServerUrl: config.env.FLEET_SERVER_URL,
-    username: config.env.KIBANA_USERNAME,
-    password: config.env.KIBANA_PASSWORD,
-    asSuperuser: true,
-  });
+  const stackServicesPromise = setupStackServicesUsingCypressConfig(config);
 
   on('task', {
     getLatestActionDoc: async () => {
diff --git a/x-pack/plugins/security_solution/public/management/cypress/support/setup_tooling_log_level.ts b/x-pack/plugins/security_solution/public/management/cypress/support/setup_tooling_log_level.ts
index c4c1acd428355b..b4901bef9321af 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/support/setup_tooling_log_level.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/support/setup_tooling_log_level.ts
@@ -13,12 +13,13 @@ import { createToolingLogger } from '../../../../common/endpoint/data_loaders/ut
  * @param config
  */
 export const setupToolingLogLevel = (config: Cypress.PluginConfigOptions) => {
+  const log = createToolingLogger();
   const defaultToolingLogLevel = config.env.TOOLING_LOG_LEVEL;
 
+  log.info(`Cypress config 'env.TOOLING_LOG_LEVEL': ${defaultToolingLogLevel}`);
+
   if (defaultToolingLogLevel && defaultToolingLogLevel !== createToolingLogger.defaultLogLevel) {
     createToolingLogger.defaultLogLevel = defaultToolingLogLevel;
-    createToolingLogger().info(
-      `Default log level for 'createToolingLogger()' set to ${defaultToolingLogLevel}`
-    );
+    log.info(`Default log level for 'createToolingLogger()' set to ${defaultToolingLogLevel}`);
   }
 };
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/fleet.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/fleet.ts
index bc0f94d7120584..aa2568268f0204 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tasks/fleet.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/tasks/fleet.ts
@@ -10,6 +10,7 @@ import type {
   GetAgentsResponse,
   GetInfoResponse,
   GetPackagePoliciesResponse,
+  GetOneAgentPolicyResponse,
 } from '@kbn/fleet-plugin/common';
 import {
   agentRouteService,
@@ -26,6 +27,7 @@ import type {
 import { uninstallTokensRouteService } from '@kbn/fleet-plugin/common/services/routes';
 import type { GetUninstallTokensMetadataResponse } from '@kbn/fleet-plugin/common/types/rest_spec/uninstall_token';
 import type { UninstallToken } from '@kbn/fleet-plugin/common/types/models/uninstall_token';
+import { logger } from './logger';
 import type { IndexedFleetEndpointPolicyResponse } from '../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
 import { request } from './common';
 
@@ -138,21 +140,33 @@ export const unenrollAgent = (agentId: string): Cypress.Chainable<boolean> => {
   });
 };
 
-export const changeAgentPolicy = (
+export const fetchFleetAgentPolicy = (
+  agentPolicyId: string
+): Cypress.Chainable<GetOneAgentPolicyResponse['item']> => {
+  return request<GetOneAgentPolicyResponse>({
+    method: 'GET',
+    url: agentPolicyRouteService.getInfoPath(agentPolicyId),
+  }).then((res) => res.body.item);
+};
+
+export const reAssignFleetAgentToPolicy = (
   agentId: string,
-  policyId: string,
-  policyRevision: number
+  policyId: string
 ): Cypress.Chainable<boolean> => {
-  return request({
-    method: 'POST',
-    url: agentRouteService.getReassignPath(agentId),
-    body: {
-      policy_id: policyId,
-    },
-    headers: { 'Elastic-Api-Version': API_VERSIONS.public.v1 },
-  }).then(() => {
-    return waitForHasAgentPolicyChanged(agentId, policyId, policyRevision);
-  });
+  return fetchFleetAgentPolicy(policyId)
+    .then((agentPolicy) => {
+      return request({
+        method: 'POST',
+        url: agentRouteService.getReassignPath(agentId),
+        body: {
+          policy_id: policyId,
+        },
+        headers: { 'Elastic-Api-Version': API_VERSIONS.public.v1 },
+      }).then(() => agentPolicy);
+    })
+    .then((agentPolicy) => {
+      return waitForHasAgentPolicyChanged(agentId, policyId, agentPolicy.revision);
+    });
 };
 
 // only used in "real" endpoint tests not in mocked ones
@@ -205,9 +219,11 @@ const waitForIsAgentUnenrolled = (agentId: string): Cypress.Chainable<boolean> =
 const waitForHasAgentPolicyChanged = (
   agentId: string,
   policyId: string,
+  /** The minimum revision number that the agent must report before it is considered "changed" */
   policyRevision: number
 ): Cypress.Chainable<boolean> => {
   let isPolicyUpdated = false;
+
   return cy
     .waitUntil(
       () => {
@@ -218,19 +234,24 @@ const waitForHasAgentPolicyChanged = (
             'elastic-api-version': API_VERSIONS.public.v1,
           },
         }).then((response) => {
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          const { status, policy_revision, policy_id } = response.body.item;
+
+          logger.debug('Checking policy data:', { status, policy_revision, policy_id });
+
           if (
-            response.body.item.status !== 'updating' &&
-            response.body.item?.policy_revision === policyRevision &&
-            response.body.item?.policy_id === policyId
+            status !== 'updating' &&
+            (policy_revision ?? 0) >= policyRevision &&
+            policy_id === policyId
           ) {
             isPolicyUpdated = true;
-            return true;
           }
 
-          return false;
+          return cy.wrap(isPolicyUpdated);
         });
       },
-      { timeout: 120000 }
+      { timeout: 120000 },
+      `Wait for Fleet Agent to report policy id [${policyId}] with revision [${policyRevision}]`
     )
     .then(() => {
       return isPolicyUpdated;
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/logger.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/logger.ts
new file mode 100644
index 00000000000000..053ee123c5954d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/cypress/tasks/logger.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+export const logger = Object.freeze({
+  info: (...data: any): Cypress.Chainable<null> => {
+    return cy.task('logIt', { level: 'info', data });
+  },
+  debug: (...data: any): Cypress.Chainable<null> => {
+    return cy.task('logIt', { level: 'info', data });
+  },
+  verbose: (...data: any): Cypress.Chainable<null> => {
+    return cy.task('logIt', { level: 'info', data });
+  },
+});
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/response_actions.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/response_actions.ts
index 80f1aaba567a09..387f86c0dd1605 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tasks/response_actions.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/tasks/response_actions.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { inputConsoleCommand, submitCommand } from './response_console';
 import type { UserAuthzAccessLevel } from '../screens';
 import { loadPage, request } from './common';
 import { resolvePathVariables } from '../../../common/utils/resolve_path_variables';
@@ -66,6 +67,28 @@ export const visitRuleActions = (ruleId: string) => {
   cy.getByTestSubj('stepPanelProgress').should('not.exist');
 };
 
+export const getRunningProcesses = (command: string): Cypress.Chainable<number> => {
+  inputConsoleCommand('processes');
+  submitCommand();
+  cy.contains('Action pending.').should('exist');
+
+  // on success
+  // find pid of process
+  // traverse back from last column to the second column that has pid
+  return cy
+    .getByTestSubj('getProcessListTable', { timeout: 120000 })
+    .findByTestSubj('process_list_command')
+    .contains(command)
+    .parents('td')
+    .siblings('td')
+    .eq(1)
+    .find('span')
+    .then((span) => {
+      // get pid
+      return Number(span.text());
+    });
+};
+
 export const tryAddingDisabledResponseAction = (itemNumber = 0) => {
   cy.getByTestSubj('response-actions-wrapper').within(() => {
     cy.getByTestSubj('Endpoint Security-response-action-type-selection-option').should(
diff --git a/x-pack/plugins/security_solution/public/management/cypress/types.ts b/x-pack/plugins/security_solution/public/management/cypress/types.ts
index 6c5dae16100de2..8beb150a64d5af 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/types.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/types.ts
@@ -8,6 +8,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
 import type { Role } from '@kbn/security-plugin/common';
+import type { ToolingLog } from '@kbn/tooling-log';
 import type { ActionDetails } from '../../../common/endpoint/types';
 import type { CyLoadEndpointDataOptions } from './support/plugin_handlers/endpoint_data_loader';
 import type { SecurityTestUser } from './common/constants';
@@ -75,3 +76,8 @@ export interface UninstallAgentFromHostTaskOptions {
 export interface IsAgentAndEndpointUninstalledFromHostTaskOptions {
   hostname: string;
 }
+
+export interface LogItTaskOptions {
+  level: keyof Pick<ToolingLog, 'info' | 'debug' | 'verbose'>;
+  data: any;
+}
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
index cf7012f9019744..2ec4ba333e6409 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
@@ -73,7 +73,9 @@ export const ProtectionUpdatesLayout = React.memo<ProtectionUpdatesLayoutProps>(
     const [manifestVersion, setManifestVersion] = useState(deployedVersion);
 
     const today = moment.utc();
-    const [selectedDate, setSelectedDate] = useState<Moment>(today);
+    const defaultDate = today.clone().subtract(1, 'days');
+
+    const [selectedDate, setSelectedDate] = useState<Moment>(defaultDate);
 
     const { data: fetchedNote, isLoading: getNoteInProgress } = useGetProtectionUpdatesNote({
       packagePolicyId: _policy.id,
@@ -181,24 +183,24 @@ export const ProtectionUpdatesLayout = React.memo<ProtectionUpdatesLayoutProps>(
         if (checked && !automaticUpdatesEnabled) {
           setManifestVersion('latest');
           // Clear selected date on user enabling automatic updates
-          if (selectedDate !== today) {
-            setSelectedDate(today);
+          if (selectedDate !== defaultDate) {
+            setSelectedDate(defaultDate);
           }
         } else {
           setManifestVersion(selectedDate.format(internalDateFormat));
         }
       },
-      [automaticUpdatesEnabled, selectedDate, today]
+      [automaticUpdatesEnabled, selectedDate, defaultDate]
     );
 
     const updateDatepickerSelectedDate = useCallback(
       (date: Moment | null) => {
-        if (date?.isAfter(cutoffDate) && date?.isSameOrBefore(today)) {
-          setSelectedDate(date || today);
+        if (date?.isAfter(cutoffDate) && date?.isSameOrBefore(defaultDate)) {
+          setSelectedDate(date || defaultDate);
           setManifestVersion(date?.format(internalDateFormat) || 'latest');
         }
       },
-      [cutoffDate, today]
+      [cutoffDate, defaultDate]
     );
 
     const renderVersionToDeployPicker = () => {
@@ -224,7 +226,7 @@ export const ProtectionUpdatesLayout = React.memo<ProtectionUpdatesLayoutProps>(
                 popoverPlacement={'downCenter'}
                 dateFormat={displayDateFormat}
                 selected={selectedDate}
-                maxDate={today}
+                maxDate={defaultDate}
                 minDate={cutoffDate}
                 onChange={updateDatepickerSelectedDate}
               />
@@ -304,13 +306,22 @@ export const ProtectionUpdatesLayout = React.memo<ProtectionUpdatesLayoutProps>(
               }
             )}
           >
-            {i18n.translate(
-              'xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled',
-              {
-                defaultMessage:
-                  'Manifest will always be updated to the latest available version. If you want to control updates manually, disable "Update manifest automatically".',
-              }
-            )}
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled"
+              defaultMessage="Protection updates will always be updated to the latest available version. If you want to control updates manually, disable the {toggleName} toggle."
+              values={{
+                toggleName: (
+                  <strong>
+                    {i18n.translate(
+                      'xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled.toggleName',
+                      {
+                        defaultMessage: 'Enable automatic updates',
+                      }
+                    )}
+                  </strong>
+                ),
+              }}
+            />
           </EuiCallOut>
         );
       }
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index e7bb9294a90f2b..c07273e59ed4a0 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -68,6 +68,10 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
    * The current Kibana version. e.g. '8.0.0' or '8.0.0-SNAPSHOT'
    */
   readonly kibanaVersion: string;
+  /**
+   * Whether the environment is 'serverless' or 'traditional'
+   */
+  readonly buildFlavor: string;
   /**
    * For internal use. Specify which version of the Detection Rules fleet package to install
    * when upgrading rules. If not provided, the latest compatible package will be installed,
@@ -97,6 +101,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     this.configSettings = parseConfigSettings(this.config.offeringSettings ?? {}).settings;
     this.kibanaVersion = initializerContext.env.packageInfo.version;
     this.kibanaBranch = initializerContext.env.packageInfo.branch;
+    this.buildFlavor = initializerContext.env.packageInfo.buildFlavor;
     this.prebuiltRulesPackageVersion = this.config.prebuiltRulesPackageVersion;
     this.contract = new PluginContract(this.experimentalFeatures);
     this.telemetry = new TelemetryService();
@@ -281,6 +286,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       ...plugins,
       kibanaBranch: this.kibanaBranch,
       kibanaVersion: this.kibanaVersion,
+      buildFlavor: this.buildFlavor,
       prebuiltRulesPackageVersion: this.prebuiltRulesPackageVersion,
     });
     ExperimentalFeaturesService.init({ experimentalFeatures: this.experimentalFeatures });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index 4a91e71e3e0b57..13b65136500894 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -291,7 +291,9 @@ const UnstyledProcessEventDot = React.memo(
        */ false
     );
 
-    const labelHTMLID = htmlIdGenerator('resolver')(`${nodeID}:label`);
+    const labelHTMLID = useMemo(() => {
+      return htmlIdGenerator('resolver')(`${nodeID}:label`);
+    }, [nodeID]);
 
     const isAriaCurrent = nodeID === ariaActiveDescendant;
     const isAriaSelected = nodeID === selectedNode;
@@ -351,6 +353,14 @@ const UnstyledProcessEventDot = React.memo(
       }
     }, [processEvent, nodeName]);
 
+    const flowToId = useMemo(() => {
+      return ariaFlowtoNodeID === null ? undefined : nodeHTMLID(ariaFlowtoNodeID);
+    }, [ariaFlowtoNodeID, nodeHTMLID]);
+
+    const generatedNodeHTMLID = useMemo(() => {
+      return nodeHTMLID(nodeID);
+    }, [nodeHTMLID, nodeID]);
+
     /* eslint-disable jsx-a11y/click-events-have-key-events */
     return (
       <div
@@ -359,13 +369,13 @@ const UnstyledProcessEventDot = React.memo(
         className={`${className} kbn-resetFocusState`}
         role="treeitem"
         aria-level={ariaLevel === null ? undefined : ariaLevel}
-        aria-flowto={ariaFlowtoNodeID === null ? undefined : nodeHTMLID(ariaFlowtoNodeID)}
+        aria-flowto={flowToId}
         aria-labelledby={labelHTMLID}
         aria-haspopup="true"
         aria-current={isAriaCurrent ? 'true' : undefined}
         aria-selected={isAriaSelected ? 'true' : undefined}
         style={nodeViewportStyle}
-        id={nodeHTMLID(nodeID)}
+        id={generatedNodeHTMLID}
         tabIndex={-1}
       >
         <svg
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
index 6f392006df8bf0..34f473a854460f 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/agent_downloads_service.ts
@@ -10,6 +10,7 @@ import { join } from 'path';
 import fs from 'fs';
 import nodeFetch from 'node-fetch';
 import { finished } from 'stream/promises';
+import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils';
 import { SettingsStorage } from './settings_storage';
 
 export interface DownloadedAgentInfo {
@@ -40,6 +41,7 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
   private downloadsFolderExists = false;
   private readonly downloadsDirName = 'agent_download_storage';
   private readonly downloadsDirFullPath: string;
+  private readonly log = createToolingLogger();
 
   constructor() {
     super('agent_download_storage_settings.json', {
@@ -57,6 +59,7 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
 
     if (!this.downloadsFolderExists) {
       await mkdir(this.downloadsDirFullPath, { recursive: true });
+      this.log.debug(`Created directory [this.downloadsDirFullPath] for cached agent downloads`);
       this.downloadsFolderExists = true;
     }
   }
@@ -74,6 +77,8 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
   }
 
   public async downloadAndStore(agentDownloadUrl: string): Promise<DownloadedAgentInfo> {
+    this.log.debug(`Downloading and storing: ${agentDownloadUrl}`);
+
     // TODO: should we add "retry" attempts to file downloads?
 
     await this.ensureExists();
@@ -82,6 +87,7 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
 
     // If download is already present on disk, then just return that info. No need to re-download it
     if (fs.existsSync(newDownloadInfo.fullFilePath)) {
+      this.log.debug(`Download already cached at [${newDownloadInfo.fullFilePath}]`);
       return newDownloadInfo;
     }
 
@@ -104,10 +110,14 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
       throw e;
     }
 
+    await this.cleanupDownloads();
+
     return newDownloadInfo;
   }
 
   public async cleanupDownloads(): Promise<{ deleted: string[] }> {
+    this.log.debug(`Performing cleanup of cached Agent downlaods`);
+
     const settings = await this.get();
     const maxAgeDate = new Date();
     const response: { deleted: string[] } = { deleted: [] };
@@ -139,6 +149,9 @@ class AgentDownloadStorage extends SettingsStorage<AgentDownloadStorageSettings>
 
     await Promise.allSettled(deleteFilePromises);
 
+    this.log.debug(`Deleted [${response.deleted.length}] file(s)`);
+    this.log.verbose(`files deleted:\n`, response.deleted.join('\n'));
+
     return response;
   }
 }
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/endpoint_host_services.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/endpoint_host_services.ts
index 303ae81a9197a1..cb2718e72ba261 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/endpoint_host_services.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/endpoint_host_services.ts
@@ -8,22 +8,15 @@
 import { kibanaPackageJson } from '@kbn/repo-info';
 import type { KbnClient } from '@kbn/test';
 import type { ToolingLog } from '@kbn/tooling-log';
-import execa from 'execa';
-import assert from 'assert';
-import type { DownloadedAgentInfo } from './agent_downloads_service';
-import { cleanupDownloads, downloadAndStoreAgent } from './agent_downloads_service';
-import {
-  fetchAgentPolicyEnrollmentKey,
-  fetchFleetServerUrl,
-  getAgentDownloadUrl,
-  unEnrollFleetAgent,
-  waitForHostToEnroll,
-} from './fleet_services';
-
-export const VAGRANT_CWD = `${__dirname}/../endpoint_agent_runner/`;
+import { prefixedOutputLogger } from './utils';
+import type { HostVm } from './types';
+import type { BaseVmCreateOptions } from './vm_services';
+import { createVm, getHostVmClient } from './vm_services';
+import { downloadAndStoreAgent } from './agent_downloads_service';
+import { enrollHostVmWithFleet, getAgentDownloadUrl, unEnrollFleetAgent } from './fleet_services';
 
 export interface CreateAndEnrollEndpointHostOptions
-  extends Pick<CreateMultipassVmOptions, 'disk' | 'cpus' | 'memory'> {
+  extends Pick<BaseVmCreateOptions, 'disk' | 'cpus' | 'memory'> {
   kbnClient: KbnClient;
   log: ToolingLog;
   /** The fleet Agent Policy ID to use for enrolling the agent */
@@ -41,6 +34,7 @@ export interface CreateAndEnrollEndpointHostOptions
 export interface CreateAndEnrollEndpointHostResponse {
   hostname: string;
   agentId: string;
+  hostVm: HostVm;
 }
 
 /**
@@ -48,7 +42,7 @@ export interface CreateAndEnrollEndpointHostResponse {
  */
 export const createAndEnrollEndpointHost = async ({
   kbnClient,
-  log,
+  log: _log,
   agentPolicyId,
   cpus,
   disk,
@@ -58,85 +52,47 @@ export const createAndEnrollEndpointHost = async ({
   useClosestVersionMatch = false,
   useCache = true,
 }: CreateAndEnrollEndpointHostOptions): Promise<CreateAndEnrollEndpointHostResponse> => {
-  let cacheCleanupPromise: ReturnType<typeof cleanupDownloads> = Promise.resolve({
-    deleted: [],
-  });
-
+  const log = prefixedOutputLogger('createAndEnrollEndpointHost()', _log);
+  const isRunningInCI = Boolean(process.env.CI);
   const vmName = hostname ?? `test-host-${Math.random().toString().substring(2, 6)}`;
-
-  const agentDownload = await getAgentDownloadUrl(version, useClosestVersionMatch, log).then<{
-    url: string;
-    cache?: DownloadedAgentInfo;
-  }>(({ url }) => {
-    if (useCache) {
-      cacheCleanupPromise = cleanupDownloads();
-
-      return downloadAndStoreAgent(url).then((cache) => {
-        return {
-          url,
-          cache,
-        };
+  const { url: agentUrl } = await getAgentDownloadUrl(version, useClosestVersionMatch, log);
+  const agentDownload = isRunningInCI ? await downloadAndStoreAgent(agentUrl) : undefined;
+
+  // TODO: remove dependency on env. var and keep function pure
+  const hostVm = process.env.CI
+    ? await createVm({
+        type: 'vagrant',
+        name: vmName,
+        log,
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        agentDownload: agentDownload!,
+        disk,
+        cpus,
+        memory,
+      })
+    : await createVm({
+        type: 'multipass',
+        log,
+        name: vmName,
+        disk,
+        cpus,
+        memory,
       });
-    }
-
-    return { url };
-  });
-
-  const [vm, fleetServerUrl, enrollmentToken] = await Promise.all([
-    process.env.CI
-      ? createVagrantVm({
-          vmName,
-          log,
-          cachedAgentDownload: agentDownload.cache as DownloadedAgentInfo,
-        })
-      : createMultipassVm({
-          vmName,
-          disk,
-          cpus,
-          memory,
-        }),
-
-    fetchFleetServerUrl(kbnClient),
 
-    fetchAgentPolicyEnrollmentKey(kbnClient, agentPolicyId),
-  ]);
-
-  if (!process.env.CI) {
-    log.verbose(await execa('multipass', ['info', vm.vmName]));
-  }
-
-  // Some validations before we proceed
-  assert(agentDownload.url, 'Missing agent download URL');
-  assert(fleetServerUrl, 'Fleet server URL not set');
-  assert(enrollmentToken, `No enrollment token for agent policy id [${agentPolicyId}]`);
-
-  log.verbose(`Enrolling host [${vm.vmName}]
-  with fleet-server [${fleetServerUrl}]
-  using enrollment token [${enrollmentToken}]`);
-
-  const { agentId } = await enrollHostWithFleet({
+  const { id: agentId } = await enrollHostVmWithFleet({
     kbnClient,
     log,
-    fleetServerUrl,
-    agentDownloadUrl: agentDownload.url,
-    cachedAgentDownload: agentDownload.cache,
-    enrollmentToken,
-    vmName: vm.vmName,
-  });
-
-  await cacheCleanupPromise.then((results) => {
-    if (results.deleted.length > 0) {
-      log.verbose(`Agent Downloads cache directory was cleaned up and the following ${
-        results.deleted.length
-      } were deleted:
-${results.deleted.join('\n')}
-`);
-    }
+    hostVm,
+    agentPolicyId,
+    version,
+    closestVersionMatch: useClosestVersionMatch,
+    useAgentCache: useCache,
   });
 
   return {
-    hostname: vm.vmName,
+    hostname: hostVm.name,
     agentId,
+    hostVm,
   };
 };
 
@@ -147,7 +103,7 @@ ${results.deleted.join('\n')}
  */
 export const destroyEndpointHost = async (
   kbnClient: KbnClient,
-  createdHost: CreateAndEnrollEndpointHostResponse
+  createdHost: Pick<CreateAndEnrollEndpointHostResponse, 'hostname' | 'agentId'>
 ): Promise<void> => {
   await Promise.all([
     deleteMultipassVm(createdHost.hostname),
@@ -155,226 +111,14 @@ export const destroyEndpointHost = async (
   ]);
 };
 
-interface CreateVmResponse {
-  vmName: string;
-}
-
-interface CreateVagrantVmOptions {
-  vmName: string;
-  cachedAgentDownload: DownloadedAgentInfo;
-  log: ToolingLog;
-}
-
-/**
- * Creates a new VM using `vagrant`
- */
-const createVagrantVm = async ({
-  vmName,
-  cachedAgentDownload,
-  log,
-}: CreateVagrantVmOptions): Promise<CreateVmResponse> => {
-  try {
-    await execa.command(`vagrant destroy -f`, {
-      env: {
-        VAGRANT_CWD,
-      },
-      // Only `pipe` STDERR to parent process
-      stdio: ['inherit', 'inherit', 'pipe'],
-    });
-    // eslint-disable-next-line no-empty
-  } catch (e) {}
-
-  try {
-    await execa.command(`vagrant up`, {
-      env: {
-        VAGRANT_DISABLE_VBOXSYMLINKCREATE: '1',
-        VAGRANT_CWD,
-        VMNAME: vmName,
-        CACHED_AGENT_SOURCE: cachedAgentDownload.fullFilePath,
-        CACHED_AGENT_FILENAME: cachedAgentDownload.filename,
-      },
-      // Only `pipe` STDERR to parent process
-      stdio: ['inherit', 'inherit', 'pipe'],
-    });
-  } catch (e) {
-    log.error(e);
-    throw e;
-  }
-
-  return {
-    vmName,
-  };
-};
-
-interface CreateMultipassVmOptions {
-  vmName: string;
-  /** Number of CPUs */
-  cpus?: number;
-  /** Disk size */
-  disk?: string;
-  /** Amount of memory */
-  memory?: string;
-}
-
-/**
- * Creates a new VM using `multipass`
- */
-const createMultipassVm = async ({
-  vmName,
-  disk = '8G',
-  cpus = 1,
-  memory = '1G',
-}: CreateMultipassVmOptions): Promise<CreateVmResponse> => {
-  await execa.command(
-    `multipass launch --name ${vmName} --disk ${disk} --cpus ${cpus} --memory ${memory}`
-  );
-
-  return {
-    vmName,
-  };
-};
-
 export const deleteMultipassVm = async (vmName: string): Promise<void> => {
-  if (process.env.CI) {
-    await execa.command(`vagrant destroy -f`, {
-      env: {
-        VAGRANT_CWD,
-      },
-    });
-  } else {
-    await execa.command(`multipass delete -p ${vmName}`);
-  }
+  await getHostVmClient(vmName).destroy();
 };
 
-interface EnrollHostWithFleetOptions {
-  kbnClient: KbnClient;
-  log: ToolingLog;
-  vmName: string;
-  agentDownloadUrl: string;
-  cachedAgentDownload?: DownloadedAgentInfo;
-  fleetServerUrl: string;
-  enrollmentToken: string;
-}
-
-const enrollHostWithFleet = async ({
-  kbnClient,
-  log,
-  vmName,
-  fleetServerUrl,
-  agentDownloadUrl,
-  cachedAgentDownload,
-  enrollmentToken,
-}: EnrollHostWithFleetOptions): Promise<{ agentId: string }> => {
-  const agentDownloadedFile = agentDownloadUrl.substring(agentDownloadUrl.lastIndexOf('/') + 1);
-  const vmDirName = agentDownloadedFile.replace(/\.tar\.gz$/, '');
-
-  if (cachedAgentDownload) {
-    log.verbose(
-      `Installing agent on host using cached download from [${cachedAgentDownload.fullFilePath}]`
-    );
-
-    if (!process.env.CI) {
-      // mount local folder on VM
-      await execa.command(
-        `multipass mount ${cachedAgentDownload.directory} ${vmName}:~/_agent_downloads`
-      );
-      await execa.command(
-        `multipass exec ${vmName} -- tar -zxf _agent_downloads/${cachedAgentDownload.filename}`
-      );
-      await execa.command(`multipass unmount ${vmName}:~/_agent_downloads`);
-    }
-  } else {
-    log.verbose(`downloading and installing agent from URL [${agentDownloadUrl}]`);
-
-    if (!process.env.CI) {
-      // download into VM
-      await execa.command(
-        `multipass exec ${vmName} -- curl -L ${agentDownloadUrl} -o ${agentDownloadedFile}`
-      );
-      await execa.command(`multipass exec ${vmName} -- tar -zxf ${agentDownloadedFile}`);
-      await execa.command(`multipass exec ${vmName} -- rm -f ${agentDownloadedFile}`);
-    }
-  }
-
-  const agentInstallArguments = [
-    'sudo',
-
-    './elastic-agent',
-
-    'install',
-
-    '--insecure',
-
-    '--force',
-
-    '--url',
-    fleetServerUrl,
-
-    '--enrollment-token',
-    enrollmentToken,
-  ];
-
-  log.info(`Enrolling elastic agent with Fleet`);
-  if (process.env.CI) {
-    log.verbose(`Command: vagrant ${agentInstallArguments.join(' ')}`);
-
-    await execa(`vagrant`, ['ssh', '--', `cd ${vmDirName} && ${agentInstallArguments.join(' ')}`], {
-      env: {
-        VAGRANT_CWD,
-      },
-      // Only `pipe` STDERR to parent process
-      stdio: ['inherit', 'inherit', 'pipe'],
-    });
-  } else {
-    log.verbose(`Command: multipass ${agentInstallArguments.join(' ')}`);
-
-    await execa(`multipass`, [
-      'exec',
-      vmName,
-      '--working-directory',
-      `/home/ubuntu/${vmDirName}`,
-
-      '--',
-      ...agentInstallArguments,
-    ]);
-  }
-  log.info(`Waiting for Agent to check-in with Fleet`);
-
-  const agent = await waitForHostToEnroll(kbnClient, vmName, 8 * 60 * 1000);
-
-  log.info(`Agent enrolled with Fleet, status: `, agent.status);
-
-  return {
-    agentId: agent.id,
-  };
-};
-
-export async function getEndpointHosts(): Promise<
-  Array<{ name: string; state: string; ipv4: string; image: string }>
-> {
-  const output = await execa('multipass', ['list', '--format', 'json']);
-  return JSON.parse(output.stdout).list;
-}
-
-export function stopEndpointHost(hostName: string) {
-  if (process.env.CI) {
-    return execa('vagrant', ['suspend'], {
-      env: {
-        VAGRANT_CWD,
-        VMNAME: hostName,
-      },
-    });
-  }
-  return execa('multipass', ['stop', hostName]);
+export async function stopEndpointHost(hostName: string): Promise<void> {
+  await getHostVmClient(hostName).stop();
 }
 
-export function startEndpointHost(hostName: string) {
-  if (process.env.CI) {
-    return execa('vagrant', ['up'], {
-      env: {
-        VAGRANT_CWD,
-      },
-    });
-  }
-  return execa('multipass', ['start', hostName]);
+export async function startEndpointHost(hostName: string): Promise<void> {
+  await getHostVmClient(hostName).start();
 }
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
index 50384b3541f5c9..f6590e5ef9e2e7 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
@@ -42,6 +42,7 @@ import {
 import { maybeCreateDockerNetwork, SERVERLESS_NODES, verifyDockerInstalled } from '@kbn/es';
 import { resolve } from 'path';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { captureCallingStack, prefixedOutputLogger } from '../utils';
 import {
   createToolingLogger,
   RETRYABLE_TRANSIENT_ERRORS,
@@ -51,6 +52,7 @@ import { isServerlessKibanaFlavor } from '../stack_services';
 import type { FormattedAxiosError } from '../format_axios_error';
 import { catchAxiosErrorFormatAndThrow } from '../format_axios_error';
 import {
+  ensureFleetSetup,
   fetchFleetOutputs,
   fetchFleetServerHostList,
   fetchFleetServerUrl,
@@ -77,6 +79,8 @@ interface StartedServer {
   url: string;
   /** Stop server */
   stop: () => Promise<void>;
+  /** Stop server synchronously. Sometimes useful when called from nodeJS unexpected exits. */
+  stopNow: () => void;
   /** Any information about the server */
   info?: string;
 }
@@ -94,24 +98,34 @@ interface StartFleetServerOptions {
   port?: number;
 }
 
-interface StartedFleetServer extends StartedServer {
-  /** The policy id that the fleet-server agent is running with */
+export interface StartedFleetServer extends StartedServer {
+  /** The Fleet Agent policy id that the fleet-server agent is running with */
   policyId: string;
 }
 
+/**
+ * Starts Fleet Server and connectors it to the stack
+ * @param kbnClient
+ * @param logger
+ * @param policy
+ * @param version
+ * @param force
+ * @param port
+ */
 export const startFleetServer = async ({
   kbnClient,
-  logger,
+  logger: _logger,
   policy,
   version,
   force = false,
   port = 8220,
 }: StartFleetServerOptions): Promise<StartedFleetServer> => {
+  const logger = prefixedOutputLogger('startFleetServer()', _logger);
+
   logger.info(`Starting Fleet Server and connecting it to Kibana`);
+  logger.debug(captureCallingStack());
 
   return logger.indent(4, async () => {
-    const isServerless = await isServerlessKibanaFlavor(kbnClient);
-
     // Check if fleet already running if `force` is false
     if (!force && (await isFleetServerRunning(kbnClient))) {
       throw new Error(
@@ -119,6 +133,9 @@ export const startFleetServer = async ({
       );
     }
 
+    await ensureFleetSetup(kbnClient, logger);
+
+    const isServerless = await isServerlessKibanaFlavor(kbnClient);
     const policyId =
       policy || !isServerless ? await getOrCreateFleetServerAgentPolicyId(kbnClient, logger) : '';
     const serviceToken = isServerless ? '' : await generateFleetServiceToken(kbnClient, logger);
@@ -138,6 +155,18 @@ export const startFleetServer = async ({
   });
 };
 
+/**
+ * Checks if fleet server is already running and if not, then it will attempt to start
+ * one and connect it to the stack
+ */
+export const startFleetServerIfNecessary = async (
+  options: StartFleetServerOptions
+): Promise<StartedFleetServer | void> => {
+  if (options.force || !(await isFleetServerRunning(options.kbnClient, options.logger))) {
+    return startFleetServer(options);
+  }
+};
+
 const getOrCreateFleetServerAgentPolicyId = async (
   kbnClient: KbnClient,
   log: ToolingLog
@@ -216,13 +245,15 @@ const startFleetServerWithDocker = async ({
   await verifyDockerInstalled(log);
 
   let agentVersion = version || (await getAgentVersionMatchingCurrentStack(kbnClient));
+  const localhostRealIp = getLocalhostRealIp();
+  const fleetServerUrl = `https://${localhostRealIp}:${port}`;
 
-  log.info(`Starting a new fleet server using Docker (version: ${agentVersion})`);
+  log.info(
+    `Starting a new fleet server using Docker\n    Agent version: ${agentVersion}\n    Server URL: ${fleetServerUrl}`
+  );
 
   const response: StartedServer = await log.indent(4, async () => {
     const isServerless = await isServerlessKibanaFlavor(kbnClient);
-    const localhostRealIp = getLocalhostRealIp();
-    const fleetServerUrl = `https://${localhostRealIp}:${port}`;
     const esURL = new URL(await getFleetElasticsearchOutputHost(kbnClient));
     const containerName = `dev-fleet-server.${port}`;
     const hostname = `dev-fleet-server.${port}.${Math.random().toString(32).substring(2, 6)}`;
@@ -239,12 +270,14 @@ const startFleetServerWithDocker = async ({
   - version adjusted to [latest] from [${agentVersion}]`);
 
       agentVersion = 'latest';
-      await maybeCreateDockerNetwork(log);
     } else {
       assert.ok(!!policyId, '`policyId` is required');
       assert.ok(!!serviceToken, '`serviceToken` is required');
     }
 
+    // Create the `elastic` network to use with all containers
+    await maybeCreateDockerNetwork(log);
+
     try {
       const dockerArgs = isServerless
         ? getFleetServerStandAloneDockerArgs({
@@ -266,7 +299,7 @@ const startFleetServerWithDocker = async ({
 
       await execa('docker', ['kill', containerName])
         .then(() => {
-          log.verbose(
+          log.info(
             `Killed an existing container with name [${containerName}]. New one will be started.`
           );
         })
@@ -294,25 +327,27 @@ const startFleetServerWithDocker = async ({
 
         await waitForFleetServerToRegisterWithElasticsearch(kbnClient, hostname, 120000);
       } else {
-        log.info('Waiting for server to show up in Kibana Fleet');
-
-        const fleetServerAgent = await waitForHostToEnroll(kbnClient, hostname, 120000);
-
-        log.verbose(`Fleet server enrolled agent:\n${JSON.stringify(fleetServerAgent, null, 2)}`);
+        await waitForHostToEnroll(kbnClient, log, hostname, 120000);
       }
 
-      fleetServerVersionInfo = (
-        await execa('docker', [
-          'exec',
-          containerName,
-          '/bin/bash',
-          '-c',
-          './elastic-agent version',
-        ]).catch((err) => {
-          log.verbose(`Failed to retrieve agent version information from running instance.`, err);
-          return { stdout: 'Unable to retrieve version information' };
-        })
-      ).stdout;
+      fleetServerVersionInfo = isServerless
+        ? // `/usr/bin/fleet-server` process does not seem to support a `--version` type of argument
+          'Running latest standalone fleet server'
+        : (
+            await execa('docker', [
+              'exec',
+              containerName,
+              '/bin/bash',
+              '-c',
+              '/usr/share/elastic-agent/elastic-agent version',
+            ]).catch((err) => {
+              log.verbose(
+                `Failed to retrieve agent version information from running instance.`,
+                err
+              );
+              return { stdout: 'Unable to retrieve version information' };
+            })
+          ).stdout;
     } catch (error) {
       log.error(dump(error));
       throw error;
@@ -335,8 +370,17 @@ Kill container:       ${chalk.cyan(`docker kill ${containerId}`)}
       url: fleetServerUrl,
       info,
       stop: async () => {
+        log.info(
+          `Stopping (kill) fleet server. Container name [${containerName}] id [${containerId}]`
+        );
         await execa('docker', ['kill', containerId]);
       },
+      stopNow: () => {
+        log.info(
+          `Stopping (kill) fleet server. Container name [${containerName}] id [${containerId}]`
+        );
+        execa.sync('docker', ['kill', containerId]);
+      },
     };
   });
 
@@ -371,6 +415,9 @@ const getFleetServerManagedDockerArgs = ({
     '--restart',
     'no',
 
+    '--net',
+    'elastic',
+
     '--add-host',
     'host.docker.internal:host-gateway',
 
@@ -494,7 +541,7 @@ const addFleetServerHostToFleetSettings = async (
       const newFleetHostEntry: PostFleetServerHostsRequest['body'] = {
         name: `Dev fleet server running on localhost`,
         host_urls: [fleetServerHostUrl],
-        is_default: !exitingFleetServerHostList.total,
+        is_default: true,
       };
 
       const { item } = await kbnClient
@@ -630,12 +677,13 @@ export const isFleetServerRunning = async (
       httpsAgent: new https.Agent({ rejectUnauthorized: false }),
     })
     .then((response) => {
-      log.verbose(`Fleet server is up and running as [${fleetServerUrl}]`, response.data);
+      log.debug(`Fleet server is up and running at [${fleetServerUrl}]. Status: `, response.data);
       return true;
     })
     .catch(catchAxiosErrorFormatAndThrow)
     .catch((e) => {
-      log.verbose(`Fleet server not up. Attempt to call [${url.toString()}] failed with:`, e);
+      log.debug(`Fleet server not up at [${fleetServerUrl}]`);
+      log.verbose(`Call to [${url.toString()}] failed with:`, e);
       return false;
     });
 };
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_services.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_services.ts
index 80825c84fb1956..26ca9d64743931 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_services.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_services.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { map, pick } from 'lodash';
+import { map, memoize, pick } from 'lodash';
 import type { Client, estypes } from '@elastic/elasticsearch';
 import type {
   Agent,
@@ -23,6 +23,7 @@ import type {
   PackagePolicy,
   GetInfoResponse,
   GetOneAgentPolicyResponse,
+  PostFleetSetupResponse,
 } from '@kbn/fleet-plugin/common';
 import {
   AGENT_API_ROUTES,
@@ -35,6 +36,7 @@ import {
   APP_API_ROUTES,
   epmRouteService,
   PACKAGE_POLICY_API_ROUTES,
+  SETUP_API_ROUTE,
 } from '@kbn/fleet-plugin/common';
 import type { ToolingLog } from '@kbn/tooling-log';
 import type { KbnClient } from '@kbn/test';
@@ -56,6 +58,7 @@ import nodeFetch from 'node-fetch';
 import semver from 'semver';
 import axios from 'axios';
 import { userInfo } from 'os';
+import { isFleetServerRunning } from './fleet_server/fleet_server_services';
 import { getEndpointPackageInfo } from '../../../common/endpoint/utils/package';
 import type { DownloadAndStoreAgentResponse } from './agent_downloads_service';
 import { downloadAndStoreAgent } from './agent_downloads_service';
@@ -72,6 +75,9 @@ import { FleetAgentGenerator } from '../../../common/endpoint/data_generators/fl
 
 const fleetGenerator = new FleetAgentGenerator();
 const CURRENT_USERNAME = userInfo().username.toLowerCase();
+const DEFAULT_AGENT_POLICY_NAME = `${CURRENT_USERNAME} test policy`;
+/** A Fleet agent policy that includes integrations that don't actually require an agent to run on a host. Example: SenttinelOne */
+export const DEFAULT_AGENTLESS_INTEGRATIONS_AGENT_POLICY_NAME = `${CURRENT_USERNAME} - agentless integrations`;
 
 export const checkInFleetAgent = async (
   esClient: Client,
@@ -151,14 +157,18 @@ export const fetchFleetAgents = async (
  * Will keep querying Fleet list of agents until the given `hostname` shows up as healthy
  *
  * @param kbnClient
+ * @param log
  * @param hostname
  * @param timeoutMs
  */
 export const waitForHostToEnroll = async (
   kbnClient: KbnClient,
+  log: ToolingLog,
   hostname: string,
   timeoutMs: number = 30000
 ): Promise<Agent> => {
+  log.info(`Waiting for host [${hostname}] to enroll with fleet`);
+
   const started = new Date();
   const hasTimedOut = (): boolean => {
     const elapsedTime = Date.now() - started.getTime();
@@ -190,14 +200,17 @@ export const waitForHostToEnroll = async (
   if (!found) {
     throw Object.assign(
       new Error(
-        `Timed out waiting for host [${hostname}] to show up in Fleet in ${
-          timeoutMs / 60 / 1000
+        `Timed out waiting for host [${hostname}] to show up in Fleet. Waited ${
+          timeoutMs / 1000
         } seconds`
       ),
       { agentId, hostname }
     );
   }
 
+  log.debug(`Host [${hostname}] has been enrolled with fleet`);
+  log.verbose(found);
+
   return found;
 };
 
@@ -544,7 +557,10 @@ export const fetchFleetOutputs = async (kbnClient: KbnClient): Promise<GetOutput
     .catch(catchAxiosErrorFormatAndThrow);
 };
 
-export const getFleetElasticsearchOutputHost = async (kbnClient: KbnClient): Promise<string> => {
+export const getFleetElasticsearchOutputHost = async (
+  kbnClient: KbnClient,
+  log: ToolingLog = createToolingLogger()
+): Promise<string> => {
   const outputs = await fetchFleetOutputs(kbnClient);
   let host: string = '';
 
@@ -555,6 +571,7 @@ export const getFleetElasticsearchOutputHost = async (kbnClient: KbnClient): Pro
   }
 
   if (!host) {
+    log.error(`Outputs returned from Fleet:\n${JSON.stringify(outputs, null, 2)}`);
     throw new Error(`An output for Elasticsearch was not found in Fleet settings`);
   }
 
@@ -578,7 +595,10 @@ interface EnrollHostVmWithFleetOptions {
 }
 
 /**
- * Installs the Elastic agent on the provided Host VM and enrolls with it Fleet
+ * Installs the Elastic agent on the provided Host VM and enrolls with it Fleet.
+ *
+ * NOTE: this method assumes that FLeet-Server is already setup and running.
+ *
  * @param hostVm
  * @param kbnClient
  * @param log
@@ -600,6 +620,10 @@ export const enrollHostVmWithFleet = async ({
 }: EnrollHostVmWithFleetOptions): Promise<Agent> => {
   log.info(`Enrolling host VM [${hostVm.name}] with Fleet`);
 
+  if (!(await isFleetServerRunning(kbnClient))) {
+    throw new Error(`Fleet server does not seem to be running on this instance of kibana!`);
+  }
+
   const agentVersion = version || (await getAgentVersionMatchingCurrentStack(kbnClient));
   const agentUrlInfo = await getAgentDownloadUrl(agentVersion, closestVersionMatch, log);
 
@@ -609,26 +633,30 @@ export const enrollHostVmWithFleet = async ({
 
   log.info(`Installing Elastic Agent`);
 
-  // Mount the directory where the agent download cache is located
-  if (useAgentCache) {
-    const hostVmDownloadsDir = '/home/ubuntu/_agent_downloads';
+  // For multipass, we need to place the Agent archive in the VM - either mounting local cache
+  // directory or downloading it directly from inside of the VM.
+  // For Vagrant, the archive is already in the VM - it was done during VM creation.
+  if (hostVm.type === 'multipass') {
+    if (useAgentCache) {
+      const hostVmDownloadsDir = '/home/ubuntu/_agent_downloads';
 
-    log.debug(
-      `Mounting agents download cache directory [${agentDownload.directory}] to Host VM at [${hostVmDownloadsDir}]`
-    );
-    const downloadsMount = await hostVm.mount(agentDownload.directory, hostVmDownloadsDir);
+      log.debug(
+        `Mounting agents download cache directory [${agentDownload.directory}] to Host VM at [${hostVmDownloadsDir}]`
+      );
+      const downloadsMount = await hostVm.mount(agentDownload.directory, hostVmDownloadsDir);
 
-    log.debug(`Extracting download archive on host VM`);
-    await hostVm.exec(`tar -zxf ${downloadsMount.hostDir}/${agentDownload.filename}`);
+      log.debug(`Extracting download archive on host VM`);
+      await hostVm.exec(`tar -zxf ${downloadsMount.hostDir}/${agentDownload.filename}`);
 
-    await downloadsMount.unmount();
-  } else {
-    log.debug(`Downloading Elastic Agent to host VM`);
-    await hostVm.exec(`curl -L ${agentDownload.url} -o ${agentDownload.filename}`);
+      await downloadsMount.unmount();
+    } else {
+      log.debug(`Downloading Elastic Agent to host VM`);
+      await hostVm.exec(`curl -L ${agentDownload.url} -o ${agentDownload.filename}`);
 
-    log.debug(`Extracting download archive on host VM`);
-    await hostVm.exec(`tar -zxf ${agentDownload.filename}`);
-    await hostVm.exec(`rm -f ${agentDownload.filename}`);
+      log.debug(`Extracting download archive on host VM`);
+      await hostVm.exec(`tar -zxf ${agentDownload.filename}`);
+      await hostVm.exec(`rm -f ${agentDownload.filename}`);
+    }
   }
 
   const policyId = agentPolicyId || (await getOrCreateDefaultAgentPolicy({ kbnClient, log })).id;
@@ -640,7 +668,7 @@ export const enrollHostVmWithFleet = async ({
   const agentEnrollCommand = [
     'sudo',
 
-    `/home/ubuntu/${agentUrlInfo.dirName}/elastic-agent`,
+    `./${agentUrlInfo.dirName}/elastic-agent`,
 
     'install',
 
@@ -660,15 +688,13 @@ export const enrollHostVmWithFleet = async ({
 
   await hostVm.exec(agentEnrollCommand);
 
-  log.info(`Waiting for Agent to check-in with Fleet`);
-  const agent = await waitForHostToEnroll(kbnClient, hostVm.name, timeoutMs);
-
-  return agent;
+  return waitForHostToEnroll(kbnClient, log, hostVm.name, timeoutMs);
 };
 
 interface GetOrCreateDefaultAgentPolicyOptions {
   kbnClient: KbnClient;
   log: ToolingLog;
+  policyName?: string;
 }
 
 /**
@@ -676,14 +702,15 @@ interface GetOrCreateDefaultAgentPolicyOptions {
  * policy already exists, then it will be reused.
  * @param kbnClient
  * @param log
+ * @param policyName
  */
 export const getOrCreateDefaultAgentPolicy = async ({
   kbnClient,
   log,
+  policyName = DEFAULT_AGENT_POLICY_NAME,
 }: GetOrCreateDefaultAgentPolicyOptions): Promise<AgentPolicy> => {
-  const agentPolicyName = `${CURRENT_USERNAME} test policy`;
   const existingPolicy = await fetchAgentPolicyList(kbnClient, {
-    kuery: `${AGENT_POLICY_SAVED_OBJECT_TYPE}.name: "${agentPolicyName}"`,
+    kuery: `${AGENT_POLICY_SAVED_OBJECT_TYPE}.name: "${policyName}"`,
   });
 
   if (existingPolicy.items[0]) {
@@ -696,13 +723,13 @@ export const getOrCreateDefaultAgentPolicy = async ({
   log.info(`Creating new default test/dev Fleet agent policy`);
 
   const newAgentPolicyData: CreateAgentPolicyRequest['body'] = {
-    name: agentPolicyName,
-    description: `Policy created by security solution tooling`,
+    name: policyName,
+    description: `Policy created by security solution tooling: ${__filename}`,
     namespace: 'default',
     monitoring_enabled: ['logs', 'metrics'],
   };
 
-  const newAgentPolicy = kbnClient
+  const newAgentPolicy = await kbnClient
     .request<CreateAgentPolicyResponse>({
       path: AGENT_POLICY_API_ROUTES.CREATE_PATTERN,
       headers: {
@@ -793,7 +820,7 @@ export const addSentinelOneIntegrationToAgentPolicy = async ({
   agentPolicyId,
   consoleUrl,
   apiToken,
-  integrationPolicyName = `SentinelOne policy (${Math.random().toString().substring(3)})`,
+  integrationPolicyName = `SentinelOne policy (${Math.random().toString().substring(2, 6)})`,
   force = false,
 }: AddSentinelOneIntegrationToAgentPolicyOptions): Promise<PackagePolicy> => {
   // If `force` is `false and agent policy already has a SentinelOne integration, exit here
@@ -1092,3 +1119,27 @@ export const addEndpointIntegrationToAgentPolicy = async ({
 
   return newIntegrationPolicy;
 };
+
+/**
+ * Calls the fleet setup API to ensure fleet configured with default settings
+ * @param kbnClient
+ * @param log
+ */
+export const ensureFleetSetup = memoize(
+  async (kbnClient: KbnClient, log: ToolingLog): Promise<PostFleetSetupResponse> => {
+    const setupResponse = await kbnClient
+      .request<PostFleetSetupResponse>({
+        path: SETUP_API_ROUTE,
+        headers: { 'Elastic-Api-Version': API_VERSIONS.public.v1 },
+        method: 'POST',
+      })
+      .catch(catchAxiosErrorFormatAndThrow);
+
+    if (!setupResponse.data.isInitialized) {
+      log.verbose(`Fleet setup response:`, setupResponse);
+      throw new Error(`Call to initialize Fleet [${SETUP_API_ROUTE}] failed`);
+    }
+
+    return setupResponse.data;
+  }
+);
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/types.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/types.ts
index 44bdcff3284013..38256f1c774bde 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/types.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/types.ts
@@ -14,8 +14,12 @@ export interface HostVm {
   exec: (command: string) => Promise<HostVmExecResponse>;
   mount: (localDir: string, hostVmDir: string) => Promise<HostVmMountResponse>;
   unmount: (hostVmDir: string) => Promise<void>;
+  /** Uploads/copies a file from the local machine to the VM */
+  transfer: (localFilePath: string, destFilePath: string) => Promise<HostVmTransferResponse>;
   destroy: () => Promise<void>;
   info: () => string;
+  stop: () => void;
+  start: () => void;
 }
 
 export type SupportedVmManager = 'multipass' | 'vagrant';
@@ -28,3 +32,9 @@ export interface HostVmMountResponse {
   hostDir: string;
   unmount: () => Promise<void>;
 }
+export interface HostVmTransferResponse {
+  /** The file path of the file on the host vm */
+  filePath: string;
+  /** Delete the file from the host VM */
+  delete: () => Promise<HostVmExecResponse>;
+}
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts
new file mode 100644
index 00000000000000..3c8e227c89271f
--- /dev/null
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/utils.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import chalk from 'chalk';
+
+/**
+ * Capture and return the calling stack for the context that called this utility.
+ */
+export const captureCallingStack = () => {
+  const s = { stack: '' };
+  Error.captureStackTrace(s);
+  return `Called from:\n${s.stack.split('\n').slice(3).join('\n')}`;
+};
+
+/**
+ * Returns a logger that intercepts calls to the ToolingLog instance methods passed in input
+ * and prefix it with the provided value. Useful in order to track log entries, especially when
+ * logging output from multiple sources is concurrently being output to the same source
+ * (ex. CI jobs and output to stdout).
+ *
+ * @param prefix
+ * @param log
+ *
+ * @example
+ * const logger = new ToolingLog();
+ * const prefixedLogger = prefixedOutputLogger('my_log', logger);
+ *
+ * prefixedLogger.info('log something'); // => info [my_log] log something
+ */
+export const prefixedOutputLogger = (prefix: string, log: ToolingLog): ToolingLog => {
+  const styledPrefix = `[${chalk.grey(prefix)}]`;
+  const logIt = (type: keyof ToolingLog, ...args: any) => {
+    return log[type](styledPrefix, ...args);
+  };
+
+  const logger: Partial<ToolingLog> = {
+    info: logIt.bind(null, 'info'),
+    debug: logIt.bind(null, 'debug'),
+    verbose: logIt.bind(null, 'verbose'),
+    success: logIt.bind(null, 'success'),
+    warning: logIt.bind(null, 'warning'),
+    write: logIt.bind(null, 'write'),
+  };
+
+  const proxy = new Proxy(log, {
+    get(target: ToolingLog, prop: keyof ToolingLog, receiver: any): any {
+      if (prop in logger) {
+        return logger[prop];
+      }
+
+      return log[prop];
+    },
+  });
+
+  return proxy;
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/Vagrantfile b/x-pack/plugins/security_solution/scripts/endpoint/common/vagrant/Vagrantfile
similarity index 76%
rename from x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/Vagrantfile
rename to x-pack/plugins/security_solution/scripts/endpoint/common/vagrant/Vagrantfile
index a6b93e8de47b5a..fd33efaeab6251 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/Vagrantfile
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/vagrant/Vagrantfile
@@ -1,3 +1,7 @@
+# ------------------------------------------------------------------------------------
+# Vagrant setup for running Elastic agent on the created VM.0
+# This setup is mostly used for CI runs, since multipass is not used in that env.
+# ------------------------------------------------------------------------------------
 hostname = ENV["VMNAME"] || 'ubuntu'
 cachedAgentSource = ENV["CACHED_AGENT_SOURCE"] || ''
 cachedAgentFilename = ENV["CACHED_AGENT_FILENAME"] || ''
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/vm_services.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/vm_services.ts
index ca0a83d2cdd41e..a0efd908f80d73 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/vm_services.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/vm_services.ts
@@ -8,10 +8,17 @@
 import type { ToolingLog } from '@kbn/tooling-log';
 import execa from 'execa';
 import chalk from 'chalk';
+import { userInfo } from 'os';
+import { join as pathJoin, dirname } from 'path';
+import type { DownloadedAgentInfo } from './agent_downloads_service';
+import { BaseDataGenerator } from '../../../common/endpoint/data_generators/base_data_generator';
 import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils';
 import type { HostVm, HostVmExecResponse, SupportedVmManager } from './types';
 
-interface BaseVmCreateOptions {
+const baseGenerator = new BaseDataGenerator();
+export const DEFAULT_VAGRANTFILE = pathJoin(__dirname, 'vagrant', 'Vagrantfile');
+
+export interface BaseVmCreateOptions {
   name: string;
   /** Number of CPUs */
   cpus?: number;
@@ -21,24 +28,21 @@ interface BaseVmCreateOptions {
   memory?: string;
 }
 
-interface CreateVmOptions extends BaseVmCreateOptions {
-  /** The type of VM manager to use when creating the VM host */
-  type: SupportedVmManager;
-  log?: ToolingLog;
-}
+type CreateVmOptions = CreateMultipassVmOptions | CreateVagrantVmOptions;
 
 /**
  * Creates a new VM
  */
-export const createVm = async ({ type, ...options }: CreateVmOptions): Promise<HostVm> => {
-  if (type === 'multipass') {
+export const createVm = async (options: CreateVmOptions): Promise<HostVm> => {
+  if (options.type === 'multipass') {
     return createMultipassVm(options);
   }
 
-  throw new Error(`VM type ${type} not yet supported`);
+  return createVagrantVm(options);
 };
 
 interface CreateMultipassVmOptions extends BaseVmCreateOptions {
+  type: SupportedVmManager & 'multipass';
   name: string;
   log?: ToolingLog;
 }
@@ -97,11 +101,13 @@ export const createMultipassHostVmClient = (
   };
 
   const unmount = async (hostVmDir: string) => {
-    await execa.command(`multipass unmount ${name}:${hostVmDir}`);
+    const response = await execa.command(`multipass unmount ${name}:${hostVmDir}`);
+    log.verbose(`multipass unmount response:\n`, response);
   };
 
   const mount = async (localDir: string, hostVmDir: string) => {
-    await execa.command(`multipass mount ${localDir} ${name}:${hostVmDir}`);
+    const response = await execa.command(`multipass mount ${localDir} ${name}:${hostVmDir}`);
+    log.verbose(`multipass mount response:\n`, response);
 
     return {
       hostDir: hostVmDir,
@@ -109,6 +115,30 @@ export const createMultipassHostVmClient = (
     };
   };
 
+  const start = async () => {
+    const response = await execa.command(`multipass start ${name}`);
+    log.verbose(`multipass start response:\n`, response);
+  };
+
+  const stop = async () => {
+    const response = await execa.command(`multipass stop ${name}`);
+    log.verbose(`multipass stop response:\n`, response);
+  };
+
+  const transfer: HostVm['transfer'] = async (localFilePath, destFilePath) => {
+    const response = await execa.command(
+      `multipass transfer ${localFilePath} ${name}:${destFilePath}`
+    );
+    log.verbose(`Transferred file to VM [${name}]:`, response);
+
+    return {
+      filePath: destFilePath,
+      delete: async () => {
+        return exec(`rm ${destFilePath}`);
+      },
+    };
+  };
+
   return {
     type: 'multipass',
     name,
@@ -117,5 +147,233 @@ export const createMultipassHostVmClient = (
     info,
     mount,
     unmount,
+    transfer,
+    start,
+    stop,
   };
 };
+
+/**
+ * Generates a unique Virtual Machine name using the current user's `username`
+ * @param identifier
+ */
+export const generateVmName = (identifier: string = baseGenerator.randomUser()): string => {
+  return `${userInfo().username.toLowerCase().replaceAll('.', '-')}-${identifier
+    .toLowerCase()
+    .replace('.', '-')}-${Math.random().toString().substring(2, 6)}`;
+};
+
+/**
+ * Checks if the count of VM running under Multipass is greater than the `threshold` passed on
+ * input and if so, it will return a message indicate so. Useful to remind users of the amount of
+ * VM currently running.
+ * @param threshold
+ */
+export const getMultipassVmCountNotice = async (threshold: number = 1): Promise<string> => {
+  const response = await execa.command(`multipass list --format=json`);
+
+  const output: { list: Array<{ ipv4: string; name: string; release: string; state: string }> } =
+    JSON.parse(response.stdout);
+
+  if (output.list.length > threshold) {
+    return `-----------------------------------------------------------------
+${chalk.red('NOTE:')} ${chalk.bold(
+      chalk.cyan(`You currently have ${chalk.red(output.list.length)} VMs running.`)
+    )} Remember to delete those
+      no longer being used.
+      View running VMs: ${chalk.bold('multipass list')}
+  -----------------------------------------------------------------
+`;
+  }
+
+  return '';
+};
+
+interface CreateVagrantVmOptions extends BaseVmCreateOptions {
+  type: SupportedVmManager & 'vagrant';
+
+  name: string;
+  /**
+   * The downloaded agent information. The Agent file will be uploaded to the Vagrant VM and
+   * made available under the default login home directory (`~/agent-filename`)
+   */
+  agentDownload: DownloadedAgentInfo;
+  /**
+   * The path to the Vagrantfile to use to provision the VM. Defaults to Vagrantfile under:
+   * `x-pack/plugins/security_solution/scripts/endpoint/common/vagrant/Vagrantfile`
+   */
+  vagrantFile?: string;
+  log?: ToolingLog;
+}
+
+/**
+ * Creates a new VM using `vagrant`
+ */
+const createVagrantVm = async ({
+  name,
+  log = createToolingLogger(),
+  agentDownload: { fullFilePath: agentFullFilePath, filename: agentFileName },
+  vagrantFile = DEFAULT_VAGRANTFILE,
+  memory,
+  cpus,
+  disk,
+}: CreateVagrantVmOptions): Promise<HostVm> => {
+  log.debug(`Using Vagrantfile: ${vagrantFile}`);
+
+  const VAGRANT_CWD = dirname(vagrantFile);
+
+  // Destroy the VM running (if any) with the provided vagrant file before re-creating it
+  try {
+    await execa.command(`vagrant destroy -f`, {
+      env: {
+        VAGRANT_CWD,
+      },
+      // Only `pipe` STDERR to parent process
+      stdio: ['inherit', 'inherit', 'pipe'],
+    });
+    // eslint-disable-next-line no-empty
+  } catch (e) {}
+
+  if (memory || cpus || disk) {
+    log.warning(
+      `cpu, memory and disk options ignored for creation of vm via Vagrant. These should be defined in the Vagrantfile`
+    );
+  }
+
+  try {
+    const vagrantUpResponse = (
+      await execa.command(`vagrant up`, {
+        env: {
+          VAGRANT_DISABLE_VBOXSYMLINKCREATE: '1',
+          VAGRANT_CWD,
+          VMNAME: name,
+          CACHED_AGENT_SOURCE: agentFullFilePath,
+          CACHED_AGENT_FILENAME: agentFileName,
+        },
+        // Only `pipe` STDERR to parent process
+        stdio: ['inherit', 'inherit', 'pipe'],
+      })
+    ).stdout;
+
+    log.debug(`Vagrant up command response: `, vagrantUpResponse);
+  } catch (e) {
+    log.error(e);
+    throw e;
+  }
+
+  return createVagrantHostVmClient(name, undefined, log);
+};
+
+/**
+ * Creates a generic interface (`HotVm`) for interacting with a VM created by Vagrant
+ * @param name
+ * @param log
+ * @param vagrantFile
+ */
+export const createVagrantHostVmClient = (
+  name: string,
+  vagrantFile: string = DEFAULT_VAGRANTFILE,
+  log: ToolingLog = createToolingLogger()
+): HostVm => {
+  const VAGRANT_CWD = dirname(vagrantFile);
+  const execaOptions: execa.Options = {
+    env: {
+      VAGRANT_CWD,
+    },
+    stdio: ['inherit', 'pipe', 'pipe'],
+  };
+
+  log.debug(`Creating Vagrant VM client for [${name}] with vagrantfile [${vagrantFile}]`);
+
+  const exec = async (command: string): Promise<HostVmExecResponse> => {
+    const execResponse = await execa.command(`vagrant ssh -- ${command}`, execaOptions);
+
+    log.verbose(execResponse);
+
+    return {
+      stdout: execResponse.stdout,
+      stderr: execResponse.stderr,
+      exitCode: execResponse.exitCode,
+    };
+  };
+
+  const destroy = async (): Promise<void> => {
+    const destroyResponse = await execa.command(`vagrant destroy -f`, execaOptions);
+
+    log.debug(`VM [${name}] was destroyed successfully`, destroyResponse);
+  };
+
+  const info = () => {
+    return `VM created using Vagrant.
+  VM Name: ${name}
+
+  Shell access: ${chalk.cyan(`vagrant ssh ${name}`)}
+  Delete VM:    ${chalk.cyan(`vagrant destroy ${name} -f`)}
+`;
+  };
+
+  const unmount = async (_: string) => {
+    throw new Error('VM action `unmount`` not currently supported for vagrant');
+  };
+
+  const mount = async (_: string, __: string) => {
+    throw new Error('VM action `mount` not currently supported for vagrant');
+  };
+
+  const start = async () => {
+    const response = await execa.command(`vagrant up`, execaOptions);
+    log.verbose('vagrant up response:\n', response);
+  };
+
+  const stop = async () => {
+    const response = await execa.command(`vagrant suspend`, execaOptions);
+    log.verbose('vagrant suspend response:\n', response);
+  };
+
+  const transfer: HostVm['transfer'] = async (localFilePath, destFilePath) => {
+    const response = await execa.command(
+      `vagrant upload ${localFilePath} ${destFilePath}`,
+      execaOptions
+    );
+    log.verbose(`Transferred file to VM [${name}]:`, response);
+
+    return {
+      filePath: destFilePath,
+      delete: async () => {
+        return exec(`rm ${destFilePath}`);
+      },
+    };
+  };
+
+  return {
+    type: 'vagrant',
+    name,
+    exec,
+    destroy,
+    info,
+    mount,
+    unmount,
+    transfer,
+    start,
+    stop,
+  };
+};
+
+/**
+ * create and return a Host VM client client
+ * @param hostname
+ * @param type
+ * @param vagrantFile
+ * @param log
+ */
+export const getHostVmClient = (
+  hostname: string,
+  type: SupportedVmManager = process.env.CI ? 'vagrant' : 'multipass',
+  /** Will only be used if `type` is `vagrant` */
+  vagrantFile: string = DEFAULT_VAGRANTFILE,
+  log: ToolingLog = createToolingLogger()
+): HostVm => {
+  return type === 'vagrant'
+    ? createVagrantHostVmClient(hostname, vagrantFile, log)
+    : createMultipassHostVmClient(hostname, log);
+};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/elastic_endpoint.ts b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/elastic_endpoint.ts
index 0c07013f8c7b7a..e569580eb73578 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/elastic_endpoint.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/elastic_endpoint.ts
@@ -5,9 +5,7 @@
  * 2.0.
  */
 
-import { userInfo } from 'os';
-import execa from 'execa';
-import chalk from 'chalk';
+import { generateVmName } from '../common/vm_services';
 import { createAndEnrollEndpointHost } from '../common/endpoint_host_services';
 import {
   addEndpointIntegrationToAgentPolicy,
@@ -18,6 +16,7 @@ import { dump } from './utils';
 
 export const enrollEndpointHost = async (): Promise<string | undefined> => {
   let vmName;
+
   const {
     log,
     kbnClient,
@@ -28,8 +27,6 @@ export const enrollEndpointHost = async (): Promise<string | undefined> => {
   log.indent(4);
 
   try {
-    const uniqueId = Math.random().toString().substring(2, 6);
-    const username = userInfo().username.toLowerCase().replaceAll('.', '-'); // Multipass doesn't like periods in username
     const policyId: string = policy || (await getOrCreateAgentPolicyId());
 
     if (!policyId) {
@@ -40,11 +37,11 @@ export const enrollEndpointHost = async (): Promise<string | undefined> => {
       throw new Error(`No 'version' specified`);
     }
 
-    vmName = `${username}-dev-${uniqueId}`;
+    vmName = generateVmName('dev');
 
     log.info(`Creating VM named: ${vmName}`);
 
-    await createAndEnrollEndpointHost({
+    const { hostVm } = await createAndEnrollEndpointHost({
       kbnClient,
       log,
       hostname: vmName,
@@ -54,23 +51,7 @@ export const enrollEndpointHost = async (): Promise<string | undefined> => {
       disk: '8G',
     });
 
-    if (process.env.CI) {
-      log.info(`VM created using Vagrant.
-      VM Name: ${vmName}
-      Elastic Agent Version: ${version}
-
-      Shell access: ${chalk.bold(`vagrant ssh ${vmName}`)}
-      Delete VM:    ${chalk.bold(`vagrant destroy ${vmName} -f`)}
-  `);
-    } else {
-      log.info(`VM created using Multipass.
-        VM Name: ${vmName}
-        Elastic Agent Version: ${version}
-
-        Shell access: ${chalk.bold(`multipass shell ${vmName}`)}
-        Delete VM:    ${chalk.bold(`multipass delete -p ${vmName}${await getVmCountNotice()}`)}
-    `);
-    }
+    log.info(hostVm.info());
   } catch (error) {
     log.error(dump(error));
     log.indent(-4);
@@ -90,25 +71,3 @@ const getOrCreateAgentPolicyId = async (): Promise<string> => {
 
   return agentPolicy.id;
 };
-
-const getVmCountNotice = async (threshold: number = 1): Promise<string> => {
-  const response = await execa.command(`multipass list --format=json`);
-
-  const output: { list: Array<{ ipv4: string; name: string; release: string; state: string }> } =
-    JSON.parse(response.stdout);
-
-  if (output.list.length > threshold) {
-    return `
-
------------------------------------------------------------------
-${chalk.red('NOTE:')} ${chalk.bold(
-      `You currently have ${output.list.length} VMs running.`
-    )} Remember to delete those
-      no longer being used.
-      View running VMs: ${chalk.bold('multipass list')}
-  -----------------------------------------------------------------
-`;
-  }
-
-  return '';
-};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/fleet_server.ts b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/fleet_server.ts
deleted file mode 100644
index ec13f2f6ff1b18..00000000000000
--- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/fleet_server.ts
+++ /dev/null
@@ -1,506 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  CA_TRUSTED_FINGERPRINT,
-  FLEET_SERVER_CERT_PATH,
-  FLEET_SERVER_KEY_PATH,
-  fleetServerDevServiceAccount,
-} from '@kbn/dev-utils';
-import type {
-  AgentPolicy,
-  CreateAgentPolicyResponse,
-  GetPackagePoliciesResponse,
-  Output,
-  PackagePolicy,
-} from '@kbn/fleet-plugin/common';
-import {
-  AGENT_POLICY_API_ROUTES,
-  API_VERSIONS,
-  APP_API_ROUTES,
-  FLEET_SERVER_PACKAGE,
-  PACKAGE_POLICY_API_ROUTES,
-  PACKAGE_POLICY_SAVED_OBJECT_TYPE,
-} from '@kbn/fleet-plugin/common';
-import type {
-  FleetServerHost,
-  GenerateServiceTokenResponse,
-  GetOneOutputResponse,
-  GetOutputsResponse,
-  PutOutputRequest,
-} from '@kbn/fleet-plugin/common/types';
-import {
-  fleetServerHostsRoutesService,
-  outputRoutesService,
-} from '@kbn/fleet-plugin/common/services';
-import execa from 'execa';
-import type {
-  PostFleetServerHostsRequest,
-  PostFleetServerHostsResponse,
-} from '@kbn/fleet-plugin/common/types/rest_spec/fleet_server_hosts';
-import chalk from 'chalk';
-import { maybeCreateDockerNetwork, SERVERLESS_NODES, verifyDockerInstalled } from '@kbn/es';
-import { FLEET_SERVER_CUSTOM_CONFIG } from '../common/fleet_server/fleet_server_services';
-import { isServerlessKibanaFlavor } from '../common/stack_services';
-import type { FormattedAxiosError } from '../common/format_axios_error';
-import { catchAxiosErrorFormatAndThrow } from '../common/format_axios_error';
-import { isLocalhost } from '../common/is_localhost';
-import { dump } from './utils';
-import { fetchFleetServerUrl, waitForHostToEnroll } from '../common/fleet_services';
-import { getRuntimeServices } from './runtime';
-
-export const runFleetServerIfNeeded = async (): Promise<
-  { fleetServerContainerId: string; fleetServerAgentPolicyId: string | undefined } | undefined
-> => {
-  let fleetServerContainerId;
-  let fleetServerAgentPolicyId;
-  let serviceToken;
-
-  const {
-    log,
-    kibana: { isLocalhost: isKibanaOnLocalhost },
-    kbnClient,
-  } = getRuntimeServices();
-
-  log.info(`Setting up fleet server (if necessary)`);
-  log.indent(4);
-  const isServerless = await isServerlessKibanaFlavor(kbnClient);
-
-  await verifyDockerInstalled(log);
-  await maybeCreateDockerNetwork(log);
-
-  try {
-    if (isServerless) {
-      fleetServerContainerId = await startFleetServerStandAloneWithDocker();
-    } else {
-      fleetServerAgentPolicyId = await getOrCreateFleetServerAgentPolicyId();
-      serviceToken = await generateFleetServiceToken();
-      if (isKibanaOnLocalhost) {
-        await configureFleetIfNeeded();
-      }
-      fleetServerContainerId = await startFleetServerWithDocker({
-        policyId: fleetServerAgentPolicyId,
-        serviceToken,
-      });
-    }
-  } catch (error) {
-    log.error(dump(error));
-    log.indent(-4);
-    throw error;
-  }
-
-  log.indent(-4);
-
-  return { fleetServerContainerId, fleetServerAgentPolicyId };
-};
-
-const getFleetServerPackagePolicy = async (): Promise<PackagePolicy | undefined> => {
-  const { kbnClient } = getRuntimeServices();
-
-  return kbnClient
-    .request<GetPackagePoliciesResponse>({
-      method: 'GET',
-      path: PACKAGE_POLICY_API_ROUTES.LIST_PATTERN,
-      headers: {
-        'elastic-api-version': API_VERSIONS.public.v1,
-      },
-      query: {
-        perPage: 1,
-        kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: "${FLEET_SERVER_PACKAGE}"`,
-      },
-    })
-    .then((response) => response.data.items[0]);
-};
-
-const getOrCreateFleetServerAgentPolicyId = async (): Promise<string> => {
-  const { log, kbnClient } = getRuntimeServices();
-
-  const existingFleetServerIntegrationPolicy = await getFleetServerPackagePolicy();
-
-  if (existingFleetServerIntegrationPolicy) {
-    log.verbose(
-      `Found existing Fleet Server Policy: ${JSON.stringify(
-        existingFleetServerIntegrationPolicy,
-        null,
-        2
-      )}`
-    );
-    log.info(
-      `Using existing Fleet Server agent policy id: ${existingFleetServerIntegrationPolicy.policy_id}`
-    );
-
-    return existingFleetServerIntegrationPolicy.policy_id;
-  }
-
-  log.info(`Creating new Fleet Server policy`);
-
-  const createdFleetServerPolicy: AgentPolicy = await kbnClient
-    .request<CreateAgentPolicyResponse>({
-      method: 'POST',
-      path: AGENT_POLICY_API_ROUTES.CREATE_PATTERN,
-      headers: {
-        'elastic-api-version': API_VERSIONS.public.v1,
-      },
-      body: {
-        name: `Fleet Server policy (${Math.random().toString(32).substring(2)})`,
-        description: `Created by CLI Tool via: ${__filename}`,
-        namespace: 'default',
-        monitoring_enabled: ['logs', 'metrics'],
-        // This will ensure the Fleet Server integration policy
-        // is also created and added to the agent policy
-        has_fleet_server: true,
-      },
-    })
-    .then((response) => response.data.item);
-
-  log.indent(4);
-  log.info(
-    `Agent Policy created: ${createdFleetServerPolicy.name} (${createdFleetServerPolicy.id})`
-  );
-  log.verbose(createdFleetServerPolicy);
-  log.indent(-4);
-
-  return createdFleetServerPolicy.id;
-};
-
-const generateFleetServiceToken = async (): Promise<string> => {
-  const { kbnClient, log } = getRuntimeServices();
-
-  const serviceToken: string = await kbnClient
-    .request<GenerateServiceTokenResponse>({
-      method: 'POST',
-      path: APP_API_ROUTES.GENERATE_SERVICE_TOKEN_PATTERN,
-      headers: {
-        'elastic-api-version': API_VERSIONS.public.v1,
-      },
-      body: {},
-    })
-    .then((response) => response.data.value);
-
-  log.info(`New service token created.`);
-
-  return serviceToken;
-};
-
-export const startFleetServerWithDocker = async ({
-  policyId,
-  serviceToken,
-}: {
-  policyId: string;
-  serviceToken: string;
-}) => {
-  let containerId;
-  const {
-    log,
-    localhostRealIp,
-    elastic: { url: elasticUrl, isLocalhost: isElasticOnLocalhost },
-    fleetServer: { port: fleetServerPort },
-    kbnClient,
-    options: { version },
-  } = getRuntimeServices();
-
-  log.info(`Starting a new fleet server using Docker`);
-  log.indent(4);
-
-  const esURL = new URL(elasticUrl);
-  const containerName = `dev-fleet-server.${fleetServerPort}`;
-  let esUrlWithRealIp: string = elasticUrl;
-
-  if (isElasticOnLocalhost) {
-    esURL.hostname = localhostRealIp;
-    esUrlWithRealIp = esURL.toString();
-  }
-
-  try {
-    const dockerArgs = [
-      'run',
-      '--restart',
-      'no',
-      '--net',
-      'elastic',
-      '--add-host',
-      'host.docker.internal:host-gateway',
-      '--rm',
-      '--detach',
-      '--name',
-      containerName,
-      // The container's hostname will appear in Fleet when the agent enrolls
-      '--hostname',
-      containerName,
-      '--env',
-      'FLEET_SERVER_ENABLE=1',
-      '--env',
-      `FLEET_SERVER_ELASTICSEARCH_HOST=${esUrlWithRealIp}`,
-      '--env',
-      `FLEET_SERVER_SERVICE_TOKEN=${serviceToken}`,
-      '--env',
-      `FLEET_SERVER_POLICY=${policyId}`,
-      '--publish',
-      `${fleetServerPort}:8220`,
-      `docker.elastic.co/beats/elastic-agent:${version}`,
-    ];
-
-    await execa('docker', ['kill', containerName])
-      .then(() => {
-        log.verbose(
-          `Killed an existing container with name [${containerName}]. New one will be started.`
-        );
-      })
-      .catch((error) => {
-        log.verbose(`Attempt to kill currently running fleet-server container (if any) with name [${containerName}] was unsuccessful:
-  ${error}
-(This is ok if one was not running already)`);
-      });
-
-    await addFleetServerHostToFleetSettings(`https://${localhostRealIp}:${fleetServerPort}`);
-
-    log.verbose(`docker arguments:\n${dockerArgs.join(' ')}`);
-
-    containerId = (await execa('docker', dockerArgs)).stdout;
-
-    const fleetServerAgent = await waitForHostToEnroll(kbnClient, containerName, 120000);
-
-    log.verbose(`Fleet server enrolled agent:\n${JSON.stringify(fleetServerAgent, null, 2)}`);
-
-    log.info(`Done. Fleet Server is running and connected to Fleet.
-  Container Name: ${containerName}
-  Container Id:   ${containerId}
-
-  View running output:  ${chalk.bold(`docker attach ---sig-proxy=false ${containerName}`)}
-  Shell access:         ${chalk.bold(`docker exec -it ${containerName} /bin/bash`)}
-  Kill container:       ${chalk.bold(`docker kill ${containerId}`)}
-`);
-  } catch (error) {
-    log.error(dump(error));
-    log.indent(-4);
-    throw error;
-  }
-
-  log.indent(-4);
-
-  return containerId;
-};
-
-export const startFleetServerStandAloneWithDocker = async () => {
-  let containerId;
-  const {
-    log,
-    elastic: { url: elasticUrl },
-    fleetServer: { port: fleetServerPort },
-  } = getRuntimeServices();
-
-  log.info(`Starting a new fleet server using Docker`);
-  log.indent(4);
-  const esURL = new URL(elasticUrl);
-
-  esURL.hostname = SERVERLESS_NODES[0].name;
-
-  const esUrlWithRealIp = esURL.toString();
-
-  const containerName = `dev-fleet-server.${fleetServerPort}`;
-  try {
-    const dockerArgs = [
-      'run',
-      '--restart',
-      'no',
-      '--net',
-      'elastic',
-      '--add-host',
-      'host.docker.internal:host-gateway',
-      '--rm',
-      '--detach',
-      '--name',
-      containerName,
-      // The container's hostname will appear in Fleet when the agent enrolls
-      '--hostname',
-      containerName,
-      '--volume',
-      `${FLEET_SERVER_CERT_PATH}:/fleet-server.crt`,
-      '--volume',
-      `${FLEET_SERVER_KEY_PATH}:/fleet-server.key`,
-      '--env',
-      'FLEET_SERVER_CERT=/fleet-server.crt',
-      '--env',
-      'FLEET_SERVER_CERT_KEY=/fleet-server.key',
-      '--env',
-      `ELASTICSEARCH_HOSTS=${esUrlWithRealIp}`,
-      '--env',
-      `ELASTICSEARCH_SERVICE_TOKEN=${fleetServerDevServiceAccount.token}`,
-      '--env',
-      `ELASTICSEARCH_CA_TRUSTED_FINGERPRINT=${CA_TRUSTED_FINGERPRINT}`,
-      '--volume',
-      `${FLEET_SERVER_CUSTOM_CONFIG}:/etc/fleet-server.yml:ro`,
-      '--publish',
-      `${fleetServerPort}:8220`,
-      `docker.elastic.co/observability-ci/fleet-server:latest`,
-    ];
-
-    await execa('docker', ['kill', containerName])
-      .then(() => {
-        log.verbose(
-          `Killed an existing container with name [${containerName}]. New one will be started.`
-        );
-      })
-      .catch((error) => {
-        log.verbose(`Attempt to kill currently running fleet-server container (if any) with name [${containerName}] was unsuccessful:
-  ${error}
-(This is ok if one was not running already)`);
-      });
-
-    log.verbose(`docker arguments:\n${dockerArgs.join(' ')}`);
-
-    containerId = (await execa('docker', dockerArgs)).stdout;
-
-    log.info(`Done. Fleet Server Stand Alone is running and connected to Fleet.
-  Container Name: ${containerName}
-  Container Id:   ${containerId}
-
-  View running output:  ${chalk.bold(`docker attach ---sig-proxy=false ${containerName}`)}
-  Shell access:         ${chalk.bold(`docker exec -it ${containerName} /bin/bash`)}
-  Kill container:       ${chalk.bold(`docker kill ${containerId}`)}
-`);
-  } catch (error) {
-    log.error(dump(error));
-    log.indent(-4);
-    throw error;
-  }
-
-  log.indent(-4);
-
-  return containerId;
-};
-
-const configureFleetIfNeeded = async () => {
-  const { log, kbnClient, localhostRealIp } = getRuntimeServices();
-
-  log.info('Checking if Fleet needs to be configured');
-  log.indent(4);
-
-  try {
-    // make sure that all ES hostnames are using localhost real IP
-    const fleetOutputs = await kbnClient
-      .request<GetOutputsResponse>({
-        method: 'GET',
-        headers: {
-          'elastic-api-version': API_VERSIONS.public.v1,
-        },
-        path: outputRoutesService.getListPath(),
-      })
-      .then((response) => response.data);
-
-    for (const { id, ...output } of fleetOutputs.items) {
-      if (output.type === 'elasticsearch') {
-        if (output.hosts) {
-          let needsUpdating = false;
-          const updatedHosts: Output['hosts'] = [];
-
-          for (const host of output.hosts) {
-            const hostURL = new URL(host);
-
-            if (isLocalhost(hostURL.hostname)) {
-              needsUpdating = true;
-              hostURL.hostname = localhostRealIp;
-              updatedHosts.push(hostURL.toString());
-
-              log.verbose(
-                `Fleet Settings for Elasticsearch Output [Name: ${
-                  output.name
-                } (id: ${id})]: Host [${host}] updated to [${hostURL.toString()}]`
-              );
-            } else {
-              updatedHosts.push(host);
-            }
-          }
-
-          if (needsUpdating) {
-            const update: PutOutputRequest['body'] = {
-              ...(output as PutOutputRequest['body']), // cast needed to quite TS - looks like the types for Output in fleet differ a bit between create/update
-              hosts: updatedHosts,
-            };
-
-            log.info(`Updating Fleet Settings for Output [${output.name} (${id})]`);
-
-            await kbnClient
-              .request<GetOneOutputResponse>({
-                method: 'PUT',
-                headers: {
-                  'elastic-api-version': API_VERSIONS.public.v1,
-                },
-                path: outputRoutesService.getUpdatePath(id),
-                body: update,
-              })
-              .catch(catchAxiosErrorFormatAndThrow);
-          }
-        }
-      }
-    }
-  } catch (error) {
-    log.error(dump(error));
-    log.indent(-4);
-    throw error;
-  }
-
-  log.indent(-4);
-};
-
-const addFleetServerHostToFleetSettings = async (
-  fleetServerHostUrl: string
-): Promise<FleetServerHost> => {
-  const { kbnClient, log } = getRuntimeServices();
-
-  log.info(`Updating Fleet with new fleet server host: ${fleetServerHostUrl}`);
-  log.indent(4);
-
-  try {
-    const exitingFleetServerHostUrl = await fetchFleetServerUrl(kbnClient);
-
-    const newFleetHostEntry: PostFleetServerHostsRequest['body'] = {
-      name: `Dev fleet server running on localhost`,
-      host_urls: [fleetServerHostUrl],
-      is_default: !exitingFleetServerHostUrl,
-    };
-
-    const { item } = await kbnClient
-      .request<PostFleetServerHostsResponse>({
-        method: 'POST',
-        path: fleetServerHostsRoutesService.getCreatePath(),
-        headers: {
-          'elastic-api-version': API_VERSIONS.public.v1,
-        },
-        body: newFleetHostEntry,
-      })
-      .catch(catchAxiosErrorFormatAndThrow)
-      .catch((error: FormattedAxiosError) => {
-        if (
-          error.response.status === 403 &&
-          ((error.response?.data?.message as string) ?? '').includes('disabled')
-        ) {
-          log.error(`Update failed with [403: ${error.response.data.message}].
-
-${chalk.red('Are you running this utility against a Serverless project?')}
-If so, the following entry should be added to your local
-'config/serverless.[project_type].dev.yml' (ex. 'serverless.security.dev.yml'):
-
-${chalk.bold(chalk.cyan('xpack.fleet.internal.fleetServerStandalone: false'))}
-
-`);
-        }
-
-        throw error;
-      })
-      .then((response) => response.data);
-
-    log.verbose(item);
-    log.indent(-4);
-
-    return item;
-  } catch (error) {
-    log.error(dump(error));
-    log.indent(-4);
-    throw error;
-  }
-};
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/index.ts
index 5e596c0c51a766..51fb0ea3b51488 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/index.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/index.ts
@@ -47,7 +47,6 @@ export const cli = () => {
         default: {
           kibanaUrl: 'http://127.0.0.1:5601',
           elasticUrl: 'http://127.0.0.1:9200',
-          fleetServerUrl: 'https://127.0.0.1:8220',
           username: 'elastic',
           password: 'changeme',
           version: '',
@@ -65,7 +64,6 @@ export const cli = () => {
         --password          Optional. Password associated with the username (Default: changeme)
         --kibanaUrl         Optional. The url to Kibana (Default: http://127.0.0.1:5601)
         --elasticUrl        Optional. The url to Elasticsearch (Default: http://127.0.0.1:9200)
-        --fleetServerUrl    Optional. The url to Fleet Server (Default: https://127.0.0.1:8220)
       `,
       },
     }
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/setup.ts b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/setup.ts
index 18ef51a35bcca3..c851b6ee34dbeb 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/setup.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/setup.ts
@@ -5,18 +5,23 @@
  * 2.0.
  */
 
-import { runFleetServerIfNeeded } from './fleet_server';
-import { startRuntimeServices, stopRuntimeServices } from './runtime';
+import { getRuntimeServices, startRuntimeServices, stopRuntimeServices } from './runtime';
 import { checkDependencies } from './pre_check';
 import { enrollEndpointHost } from './elastic_endpoint';
 import type { StartRuntimeServicesOptions } from './types';
+import { startFleetServerIfNecessary } from '../common/fleet_server/fleet_server_services';
 
 export const setupAll = async (options: StartRuntimeServicesOptions) => {
   await startRuntimeServices(options);
 
+  const { kbnClient, log } = getRuntimeServices();
+
   await checkDependencies();
 
-  await runFleetServerIfNeeded();
+  await startFleetServerIfNecessary({
+    kbnClient,
+    logger: log,
+  });
 
   await enrollEndpointHost();
 
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
index a5aec7a52aec94..3fad8bf0223bb7 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/sentinelone_host/index.ts
@@ -7,27 +7,37 @@
 
 import type { RunFn } from '@kbn/dev-cli-runner';
 import { run } from '@kbn/dev-cli-runner';
-import { userInfo } from 'os';
 import { ok } from 'assert';
+import {
+  isFleetServerRunning,
+  startFleetServer,
+} from '../common/fleet_server/fleet_server_services';
+import type { HostVm } from '../common/types';
 import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils';
 import {
   addSentinelOneIntegrationToAgentPolicy,
+  DEFAULT_AGENTLESS_INTEGRATIONS_AGENT_POLICY_NAME,
+  enrollHostVmWithFleet,
+  fetchAgentPolicy,
   getOrCreateDefaultAgentPolicy,
 } from '../common/fleet_services';
 import { installSentinelOneAgent, S1Client } from './common';
-import { createVm } from '../common/vm_services';
-import { createRuntimeServices } from '../common/stack_services';
+import { createVm, generateVmName, getMultipassVmCountNotice } from '../common/vm_services';
+import { createKbnClient } from '../common/stack_services';
 
 export const cli = async () => {
   // TODO:PT add support for CPU, Disk and Memory input args
 
   return run(runCli, {
-    description:
-      'Creates a new VM and runs both SentinelOne agent and elastic agent with the SentinelOne integration',
+    description: `Sets up the kibana system so that SentinelOne hosts data can be be streamed to Elasticsearch.
+It will first setup a host VM that runs the SentinelOne agent on it. This VM will ensure that data is being
+created in SentinelOne.
+It will then also setup a second VM (if necessary) that runs Elastic Agent along with the SentinelOne integration
+policy (an agent-less integration) - this is the process that then connects to the SentinelOne management
+console and pushes the data to Elasticsearch.`,
     flags: {
       string: [
         'kibanaUrl',
-        'elasticUrl',
         'username',
         'password',
         'version',
@@ -36,29 +46,28 @@ export const cli = async () => {
         's1ApiToken',
         'vmName',
       ],
-      boolean: ['force'],
+      boolean: ['forceFleetServer'],
       default: {
         kibanaUrl: 'http://127.0.0.1:5601',
-        elasticUrl: 'http://127.0.0.1:9200',
         username: 'elastic',
         password: 'changeme',
-        version: '',
         policy: '',
-        force: false,
       },
       help: `
       --s1Url             Required. The base URL for SentinelOne management console.
                           Ex: https://usea1-partners.sentinelone.net (valid as of Oct. 2023)
       --s1ApiToken        Required. The API token for SentinelOne
-      --vmName            Optional. The name for the VM
+      --vmName            Optional. The name for the VM.
+                          Default: [current login user name]-sentinelone-[unique number]
       --policy            Optional. The UUID of the Fleet Agent Policy that should be used to setup
                           the SentinelOne Integration
                           Default: re-uses existing dev policy (if found) or creates a new one
+      --forceFleetServer  Optional. If fleet server should be started/configured even if it seems
+                          like it is already setup.
       --username          Optional. User name to be used for auth against elasticsearch and
                           kibana (Default: elastic).
       --password          Optional. Password associated with the username (Default: changeme)
       --kibanaUrl         Optional. The url to Kibana (Default: http://127.0.0.1:5601)
-      --elasticUrl        Optional. The url to Elasticsearch (Default: http://127.0.0.1:9200)
 `,
     },
   });
@@ -68,38 +77,24 @@ const runCli: RunFn = async ({ log, flags }) => {
   const username = flags.username as string;
   const password = flags.password as string;
   const kibanaUrl = flags.kibanaUrl as string;
-  const elasticUrl = flags.elasticUrl as string;
   const s1Url = flags.s1Url as string;
   const s1ApiToken = flags.s1ApiToken as string;
   const policy = flags.policy as string;
-
-  createToolingLogger.defaultLogLevel = flags.verbose
-    ? 'verbose'
-    : flags.debug
-    ? 'debug'
-    : flags.silent
-    ? 'silent'
-    : flags.quiet
-    ? 'error'
-    : 'info';
-
+  const forceFleetServer = flags.forceFleetServer as boolean;
   const getRequiredArgMessage = (argName: string) => `${argName} argument is required`;
 
+  createToolingLogger.setDefaultLogLevelFromCliFlags(flags);
+
   ok(s1Url, getRequiredArgMessage('s1Url'));
   ok(s1ApiToken, getRequiredArgMessage('s1ApiToken'));
 
-  const vmName =
-    (flags.vmName as string) ||
-    `${userInfo().username.toLowerCase().replaceAll('.', '-')}-sentinelone-${Math.random()
-      .toString()
-      .substring(2, 6)}`;
+  const vmName = (flags.vmName as string) || generateVmName('sentinelone');
   const s1Client = new S1Client({ url: s1Url, apiToken: s1ApiToken, log });
-  const { kbnClient } = await createRuntimeServices({
-    kibanaUrl,
-    elasticsearchUrl: elasticUrl,
+  const kbnClient = createKbnClient({
+    log,
+    url: kibanaUrl,
     username,
     password,
-    log,
   });
 
   const hostVm = await createVm({
@@ -116,7 +111,17 @@ const runCli: RunFn = async ({ log, flags }) => {
     s1Client,
   });
 
-  const agentPolicyId = policy || (await getOrCreateDefaultAgentPolicy({ kbnClient, log })).id;
+  const {
+    id: agentPolicyId,
+    agents = 0,
+    name: agentPolicyName,
+  } = policy
+    ? await fetchAgentPolicy(kbnClient, policy)
+    : await getOrCreateDefaultAgentPolicy({
+        kbnClient,
+        log,
+        policyName: DEFAULT_AGENTLESS_INTEGRATIONS_AGENT_POLICY_NAME,
+      });
 
   await addSentinelOneIntegrationToAgentPolicy({
     kbnClient,
@@ -126,10 +131,42 @@ const runCli: RunFn = async ({ log, flags }) => {
     apiToken: s1ApiToken,
   });
 
+  let agentPolicyVm: HostVm | undefined;
+
+  // If no agents are running against the given Agent policy for agentless integrations, then add one now
+  if (!agents) {
+    log.info(`Creating VM and enrolling it with Fleet using policy [${agentPolicyName}]`);
+
+    agentPolicyVm = await createVm({
+      type: 'multipass',
+      name: generateVmName('agentless-integrations'),
+    });
+
+    if (forceFleetServer || !(await isFleetServerRunning(kbnClient, log))) {
+      await startFleetServer({
+        kbnClient,
+        logger: log,
+        force: forceFleetServer,
+      });
+    }
+
+    await enrollHostVmWithFleet({
+      hostVm: agentPolicyVm,
+      kbnClient,
+      log,
+      agentPolicyId,
+    });
+  } else {
+    log.info(
+      `No host VM created for Fleet agent policy [${agentPolicyName}]. It already shows to have [${agents}] enrolled`
+    );
+  }
+
   log.info(`Done!
 
 ${hostVm.info()}
-
+${agentPolicyVm ? `${agentPolicyVm.info()}\n` : ''}
+${await getMultipassVmCountNotice(2)}
 SentinelOne Agent Status:
 ${s1Info.status}
 `);
diff --git a/x-pack/plugins/security_solution/scripts/run_cypress/parallel.ts b/x-pack/plugins/security_solution/scripts/run_cypress/parallel.ts
index b7cfabb2bc937f..b5ab801c3fa21a 100644
--- a/x-pack/plugins/security_solution/scripts/run_cypress/parallel.ts
+++ b/x-pack/plugins/security_solution/scripts/run_cypress/parallel.ts
@@ -10,7 +10,6 @@ import yargs from 'yargs';
 import _ from 'lodash';
 import globby from 'globby';
 import pMap from 'p-map';
-import { ToolingLog } from '@kbn/tooling-log';
 import { withProcRunner } from '@kbn/dev-proc-runner';
 import cypress from 'cypress';
 import { findChangedFiles } from 'find-cypress-specs';
@@ -27,18 +26,18 @@ import {
 
 import { createFailError } from '@kbn/dev-cli-errors';
 import pRetry from 'p-retry';
+import { prefixedOutputLogger } from '../endpoint/common/utils';
+import { createToolingLogger } from '../../common/endpoint/data_loaders/utils';
+import { createKbnClient } from '../endpoint/common/stack_services';
+import type { StartedFleetServer } from '../endpoint/common/fleet_server/fleet_server_services';
+import { startFleetServer } from '../endpoint/common/fleet_server/fleet_server_services';
 import { renderSummaryTable } from './print_run';
 import { parseTestFileConfig, retrieveIntegrations } from './utils';
 import { getFTRConfig } from './get_ftr_config';
 
 export const cli = () => {
   run(
-    async () => {
-      const log = new ToolingLog({
-        level: 'info',
-        writeTo: process.stdout,
-      });
-
+    async ({ log: _cliLogger }) => {
       const { argv } = yargs(process.argv.slice(2))
         .coerce('configFile', (arg) => (_.isArray(arg) ? _.last(arg) : arg))
         .coerce('spec', (arg) => (_.isArray(arg) ? _.last(arg) : arg))
@@ -55,7 +54,7 @@ export const cli = () => {
         )
         .boolean('inspect');
 
-      log.info(`
+      _cliLogger.info(`
 ----------------------------------------------
 Script arguments:
 ----------------------------------------------
@@ -66,10 +65,15 @@ ${JSON.stringify(argv, null, 2)}
 `);
 
       const isOpen = argv._.includes('open');
-
       const cypressConfigFilePath = require.resolve(`../../${argv.configFile}`) as string;
       const cypressConfigFile = await import(cypressConfigFilePath);
 
+      if (cypressConfigFile.env?.TOOLING_LOG_LEVEL) {
+        createToolingLogger.defaultLogLevel = cypressConfigFile.env.TOOLING_LOG_LEVEL;
+      }
+
+      const log = prefixedOutputLogger('cy.parallel()', createToolingLogger());
+
       log.info(`
 ----------------------------------------------
 Cypress config for file: ${cypressConfigFilePath}:
@@ -234,6 +238,34 @@ ${JSON.stringify(cypressConfigFile, null, 2)}
               isOpen,
             });
 
+            const createUrlFromFtrConfig = (
+              type: 'elasticsearch' | 'kibana' | 'fleetserver',
+              withAuth: boolean = false
+            ): string => {
+              const getKeyPath = (keyPath: string = ''): string => {
+                return `servers.${type}${keyPath ? `.${keyPath}` : ''}`;
+              };
+
+              if (!config.get(getKeyPath())) {
+                throw new Error(`Unable to create URL for ${type}. Not found in FTR config at `);
+              }
+
+              const url = new URL('http://localhost');
+
+              url.port = config.get(getKeyPath('port'));
+              url.protocol = config.get(getKeyPath('protocol'));
+              url.hostname = config.get(getKeyPath('hostname'));
+
+              if (withAuth) {
+                url.username = config.get(getKeyPath('username'));
+                url.password = config.get(getKeyPath('password'));
+              }
+
+              return url.toString().replace(/\/$/, '');
+            };
+
+            const baseUrl = createUrlFromFtrConfig('kibana');
+
             log.info(`
 ----------------------------------------------
 Cypress FTR setup for file: ${filePath}:
@@ -294,6 +326,31 @@ ${JSON.stringify(
               inspect: argv.inspect,
             });
 
+            // Setup fleet if Cypress config requires it
+            let fleetServer: void | StartedFleetServer;
+            if (cypressConfigFile.env?.WITH_FLEET_SERVER) {
+              log.info(`Setting up fleet-server for this Cypress config`);
+
+              const kbnClient = createKbnClient({
+                url: baseUrl,
+                username: config.get('servers.kibana.username'),
+                password: config.get('servers.kibana.password'),
+                log,
+              });
+
+              fleetServer = await startFleetServer({
+                kbnClient,
+                logger: log,
+                port:
+                  fleetServerPort ?? config.has('servers.fleetserver.port')
+                    ? (config.get('servers.fleetserver.port') as number)
+                    : undefined,
+                // `force` is needed to ensure that any currently running fleet server (perhaps left
+                // over from an interrupted run) is killed and a new one restarted
+                force: true,
+              });
+            }
+
             await providers.loadAll();
 
             const functionalTestRunner = new FunctionalTestRunner(
@@ -302,34 +359,6 @@ ${JSON.stringify(
               EsVersion.getDefault()
             );
 
-            const createUrlFromFtrConfig = (
-              type: 'elasticsearch' | 'kibana' | 'fleetserver',
-              withAuth: boolean = false
-            ): string => {
-              const getKeyPath = (keyPath: string = ''): string => {
-                return `servers.${type}${keyPath ? `.${keyPath}` : ''}`;
-              };
-
-              if (!config.get(getKeyPath())) {
-                throw new Error(`Unable to create URL for ${type}. Not found in FTR config at `);
-              }
-
-              const url = new URL('http://localhost');
-
-              url.port = config.get(getKeyPath('port'));
-              url.protocol = config.get(getKeyPath('protocol'));
-              url.hostname = config.get(getKeyPath('hostname'));
-
-              if (withAuth) {
-                url.username = config.get(getKeyPath('username'));
-                url.password = config.get(getKeyPath('password'));
-              }
-
-              return url.toString().replace(/\/$/, '');
-            };
-
-            const baseUrl = createUrlFromFtrConfig('kibana');
-
             const ftrEnv = await pRetry(() => functionalTestRunner.run(abortCtrl.signal), {
               retries: 1,
             });
@@ -408,6 +437,10 @@ ${JSON.stringify(cyCustomEnv, null, 2)}
               }
             }
 
+            if (fleetServer) {
+              await fleetServer.stop();
+            }
+
             await procs.stop('kibana');
             await shutdownEs();
             cleanupServerPorts({ esPort, kibanaPort, fleetServerPort });
diff --git a/x-pack/plugins/security_solution/scripts/run_cypress/parallel_serverless.ts b/x-pack/plugins/security_solution/scripts/run_cypress/parallel_serverless.ts
index 56740845126a81..a64f4027f456ea 100644
--- a/x-pack/plugins/security_solution/scripts/run_cypress/parallel_serverless.ts
+++ b/x-pack/plugins/security_solution/scripts/run_cypress/parallel_serverless.ts
@@ -22,8 +22,10 @@ import path from 'path';
 import os from 'os';
 import pRetry from 'p-retry';
 
+import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
+import { INITIAL_REST_VERSION } from '@kbn/data-views-plugin/server/constants';
+import { exec } from 'child_process';
 import { renderSummaryTable } from './print_run';
-import type { SecuritySolutionDescribeBlockFtrConfig } from './utils';
 import { parseTestFileConfig, retrieveIntegrations } from './utils';
 
 interface ProductType {
@@ -31,13 +33,13 @@ interface ProductType {
   product_tier: string;
 }
 
-interface CreateEnvironmentRequestBody {
+interface CreateProjectRequestBody {
   name: string;
   region_id: string;
   product_types?: ProductType[];
 }
 
-interface Environment {
+interface Project {
   name: string;
   id: string;
   region: string;
@@ -51,14 +53,25 @@ interface Credentials {
   password: string;
 }
 
+const DEFAULT_CONFIGURATION: Readonly<ProductType[]> = [
+  { product_line: 'security', product_tier: 'complete' },
+  { product_line: 'cloud', product_tier: 'complete' },
+  { product_line: 'endpoint', product_tier: 'complete' },
+] as const;
+
 const DEFAULT_REGION = 'aws-eu-west-1';
 const PROJECT_NAME_PREFIX = 'kibana-cypress-security-solution-ephemeral';
 const BASE_ENV_URL = 'https://global.qa.cld.elstc.co';
 let log: ToolingLog;
-
-const delay = async (timeout: number) => {
-  await new Promise((r) => setTimeout(r, timeout));
-};
+const API_HEADERS = Object.freeze({
+  'kbn-xsrf': 'cypress-creds',
+  'x-elastic-internal-origin': 'security-solution',
+  [ELASTIC_HTTP_VERSION_HEADER]: [INITIAL_REST_VERSION],
+});
+const PROVIDERS = Object.freeze({
+  providerType: 'basic',
+  providerName: 'cloud-basic',
+});
 
 const getApiKeyFromElasticCloudJsonFile = (): string | undefined => {
   const userHomeDir = os.homedir();
@@ -71,23 +84,18 @@ const getApiKeyFromElasticCloudJsonFile = (): string | undefined => {
   }
 };
 
-// Method to invoke the create environment API for serverless.
-async function createEnvironment(
+// Method to invoke the create project API for serverless.
+async function createSecurityProject(
   projectName: string,
   apiKey: string,
-  ftrConfig: SecuritySolutionDescribeBlockFtrConfig
-): Promise<Environment | undefined> {
-  const body: CreateEnvironmentRequestBody = {
+  productTypes: ProductType[]
+): Promise<Project | undefined> {
+  const body: CreateProjectRequestBody = {
     name: projectName,
     region_id: DEFAULT_REGION,
+    product_types: productTypes,
   };
 
-  const productTypes: ProductType[] = [];
-  ftrConfig?.productTypes?.forEach((t) => {
-    productTypes.push(t as ProductType);
-  });
-  if (productTypes.length > 0) body.product_types = productTypes;
-
   try {
     const response = await axios.post(`${BASE_ENV_URL}/api/v1/serverless/projects/security`, body, {
       headers: {
@@ -111,8 +119,8 @@ async function createEnvironment(
   }
 }
 
-// Method to invoke the delete environment API for serverless.
-async function deleteEnvironment(
+// Method to invoke the delete project API for serverless.
+async function deleteSecurityProject(
   projectId: string,
   projectName: string,
   apiKey: string
@@ -123,7 +131,7 @@ async function deleteEnvironment(
         Authorization: `ApiKey ${apiKey}`,
       },
     });
-    log.info(`Environment ${projectName} was successfully deleted!`);
+    log.info(`Project ${projectName} was successfully deleted!`);
   } catch (error) {
     if (error instanceof AxiosError) {
       log.error(`${error.response?.status}:${error.response?.data}`);
@@ -133,16 +141,16 @@ async function deleteEnvironment(
   }
 }
 
-// Method to reset the credentials for the created environment.
+// Method to reset the credentials for the created project.
 async function resetCredentials(
-  environmentId: string,
+  projectId: string,
   runnerId: string,
   apiKey: string
 ): Promise<Credentials | undefined> {
   log.info(`${runnerId} : Reseting credentials`);
   try {
     const response = await axios.post(
-      `${BASE_ENV_URL}/api/v1/serverless/projects/security/${environmentId}/_reset-credentials`,
+      `${BASE_ENV_URL}/api/v1/serverless/projects/security/${projectId}/_reset-credentials`,
       {},
       {
         headers: {
@@ -159,10 +167,43 @@ async function resetCredentials(
   }
 }
 
+// Wait until Project is initialized
+function waitForProjectInitialized(projectId: string, apiKey: string): Promise<void> {
+  const fetchProjectStatusAttempt = async (attemptNum: number) => {
+    log.info(`Retry number ${attemptNum} to check if project is initialized.`);
+    const response = await axios.get(
+      `${BASE_ENV_URL}/api/v1/serverless/projects/security/${projectId}/status`,
+      {
+        headers: {
+          Authorization: `ApiKey ${apiKey}`,
+        },
+      }
+    );
+    if (response.data.phase !== 'initialized') {
+      throw new Error('Project is not initialized. Retrying in 20s...');
+    } else {
+      log.info('Project is initialized');
+    }
+  };
+  const retryOptions = {
+    onFailedAttempt: (error: Error | AxiosError) => {
+      if (error instanceof AxiosError && error.code === 'ENOTFOUND') {
+        log.info('Project is not reachable. Retrying in 20s...');
+      } else {
+        log.info(error);
+      }
+    },
+    retries: 100,
+    factor: 2,
+    maxTimeout: 20000,
+  };
+  return pRetry(fetchProjectStatusAttempt, retryOptions);
+}
+
 // Wait until elasticsearch status goes green
 function waitForEsStatusGreen(esUrl: string, auth: string, runnerId: string): Promise<void> {
   const fetchHealthStatusAttempt = async (attemptNum: number) => {
-    log.info(`Retry number ${attemptNum} to check if es is green.`);
+    log.info(`Retry number ${attemptNum} to check if Elasticsearch is green.`);
 
     const response = await axios.get(`${esUrl}/_cluster/health?wait_for_status=green&timeout=50s`, {
       headers: {
@@ -176,7 +217,7 @@ function waitForEsStatusGreen(esUrl: string, auth: string, runnerId: string): Pr
     onFailedAttempt: (error: Error | AxiosError) => {
       if (error instanceof AxiosError && error.code === 'ENOTFOUND') {
         log.info(
-          `${runnerId}: The elasticsearch url is not yet reachable. A retry will be triggered soon...`
+          `${runnerId}: The Elasticsearch URL is not yet reachable. A retry will be triggered soon...`
         );
       }
     },
@@ -206,7 +247,7 @@ function waitForKibanaAvailable(kbUrl: string, auth: string, runnerId: string):
   const retryOptions = {
     onFailedAttempt: (error: Error | AxiosError) => {
       if (error instanceof AxiosError && error.code === 'ENOTFOUND') {
-        log.info(`${runnerId}: The kibana url is not yet reachable. Retrying in 20s...`);
+        log.info(`${runnerId}: The Kibana URL is not yet reachable. Retrying in 20s...`);
       } else {
         log.info(`${runnerId}: ${error}`);
       }
@@ -218,9 +259,99 @@ function waitForKibanaAvailable(kbUrl: string, auth: string, runnerId: string):
   return pRetry(fetchKibanaStatusAttempt, retryOptions);
 }
 
+// Wait for Elasticsearch to be accessible
+function waitForEsAccess(esUrl: string, auth: string, runnerId: string): Promise<void> {
+  const fetchEsAccessAttempt = async (attemptNum: number) => {
+    log.info(`Retry number ${attemptNum} to check if can be accessed.`);
+
+    const response = await axios.get(`${esUrl}`, {
+      headers: {
+        Authorization: `Basic ${auth}`,
+      },
+    });
+
+    if (response.status !== 200) {
+      throw new Error('Cannot access. Retrying in 20s...');
+    } else {
+      log.info('Access performed successfully');
+    }
+  };
+  const retryOptions = {
+    onFailedAttempt: (error: Error | AxiosError) => {
+      if (error instanceof AxiosError && error.code === 'ENOTFOUND') {
+        log.info(
+          `${runnerId}: The elasticsearch url is not yet reachable. A retry will be triggered soon...`
+        );
+      }
+    },
+    retries: 100,
+    factor: 2,
+    maxTimeout: 20000,
+  };
+
+  return pRetry(fetchEsAccessAttempt, retryOptions);
+}
+
+// Wait until application is ready
+function waitForKibanaLogin(kbUrl: string, credentials: Credentials): Promise<void> {
+  const body = {
+    ...PROVIDERS,
+    currentURL: '/',
+    params: credentials,
+  };
+
+  const fetchLoginStatusAttempt = async (attemptNum: number) => {
+    log.info(`Retry number ${attemptNum} to check if login can be performed.`);
+    const response = await axios.post(`${kbUrl}/internal/security/login`, body, {
+      headers: API_HEADERS,
+    });
+    if (response.status !== 200) {
+      throw new Error('Cannot login. Retrying in 20s...');
+    } else {
+      log.info('Login can be performed successfully');
+    }
+  };
+  const retryOptions = {
+    onFailedAttempt: (error: Error | AxiosError) => {
+      if (error instanceof AxiosError && error.code === 'ENOTFOUND') {
+        log.info('Project is not reachable. Retrying login in 20s...');
+      } else {
+        log.info(error);
+      }
+    },
+    retries: 100,
+    factor: 2,
+    maxTimeout: 20000,
+  };
+  return pRetry(fetchLoginStatusAttempt, retryOptions);
+}
+
+const getProductTypes = (
+  tier: string,
+  endpointAddon: boolean,
+  cloudAddon: boolean
+): ProductType[] => {
+  let productTypes: ProductType[] = [...DEFAULT_CONFIGURATION];
+
+  if (tier) {
+    productTypes = productTypes.map((product) => ({
+      ...product,
+      product_tier: tier,
+    }));
+  }
+  if (!cloudAddon) {
+    productTypes = productTypes.filter((product) => product.product_line !== 'cloud');
+  }
+  if (!endpointAddon) {
+    productTypes = productTypes.filter((product) => product.product_line !== 'endpoint');
+  }
+
+  return productTypes;
+};
+
 export const cli = () => {
   run(
-    async () => {
+    async (context) => {
       log = new ToolingLog({
         level: 'info',
         writeTo: process.stdout,
@@ -228,9 +359,9 @@ export const cli = () => {
 
       // Checking if API key is either provided via env variable or in ~/.elastic.cloud.json
       if (!process.env.CLOUD_QA_API_KEY && !getApiKeyFromElasticCloudJsonFile()) {
-        log.error('The api key for the environment needs to be provided with the env var API_KEY.');
+        log.error('The API key for the environment needs to be provided with the env var API_KEY.');
         log.error(
-          'If running locally, ~/.elastic/cloud.json is attempted to be read which contains the api key.'
+          'If running locally, ~/.elastic/cloud.json is attempted to be read which contains the API key.'
         );
         // eslint-disable-next-line no-process-exit
         return process.exit(1);
@@ -264,7 +395,22 @@ export const cli = () => {
             }
             return acc;
           }, {} as Record<string, string | number>)
-        );
+        )
+        .option('tier', {
+          alias: 't',
+          type: 'string',
+          default: 'complete',
+        })
+        .option('endpointAddon', {
+          alias: 'ea',
+          type: 'boolean',
+          default: true,
+        })
+        .option('cloudAddon', {
+          alias: 'ca',
+          type: 'boolean',
+          default: true,
+        });
 
       log.info(`
 ----------------------------------------------
@@ -281,6 +427,10 @@ ${JSON.stringify(argv, null, 2)}
       const cypressConfigFilePath = require.resolve(`../../${argv.configFile}`) as string;
       const cypressConfigFile = await import(cypressConfigFilePath);
 
+      const tier: string = argv.tier;
+      const endpointAddon: boolean = argv.endpointAddon;
+      const cloudAddon: boolean = argv.cloudAddon;
+
       log.info(`
 ----------------------------------------------
 Cypress config for file: ${cypressConfigFilePath}:
@@ -349,26 +499,34 @@ ${JSON.stringify(cypressConfigFile, null, 2)}
           await withProcRunner(log, async (procs) => {
             const id = crypto.randomBytes(8).toString('hex');
             const PROJECT_NAME = `${PROJECT_NAME_PREFIX}-${id}`;
-            const specFileFTRConfig = parseTestFileConfig(filePath);
+
+            const productTypes = isOpen
+              ? getProductTypes(tier, endpointAddon, cloudAddon)
+              : (parseTestFileConfig(filePath).productTypes as ProductType[]);
 
             if (!API_KEY) {
-              log.info('API KEY to create environment could not be retrieved.');
+              log.info('API KEY to create project could not be retrieved.');
               // eslint-disable-next-line no-process-exit
               return process.exit(1);
             }
 
-            log.info(`${id}: Creating environment ${PROJECT_NAME}...`);
-            // Creating environment for the test to run
-            const environment = await createEnvironment(PROJECT_NAME, API_KEY, specFileFTRConfig);
+            log.info(`${id}: Creating project ${PROJECT_NAME}...`);
+            // Creating project for the test to run
+            const project = await createSecurityProject(PROJECT_NAME, API_KEY, productTypes);
 
-            if (!environment) {
-              log.info('Failed to create environment.');
+            if (!project) {
+              log.info('Failed to create project.');
               // eslint-disable-next-line no-process-exit
               return process.exit(1);
             }
 
+            context.addCleanupTask(() => {
+              const command = `curl -X DELETE ${BASE_ENV_URL}/api/v1/serverless/projects/security/${project.id} -H "Authorization: ApiKey ${API_KEY}"`;
+              exec(command);
+            });
+
             // Reset credentials for elastic user
-            const credentials = await resetCredentials(environment.id, id, API_KEY);
+            const credentials = await resetCredentials(project.id, id, API_KEY);
 
             if (!credentials) {
               log.info('Credentials could not be reset.');
@@ -376,27 +534,33 @@ ${JSON.stringify(cypressConfigFile, null, 2)}
               return process.exit(1);
             }
 
-            // Wait for 8 minutes in order for the environment to be ready
-            delay(480000);
+            // Wait for project to be initialized
+            await waitForProjectInitialized(project.id, API_KEY);
 
             // Base64 encode the credentials in order to invoke ES and KB APIs
             const auth = btoa(`${credentials.username}:${credentials.password}`);
 
             // Wait for elasticsearch status to go green.
-            await waitForEsStatusGreen(environment.es_url, auth, id);
+            await waitForEsStatusGreen(project.es_url, auth, id);
 
             // Wait until Kibana is available
-            await waitForKibanaAvailable(environment.kb_url, auth, id);
+            await waitForKibanaAvailable(project.kb_url, auth, id);
+
+            // Wait for Elasticsearch to be accessible
+            await waitForEsAccess(project.es_url, auth, id);
+
+            // Wait until application is ready
+            await waitForKibanaLogin(project.kb_url, credentials);
 
             // Normalized the set of available env vars in cypress
             const cyCustomEnv = {
-              CYPRESS_BASE_URL: environment.kb_url,
+              CYPRESS_BASE_URL: project.kb_url,
 
-              ELASTICSEARCH_URL: environment.es_url,
+              ELASTICSEARCH_URL: project.es_url,
               ELASTICSEARCH_USERNAME: credentials.username,
               ELASTICSEARCH_PASSWORD: credentials.password,
 
-              KIBANA_URL: environment.kb_url,
+              KIBANA_URL: project.kb_url,
               KIBANA_USERNAME: credentials.username,
               KIBANA_PASSWORD: credentials.password,
 
@@ -418,7 +582,7 @@ ${JSON.stringify(cypressConfigFile, null, 2)}
                 configFile: cypressConfigFilePath,
                 config: {
                   e2e: {
-                    baseUrl: environment.kb_url,
+                    baseUrl: project.kb_url,
                   },
                   env: cyCustomEnv,
                 },
@@ -434,21 +598,19 @@ ${JSON.stringify(cypressConfigFile, null, 2)}
                   headed: argv.headed as boolean,
                   config: {
                     e2e: {
-                      baseUrl: environment.kb_url,
+                      baseUrl: project.kb_url,
                     },
                     numTestsKeptInMemory: 0,
                     env: cyCustomEnv,
                   },
                 });
+                // Delete serverless project
+                log.info(`${id} : Deleting project ${PROJECT_NAME}...`);
+                await deleteSecurityProject(project.id, PROJECT_NAME, API_KEY);
               } catch (error) {
                 result = error;
               }
             }
-
-            // Delete serverless environment
-            log.info(`${id} : Deleting Environment ${PROJECT_NAME}...`);
-            await deleteEnvironment(environment.id, PROJECT_NAME, API_KEY);
-
             return result;
           });
           return result;
diff --git a/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts b/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts
index 3d586d1dfab1a1..7c861bf87f18f7 100644
--- a/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts
+++ b/x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts
@@ -441,6 +441,8 @@ describe('ingest_integration tests ', () => {
       licenseEmitter.next(Enterprise); // set license level to enterprise
     });
 
+    const validDateYesterday = moment.utc().subtract(1, 'day');
+
     it.each([
       {
         date: 'invalid',
@@ -457,13 +459,21 @@ describe('ingest_integration tests ', () => {
       },
       {
         date: '2100-10-01',
-        message: 'Global manifest version cannot be in the future. UTC time.',
+        message: `Global manifest version cannot be in the future. Latest selectable date is ${validDateYesterday.format(
+          'MMMM DD, YYYY'
+        )} UTC time.`,
+      },
+      {
+        date: validDateYesterday.clone().add(1, 'day').format('YYYY-MM-DD'),
+        message: `Global manifest version cannot be in the future. Latest selectable date is ${validDateYesterday.format(
+          'MMMM DD, YYYY'
+        )} UTC time.`,
       },
       {
         date: 'latest',
       },
       {
-        date: moment.utc().subtract(1, 'day').format('YYYY-MM-DD'), // Correct date
+        date: validDateYesterday.format('YYYY-MM-DD'), // Correct date
       },
     ])(
       'should return bad request for invalid endpoint package policy global manifest values',
diff --git a/x-pack/plugins/security_solution/server/fleet_integration/handlers/validate_endpoint_package_policy.ts b/x-pack/plugins/security_solution/server/fleet_integration/handlers/validate_endpoint_package_policy.ts
index d8f1a8afecd794..f63d07d890c2d8 100644
--- a/x-pack/plugins/security_solution/server/fleet_integration/handlers/validate_endpoint_package_policy.ts
+++ b/x-pack/plugins/security_solution/server/fleet_integration/handlers/validate_endpoint_package_policy.ts
@@ -29,9 +29,12 @@ export const validateEndpointPackagePolicy = (inputs: NewPackagePolicyInput[]) =
           'Global manifest version is too far in the past. Please use either "latest" or a date within the last 18 months. The earliest valid date is October 1, 2023, in UTC time.'
         );
       }
-      if (parsedDate.isAfter(moment.utc())) {
+      const minAllowedDate = moment.utc().subtract(1, 'day');
+      if (parsedDate.isAfter(minAllowedDate)) {
         throw createManifestVersionError(
-          'Global manifest version cannot be in the future. UTC time.'
+          `Global manifest version cannot be in the future. Latest selectable date is ${minAllowedDate.format(
+            'MMMM DD, YYYY'
+          )} UTC time.`
         );
       }
     }
diff --git a/x-pack/plugins/security_solution/server/index.ts b/x-pack/plugins/security_solution/server/index.ts
index 21eb13b94df04a..9c5c1a42749a6a 100644
--- a/x-pack/plugins/security_solution/server/index.ts
+++ b/x-pack/plugins/security_solution/server/index.ts
@@ -6,14 +6,14 @@
  */
 
 import type { PluginInitializerContext, PluginConfigDescriptor } from '@kbn/core/server';
-import type { PluginSetup, PluginStart } from './plugin';
-import { Plugin } from './plugin';
+import type { Plugin, PluginSetup, PluginStart } from './plugin';
 import type { ConfigSchema, ConfigType } from './config';
 import { configSchema } from './config';
 import { SIGNALS_INDEX_KEY } from '../common/constants';
 import { AppClient } from './types';
 
-export const plugin = (context: PluginInitializerContext) => {
+export const plugin = async (context: PluginInitializerContext) => {
+  const { Plugin } = await import('./plugin');
   return new Plugin(context);
 };
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
index fda5fbe5b28003..f383a9d11cc00a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.test.ts
@@ -311,14 +311,14 @@ describe('Import rules route', () => {
         errors: [
           {
             error: {
-              message: 'Invalid value "undefined" supplied to "rule_id"',
+              message: 'rule_id: Required',
               status_code: 400,
             },
             rule_id: '(unknown id)',
           },
           {
             error: {
-              message: 'Invalid value "undefined" supplied to "rule_id"',
+              message: 'rule_id: Required',
               status_code: 400,
             },
             rule_id: '(unknown id)',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
index eb622884bc7a93..5867d099fb8def 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/import_rules/route.ts
@@ -165,9 +165,6 @@ export const importRulesRoute = (
             mlAuthz,
             overwriteRules: request.query.overwrite,
             rulesClient,
-            savedObjectsClient,
-            exceptionsClient,
-            spaceId: ctx.securitySolution.getSpaceId(),
             existingLists: foundReferencedExceptionLists,
             allowMissingConnectorSecrets: !!actionConnectors.length,
           });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
index 7b161f1ab27f2c..8afecd245e2a97 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/action_connectors/import_rule_action_connectors.test.ts
@@ -419,6 +419,7 @@ describe('importRuleActionConnectors', () => {
           },
         ],
         description: 'some description',
+        immutable: false,
         language: 'kuery',
         name: 'Query with a rule id',
         query: 'user.name: root or user.name: admin',
@@ -529,6 +530,7 @@ describe('importRuleActionConnectors', () => {
           },
         ],
         description: 'some description',
+        immutable: false,
         language: 'kuery',
         name: 'Query with a rule id',
         query: 'user.name: root or user.name: admin',
@@ -547,6 +549,7 @@ describe('importRuleActionConnectors', () => {
           },
         ],
         description: 'some description',
+        immutable: false,
         language: 'kuery',
         name: 'Query with a rule id',
         id: '0abc78e0-7031-11ed-b076-53cc4d57aaf1',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.test.ts
index 22c7130d8a15fd..be9561598fd084 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.test.ts
@@ -283,7 +283,7 @@ describe('create_rules_stream_from_ndjson', () => {
         immutable: false,
       });
       expect(resultOrError[1].message).toContain(
-        'Invalid value "undefined" supplied to "name",Invalid value "undefined" supplied to "description",Invalid value "undefined" supplied to "risk_score",Invalid value "undefined" supplied to "severity"'
+        'name: Required, description: Required, risk_score: Required, severity: Required, rule_id: Required, and 25 more'
       );
       expect(resultOrError[2]).toEqual({
         rule_id: 'rule-2',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
index af90eb560579fd..a14b02df8ce712 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/create_rules_stream_from_ndjson.ts
@@ -6,9 +6,6 @@
  */
 
 import { has } from 'lodash/fp';
-import { pipe } from 'fp-ts/lib/pipeable';
-import { fold } from 'fp-ts/lib/Either';
-import type * as t from 'io-ts';
 import type { Transform } from 'stream';
 import {
   createSplitStream,
@@ -18,13 +15,14 @@ import {
 } from '@kbn/utils';
 
 import { BadRequestError } from '@kbn/securitysolution-es-utils';
-import { exactCheck, formatErrors } from '@kbn/securitysolution-io-ts-utils';
 import type {
   ImportExceptionListItemSchema,
   ImportExceptionsListSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 
 import type { SavedObject } from '@kbn/core-saved-objects-server';
+import { stringifyZodError } from '@kbn/zod-helpers';
+import type { RuleToImportInput } from '../../../../../../common/api/detection_engine/rule_management';
 import {
   RuleToImport,
   validateRuleToImport,
@@ -42,7 +40,7 @@ import {
 export const validateRulesStream = (): Transform => {
   return createMapStream<{
     exceptions: Array<ImportExceptionsListSchema | ImportExceptionListItemSchema | Error>;
-    rules: Array<RuleToImport | Error>;
+    rules: Array<RuleToImportInput | Error>;
     actionConnectors: SavedObject[];
   }>((items) => ({
     actionConnectors: items.actionConnectors,
@@ -51,26 +49,25 @@ export const validateRulesStream = (): Transform => {
   }));
 };
 
-export const validateRules = (rules: Array<RuleToImport | Error>): Array<RuleToImport | Error> => {
-  return rules.map((obj: RuleToImport | Error) => {
-    if (!(obj instanceof Error)) {
-      const decoded = RuleToImport.decode(obj);
-      const checked = exactCheck(obj, decoded);
-      const onLeft = (errors: t.Errors): BadRequestError | RuleToImport => {
-        return new BadRequestError(formatErrors(errors).join());
-      };
-      const onRight = (schema: RuleToImport): BadRequestError | RuleToImport => {
-        const validationErrors = validateRuleToImport(schema);
-        if (validationErrors.length) {
-          return new BadRequestError(validationErrors.join());
-        } else {
-          return schema;
-        }
-      };
-      return pipe(checked, fold(onLeft, onRight));
-    } else {
+export const validateRules = (
+  rules: Array<RuleToImportInput | Error>
+): Array<RuleToImport | Error> => {
+  return rules.map((obj: RuleToImportInput | Error) => {
+    if (obj instanceof Error) {
       return obj;
     }
+
+    const result = RuleToImport.safeParse(obj);
+    if (!result.success) {
+      return new BadRequestError(stringifyZodError(result.error));
+    }
+
+    const validationErrors = validateRuleToImport(result.data);
+    if (validationErrors.length) {
+      return new BadRequestError(validationErrors.join());
+    }
+
+    return result.data;
   });
 };
 
@@ -83,7 +80,7 @@ export const validateRules = (rules: Array<RuleToImport | Error>): Array<RuleToI
 export const sortImports = (): Transform => {
   return createReduceStream<{
     exceptions: Array<ImportExceptionsListSchema | ImportExceptionListItemSchema | Error>;
-    rules: Array<RuleToImport | Error>;
+    rules: Array<RuleToImportInput | Error>;
     actionConnectors: SavedObject[];
   }>(
     (acc, importItem) => {
@@ -105,7 +102,7 @@ export const sortImports = (): Transform => {
 };
 
 export const migrateLegacyInvestigationFields = (): Transform => {
-  return createMapStream<RuleToImport | RulesObjectsExportResultDetails>((obj) => {
+  return createMapStream<RuleToImportInput | RulesObjectsExportResultDetails>((obj) => {
     if (obj != null && 'investigation_fields' in obj && Array.isArray(obj.investigation_fields)) {
       if (obj.investigation_fields.length) {
         return {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.test.ts
index 96bc58ee6d4410..0b601be81dd621 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.test.ts
@@ -44,10 +44,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: false,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -60,10 +57,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: false,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -91,10 +85,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: false,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -118,10 +109,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: false,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -150,10 +138,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: true,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -177,10 +162,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: true,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -212,10 +194,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: false,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
@@ -246,10 +225,7 @@ describe('importRules', () => {
       rulesResponseAcc: [],
       mlAuthz,
       overwriteRules: true,
-      savedObjectsClient: context.core.savedObjects.client,
       rulesClient: context.alerting.getRulesClient(),
-      exceptionsClient: context.lists?.getExceptionListClient(),
-      spaceId: 'default',
       existingLists: {},
     });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
index a2618f4af7e221..81940848b7dc47 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/import_rules_utils.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { SavedObject, SavedObjectsClientContract } from '@kbn/core/server';
+import type { SavedObject } from '@kbn/core/server';
 import type {
   ImportExceptionsListSchema,
   ImportExceptionListItemSchema,
@@ -13,7 +13,6 @@ import type {
 } from '@kbn/securitysolution-io-ts-list-types';
 
 import type { RulesClient } from '@kbn/alerting-plugin/server';
-import type { ExceptionListClient } from '@kbn/lists-plugin/server';
 
 import type { RuleToImport } from '../../../../../../common/api/detection_engine/rule_management';
 import type { ImportRuleResponse } from '../../../routes/utils';
@@ -42,9 +41,6 @@ export interface RuleExceptionsPromiseFromStreams {
  * @param overwriteRules {boolean} - whether to overwrite existing rules
  * with imported rules if their rule_id matches
  * @param rulesClient {object}
- * @param savedObjectsClient {object}
- * @param exceptionsClient {object}
- * @param spaceId {string} - space being used during import
  * @param existingLists {object} - all exception lists referenced by
  * rules that were found to exist
  * @returns {Promise} an array of error and success messages from import
@@ -55,9 +51,6 @@ export const importRules = async ({
   mlAuthz,
   overwriteRules,
   rulesClient,
-  savedObjectsClient,
-  exceptionsClient,
-  spaceId,
   existingLists,
   allowMissingConnectorSecrets,
 }: {
@@ -66,9 +59,6 @@ export const importRules = async ({
   mlAuthz: MlAuthz;
   overwriteRules: boolean;
   rulesClient: RulesClient;
-  savedObjectsClient: SavedObjectsClientContract;
-  exceptionsClient: ExceptionListClient | undefined;
-  spaceId: string;
   existingLists: Record<string, ExceptionListSchema>;
   allowMissingConnectorSecrets?: boolean;
 }) => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.ts
index 8a9370c64d0999..3e486c37e56e80 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.ts
@@ -248,7 +248,7 @@ export const migrateLegacyActionsIds = async (
         // can we swap the pre 8.0 action connector(s) id with the new,
         // post-8.0 action id (swap the originId for the new _id?)
         const newActions: Array<RuleAction | Error> = await pMap(
-          rule.actions ?? [],
+          (rule.actions as RuleAction[]) ?? [],
           (action: RuleAction) => swapActionIds(action, savedObjectsClient),
           { concurrency: MAX_CONCURRENT_SEARCHES }
         );
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/README.md b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/README.md
new file mode 100644
index 00000000000000..0398f182f9f4ee
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/README.md
@@ -0,0 +1,41 @@
+# Create role/user utility
+
+`create_role_and_user.sh` shell script facilitates roles and users creation process. It accepts only one `--role` parameter restricted to known role definitions (See `@kbn/security-solution-plugin/common/test/index.ts` for the roles list). Created user has role's name and this only role assigned.
+
+## Expected environment variables
+
+The following environment variables can be specified
+
+- `ELASTICSEARCH_URL` Elasticsearch url e.g. `http://127.0.0.1:9200`
+- `KIBANA_URL` Kibana url e.g. `http://127.0.0.1:560`
+- `USERNAME` a user name to authenticate requests e.g. `elastic`
+- `PASSWORD` a password to authenticate requests e.g. `changeme`
+
+If an environment variable is not specified sensible defaults is used.
+
+### Notes
+
+1. When first starting up elastic, detections will not be available until you visit the page with a SOC Manager role or Platform Engineer role
+2. Rule Author has the ability to create rules and create value lists
+
+## Examples
+
+For example to create `t1_analyst` user with `t1_analyst` role run the following command in the current folder
+
+```bash
+./create_role_and_user.sh --role=t1_analyst
+```
+
+Output
+
+```
+ warn Environment variable "ELASTICSEARCH_URL" is not set, using "http://127.0.0.1:9200" as a default value
+ info Using environment variable KIBANA_URL=http://127.0.0.1:5601/kbn
+ warn Environment variable "USERNAME" is not set, using "elastic" as a default value
+ warn Environment variable "PASSWORD" is not set, using "changeme" as a default value
+ info Creating role "t1_analyst"...
+ info Role "t1_analyst" has been created
+ info Creating user "t1_analyst"...
+ info User "t1_analyst" has been created (password "changeme")
+ succ Done
+```
\ No newline at end of file
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.sh
new file mode 100755
index 00000000000000..516d38829b3e48
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License
+# 2.0; you may not use this file except in compliance with the Elastic License
+# 2.0.
+#
+
+npx ts-node "$(dirname "${0}")/create_role_and_user.ts" "$@"
\ No newline at end of file
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.ts
new file mode 100644
index 00000000000000..04b09feb1a153f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/create_role_and_user.ts
@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios from 'axios';
+import yargs from 'yargs';
+import { ToolingLog } from '@kbn/tooling-log';
+import {
+  KNOWN_ESS_ROLE_DEFINITIONS,
+  KNOWN_SERVERLESS_ROLE_DEFINITIONS,
+} from '../../../../../common/test';
+
+const logger = new ToolingLog({
+  level: 'info',
+  writeTo: process.stdout,
+});
+const KNOWN_ROLE_DEFINITIONS = {
+  ...KNOWN_ESS_ROLE_DEFINITIONS,
+  ...KNOWN_SERVERLESS_ROLE_DEFINITIONS,
+};
+const DEFAULT_PASSWORD = 'changeme';
+
+cli()
+  .then(() => logger.success('Done'))
+  .catch((e) => logger.error(e));
+
+async function cli(): Promise<void> {
+  const { role } = yargs(process.argv)
+    .choices(
+      'role',
+      Object.keys(KNOWN_ROLE_DEFINITIONS) as Array<keyof typeof KNOWN_ROLE_DEFINITIONS>
+    )
+    .demandOption('role')
+    .version(false)
+    .help(false).argv;
+  const selectedRoleDefinition = KNOWN_ROLE_DEFINITIONS[role];
+  const userName = role;
+  const ELASTICSEARCH_URL = getEnvVariableOrDefault('ELASTICSEARCH_URL', 'http://127.0.0.1:9200');
+  const KIBANA_URL = getEnvVariableOrDefault('KIBANA_URL', 'http://127.0.0.1:560');
+  const USERNAME = getEnvVariableOrDefault('USERNAME', 'elastic');
+  const PASSWORD = getEnvVariableOrDefault('PASSWORD', DEFAULT_PASSWORD);
+  const password = DEFAULT_PASSWORD;
+  const requestHeaders = {
+    Authorization: `Basic ${btoa(`${USERNAME}:${PASSWORD}`)}`,
+    'kbn-xsrf': 'xxx',
+  };
+
+  try {
+    logger.info(`Creating role "${role}"...`);
+    await axios.put(
+      `${KIBANA_URL}/api/security/role/${role}`,
+      {
+        elasticsearch: selectedRoleDefinition.elasticsearch,
+        kibana: selectedRoleDefinition.kibana,
+      },
+      {
+        headers: requestHeaders,
+      }
+    );
+
+    logger.info(`Role "${role}" has been created`);
+  } catch (e) {
+    logger.error(`Unable to create role "${role}"`);
+    throw e;
+  }
+
+  try {
+    logger.info(`Creating user "${userName}"...`);
+    await axios.put(
+      `${ELASTICSEARCH_URL}/_security/user/${userName}`,
+      {
+        password,
+        roles: [role],
+        full_name: role,
+        email: `role@example.com`,
+      },
+      {
+        headers: requestHeaders,
+      }
+    );
+
+    logger.info(`User "${userName}" has been created (password "${password}")`);
+  } catch (e) {
+    logger.error(`Unable to create user "${userName}"`);
+    throw e;
+  }
+}
+
+function getEnvVariableOrDefault(variableName: string, defaultValue: string): string {
+  const value = process.env[variableName];
+
+  if (!value) {
+    logger.warning(
+      `Environment variable "${variableName}" is not set, using "${defaultValue}" as a default value`
+    );
+
+    return defaultValue;
+  }
+
+  logger.info(`Using environment variable ${variableName}=${value}`);
+
+  return value;
+}
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
index 848f66c3aaf0ab..39af813916cdd9 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -409,7 +409,7 @@ export class TelemetryEventsSender implements ITelemetryEventsSender {
         counterType: 'docs_sent',
         incrementBy: events.length,
       });
-      tlog(this.logger, `Events sent!. Response: ${resp.status} ${JSON.stringify(resp.data)}`);
+      tlog(this.logger, `Events sent!. Response: ${resp.status}`);
     } catch (err) {
       tlog(this.logger, `Error sending events: ${err}`);
       const errorStatus = err?.response?.status;
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts
index d3c40b29e218fc..2c5eabe612c099 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts
@@ -167,12 +167,10 @@ export function createTelemetryEndpointTaskConfig(maxTelemetryBatch: number) {
             policyInfo !== undefined &&
             !endpointPolicyCache.has(policyInfo)
           ) {
-            tlog(logger, `policy info exists as ${policyInfo}`);
             const agentPolicy = await receiver.fetchPolicyConfigs(policyInfo);
             const packagePolicies = agentPolicy?.package_policies;
 
             if (packagePolicies !== undefined && isPackagePolicyList(packagePolicies)) {
-              tlog(logger, `package policy exists as ${JSON.stringify(packagePolicies)}`);
               packagePolicies
                 .map((pPolicy) => pPolicy as PolicyData)
                 .forEach((pPolicy) => {
@@ -221,11 +219,6 @@ export function createTelemetryEndpointTaskConfig(maxTelemetryBatch: number) {
             )
           : new Map<string, EndpointPolicyResponseDocument>();
 
-        tlog(
-          logger,
-          `policy responses exists as ${JSON.stringify(Object.fromEntries(policyResponses))}`
-        );
-
         /** STAGE 4 - Fetch Endpoint Agent Metadata
          *
          * Reads Endpoint Agent metadata out of the `.ds-metrics-endpoint.metadata` data stream
@@ -254,10 +247,6 @@ export function createTelemetryEndpointTaskConfig(maxTelemetryBatch: number) {
             },
             new Map<string, EndpointMetadataDocument>()
           );
-        tlog(
-          logger,
-          `endpoint metadata exists as ${JSON.stringify(Object.fromEntries(endpointMetadata))}`
-        );
         /** STAGE 5 - Create the telemetry log records
          *
          * Iterates through the endpoint metrics documents at STAGE 1 and joins them together
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/security_lists.ts b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/security_lists.ts
index 68a6fb643e1ba3..04312e8843e284 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/security_lists.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/security_lists.ts
@@ -21,7 +21,6 @@ import type { ESClusterInfo, ESLicense } from '../types';
 import {
   batchTelemetryRecords,
   templateExceptionList,
-  tlog,
   createTaskMetric,
   formatValueListMetaData,
 } from '../helpers';
@@ -72,7 +71,6 @@ export function createTelemetrySecurityListTaskConfig(maxTelemetryBatch: number)
             licenseInfo,
             LIST_TRUSTED_APPLICATION
           );
-          tlog(logger, `Trusted Apps: ${trustedAppsJson}`);
           count += trustedAppsJson.length;
 
           const batches = batchTelemetryRecords(trustedAppsJson, maxTelemetryBatch);
@@ -91,7 +89,6 @@ export function createTelemetrySecurityListTaskConfig(maxTelemetryBatch: number)
             licenseInfo,
             LIST_ENDPOINT_EXCEPTION
           );
-          tlog(logger, `EP Exceptions: ${epExceptionsJson}`);
           count += epExceptionsJson.length;
 
           const batches = batchTelemetryRecords(epExceptionsJson, maxTelemetryBatch);
@@ -110,7 +107,6 @@ export function createTelemetrySecurityListTaskConfig(maxTelemetryBatch: number)
             licenseInfo,
             LIST_ENDPOINT_EVENT_FILTER
           );
-          tlog(logger, `EP Event Filters: ${epFiltersJson}`);
           count += epFiltersJson.length;
 
           const batches = batchTelemetryRecords(epFiltersJson, maxTelemetryBatch);
@@ -128,7 +124,6 @@ export function createTelemetrySecurityListTaskConfig(maxTelemetryBatch: number)
           clusterInfo,
           licenseInfo
         );
-        tlog(logger, `Value List Meta Data: ${JSON.stringify(valueListMetaData)}`);
         if (valueListMetaData?.total_list_count) {
           await sender.sendOnDemand(TELEMETRY_CHANNEL_LISTS, [valueListMetaData]);
         }
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/timelines.ts b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/timelines.ts
index b6f7a4426f0c66..bd50ffcd928171 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/tasks/timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/tasks/timelines.ts
@@ -115,7 +115,6 @@ export function createTelemetryTimelineTaskConfig() {
           // Fetch event lineage
 
           const timelineEvents = await receiver.fetchTimelineEvents(nodeIds);
-          tlog(logger, `Timeline Events: ${JSON.stringify(timelineEvents)}`);
           const eventsStore = new Map<string, SafeEndpointEvent>();
           for (const event of timelineEvents.hits.hits) {
             const doc = event._source;
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index 1766051325f5f8..4d2b16e355c6c0 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -178,5 +178,6 @@
     "@kbn/unified-doc-viewer-plugin",
     "@kbn/shared-ux-error-boundary",
     "@kbn/zod-helpers",
+    "@kbn/core-http-common",
   ]
 }
diff --git a/x-pack/plugins/security_solution_ess/server/index.ts b/x-pack/plugins/security_solution_ess/server/index.ts
index ebb28fda2cf0a0..ad6f30ea6d7710 100644
--- a/x-pack/plugins/security_solution_ess/server/index.ts
+++ b/x-pack/plugins/security_solution_ess/server/index.ts
@@ -7,12 +7,12 @@
 
 import type { PluginInitializerContext } from '@kbn/core/server';
 
-import { SecuritySolutionEssPlugin } from './plugin';
 export { config } from './config';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
-export function plugin(_initializerContext: PluginInitializerContext) {
+export async function plugin(_initializerContext: PluginInitializerContext) {
+  const { SecuritySolutionEssPlugin } = await import('./plugin');
   return new SecuritySolutionEssPlugin();
 }
 
diff --git a/x-pack/plugins/security_solution_serverless/server/index.ts b/x-pack/plugins/security_solution_serverless/server/index.ts
index 44ac7142240b90..a0e2cba23fd625 100644
--- a/x-pack/plugins/security_solution_serverless/server/index.ts
+++ b/x-pack/plugins/security_solution_serverless/server/index.ts
@@ -7,13 +7,13 @@
 
 import type { PluginInitializerContext } from '@kbn/core/server';
 
-import { SecuritySolutionServerlessPlugin } from './plugin';
 export { config } from './config';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { SecuritySolutionServerlessPlugin } = await import('./plugin');
   return new SecuritySolutionServerlessPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/serverless/server/index.ts b/x-pack/plugins/serverless/server/index.ts
index 04f08ac6ed4cca..350b7a6c276416 100644
--- a/x-pack/plugins/serverless/server/index.ts
+++ b/x-pack/plugins/serverless/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ServerlessPlugin } from './plugin';
 export { config } from './config';
 
-export const plugin = (initializerContext: PluginInitializerContext) => {
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { ServerlessPlugin } = await import('./plugin');
   return new ServerlessPlugin(initializerContext);
 };
 
diff --git a/x-pack/plugins/serverless_observability/server/index.ts b/x-pack/plugins/serverless_observability/server/index.ts
index c45e363a429bfb..f0dbaa87b5c981 100644
--- a/x-pack/plugins/serverless_observability/server/index.ts
+++ b/x-pack/plugins/serverless_observability/server/index.ts
@@ -7,13 +7,13 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { ServerlessObservabilityPlugin } from './plugin';
 export { config } from './config';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { ServerlessObservabilityPlugin } = await import('./plugin');
   return new ServerlessObservabilityPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/serverless_search/kibana.jsonc b/x-pack/plugins/serverless_search/kibana.jsonc
index 2ae8f0dbff9879..0ac92bc1974688 100644
--- a/x-pack/plugins/serverless_search/kibana.jsonc
+++ b/x-pack/plugins/serverless_search/kibana.jsonc
@@ -25,7 +25,9 @@
       "share",
       "visualizations"
     ],
-    "optionalPlugins": [],
+    "optionalPlugins": [
+      "indexManagement",
+    ],
     "requiredBundles": [
       "kibanaReact"
     ]
diff --git a/x-pack/plugins/serverless_search/public/application/components/connectors/connector_config/connector_link.tsx b/x-pack/plugins/serverless_search/public/application/components/connectors/connector_config/connector_link.tsx
index ddf8d990fe4820..0d373b820f2585 100644
--- a/x-pack/plugins/serverless_search/public/application/components/connectors/connector_config/connector_link.tsx
+++ b/x-pack/plugins/serverless_search/public/application/components/connectors/connector_config/connector_link.tsx
@@ -74,7 +74,7 @@ export const ConnectorLinkElasticsearch: React.FC<ConnectorLinkElasticsearchProp
             <span>
               <EuiButton
                 iconType={`${assetBasePath}/github_white.svg`}
-                href="https://github.com/elastic/connectors-python"
+                href="https://github.com/elastic/connectors"
                 fill
               >
                 {i18n.translate('xpack.serverlessSearch.connectors.runFromSourceLink', {
@@ -92,7 +92,7 @@ export const ConnectorLinkElasticsearch: React.FC<ConnectorLinkElasticsearchProp
                 {i18n.translate('xpack.serverlessSearch.connectors.variablesTitle', {
                   defaultMessage: 'Variables for your ',
                 })}
-                <EuiCode>connectors-python/config.yml</EuiCode>
+                <EuiCode>elastic/connectors/config.yml</EuiCode>
               </h3>
             </EuiTitle>
             <EuiSpacer />
diff --git a/x-pack/plugins/serverless_search/public/application/components/connectors_callout.tsx b/x-pack/plugins/serverless_search/public/application/components/connectors_callout.tsx
new file mode 100644
index 00000000000000..85d3db211c4797
--- /dev/null
+++ b/x-pack/plugins/serverless_search/public/application/components/connectors_callout.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import {
+  EuiButton,
+  EuiCallOut,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiText,
+  EuiToolTip,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+
+import { useConnectorTypes } from '../hooks/api/use_connector_types';
+import { useCreateConnector } from '../hooks/api/use_create_connector';
+
+const CONNECTOR_TYPES_DISPLAY = [
+  'azure_blob_storage',
+  'sharepoint_online',
+  's3',
+  'mongodb',
+  'google_cloud_storage',
+];
+
+export const ConnectorsCallout = () => {
+  const { data } = useConnectorTypes();
+  const { createConnector, isLoading } = useCreateConnector();
+
+  const allConnectorTypes = data?.connectors;
+  const connectorTypes = allConnectorTypes
+    ? CONNECTOR_TYPES_DISPLAY.map(
+        (type) => allConnectorTypes.find((connType) => connType.serviceType === type)!
+      )
+    : undefined;
+  const showConnectors = connectorTypes && connectorTypes.length;
+  return (
+    <EuiCallOut
+      title={i18n.translate('xpack.serverlessSearch.selectClient.connectorsCallout.title', {
+        defaultMessage: 'Sync your data using a connector client',
+      })}
+      size="m"
+      iconType="iInCircle"
+    >
+      <p>
+        <FormattedMessage
+          id="xpack.serverlessSearch.selectClient.connectorsCallout.description"
+          defaultMessage="Sync a range of popular third-party data sources to Elasticsearch, by deploying open code Elastic connectors on your own infrastructure."
+        />
+      </p>
+      <EuiFlexGroup alignItems="center" gutterSize="m">
+        <EuiFlexItem grow={false}>
+          <p>
+            <EuiButton
+              color="primary"
+              fill
+              data-test-subj="connectors-callout-cta"
+              onClick={() => createConnector()}
+              isLoading={isLoading}
+            >
+              {i18n.translate('xpack.serverlessSearch.selectClient.connectorsCallout.cta', {
+                defaultMessage: 'Create a connector',
+              })}
+            </EuiButton>
+          </p>
+        </EuiFlexItem>
+        <EuiFlexItem />
+        {showConnectors &&
+          connectorTypes.map((connectorType) => (
+            <EuiFlexItem grow={false} key={connectorType.serviceType}>
+              <EuiToolTip content={connectorType.name}>
+                <EuiIcon
+                  size="xxl"
+                  title={connectorType.name}
+                  id={connectorType.serviceType}
+                  type={connectorType.iconPath}
+                />
+              </EuiToolTip>
+            </EuiFlexItem>
+          ))}
+        {showConnectors && (
+          <EuiFlexItem grow={false}>
+            <p>
+              <EuiText color="subdued" size="s">
+                <FormattedMessage
+                  id="xpack.serverlessSearch.selectClient.connectorsCallout.etc"
+                  defaultMessage="and more"
+                />
+              </EuiText>
+            </p>
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
+    </EuiCallOut>
+  );
+};
diff --git a/x-pack/plugins/serverless_search/public/application/components/connectors_overview.tsx b/x-pack/plugins/serverless_search/public/application/components/connectors_overview.tsx
index f79dce303617b0..ebd7afc288d271 100644
--- a/x-pack/plugins/serverless_search/public/application/components/connectors_overview.tsx
+++ b/x-pack/plugins/serverless_search/public/application/components/connectors_overview.tsx
@@ -14,49 +14,23 @@ import {
   EuiPageTemplate,
   EuiText,
 } from '@elastic/eui';
-import { Connector } from '@kbn/search-connectors';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { useMutation } from '@tanstack/react-query';
-import React, { useEffect } from 'react';
+import React from 'react';
 
-import { generatePath } from 'react-router-dom';
 import { LEARN_MORE_LABEL } from '../../../common/i18n_string';
 import { PLUGIN_ID } from '../../../common';
 import { useConnectors } from '../hooks/api/use_connectors';
+import { useCreateConnector } from '../hooks/api/use_create_connector';
 import { useKibanaServices } from '../hooks/use_kibana';
 import { EmptyConnectorsPrompt } from './connectors/empty_connectors_prompt';
 import { ConnectorsTable } from './connectors/connectors_table';
-import { EDIT_CONNECTOR_PATH } from './connectors_router';
 
 export const ConnectorsOverview = () => {
   const { data, isLoading: connectorsLoading } = useConnectors();
-  const {
-    application: { navigateToUrl },
-    http,
-  } = useKibanaServices();
+  const { http } = useKibanaServices();
 
-  const {
-    data: connector,
-    isLoading,
-    isSuccess,
-    mutate,
-  } = useMutation({
-    mutationFn: async () => {
-      const result = await http.post<{ connector: Connector }>(
-        '/internal/serverless_search/connectors'
-      );
-      return result.connector;
-    },
-  });
-
-  useEffect(() => {
-    if (isSuccess) {
-      navigateToUrl(generatePath(EDIT_CONNECTOR_PATH, { id: connector?.id || '' }));
-    }
-  }, [connector, isSuccess, navigateToUrl]);
-
-  const createConnector = () => mutate();
+  const { createConnector, isLoading } = useCreateConnector();
 
   return (
     <EuiPageTemplate offset={0} grow restrictWidth data-test-subj="svlSearchConnectorsPage">
diff --git a/x-pack/plugins/serverless_search/public/application/components/index_mappings_docs_link.tsx b/x-pack/plugins/serverless_search/public/application/components/index_mappings_docs_link.tsx
new file mode 100644
index 00000000000000..fc1699beffa8f3
--- /dev/null
+++ b/x-pack/plugins/serverless_search/public/application/components/index_mappings_docs_link.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FunctionComponent } from 'react';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiLink,
+  EuiPanel,
+  EuiSpacer,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { CoreStart } from '@kbn/core/public';
+import { IndexContent } from '@kbn/index-management-plugin/public/services';
+
+const IndexMappingsDocsLink: FunctionComponent<{ docLinks: CoreStart['docLinks'] }> = ({
+  docLinks,
+}) => {
+  return (
+    <EuiPanel grow={false} paddingSize="l">
+      <EuiFlexGroup alignItems="center" gutterSize="s">
+        <EuiFlexItem grow={false}>
+          <EuiIcon type="iInCircle" />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiTitle size="xs">
+            <h2>
+              <FormattedMessage
+                id="xpack.serverlessSearch.indexMappings.ingestPipelinesDocs.title"
+                defaultMessage="Transform your searchable content"
+              />
+            </h2>
+          </EuiTitle>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="s" />
+      <EuiText>
+        <p>
+          <FormattedMessage
+            id="xpack.serverlessSearch.indexMappings.ingestPipelinesDocs.description"
+            defaultMessage="Want to add custom fields, or use trained ML models to analyze and enrich your
+          indexed documents? Use index-specific ingest pipelines to customize documents to your needs."
+          />
+        </p>
+      </EuiText>
+      <EuiSpacer size="m" />
+      <EuiLink href={docLinks.links.enterpriseSearch.ingestPipelines} target="_blank" external>
+        <FormattedMessage
+          id="xpack.serverlessSearch.indexMappings.ingestPipelinesDocs.linkLabel"
+          defaultMessage="Learn more about ingest pipelines"
+        />
+      </EuiLink>
+    </EuiPanel>
+  );
+};
+
+export const createIndexMappingsDocsLinkContent = (core: CoreStart): IndexContent => {
+  return {
+    renderContent: () => <IndexMappingsDocsLink docLinks={core.docLinks} />,
+  };
+};
diff --git a/x-pack/plugins/serverless_search/public/application/components/overview.tsx b/x-pack/plugins/serverless_search/public/application/components/overview.tsx
index bf66ae62855a56..cb32a66cea20d5 100644
--- a/x-pack/plugins/serverless_search/public/application/components/overview.tsx
+++ b/x-pack/plugins/serverless_search/public/application/components/overview.tsx
@@ -37,8 +37,6 @@ import type {
   LanguageDefinition,
   LanguageDefinitionSnippetArguments,
 } from '@kbn/search-api-panels';
-import { useQuery } from '@tanstack/react-query';
-import { Connector } from '@kbn/search-connectors';
 import { useLocation } from 'react-router-dom';
 import { docLinks } from '../../../common/doc_links';
 import { PLUGIN_ID } from '../../../common';
@@ -53,6 +51,7 @@ import { languageDefinitions } from './languages/languages';
 import { LanguageGrid } from './languages/language_grid';
 import './overview.scss';
 import { ApiKeyPanel } from './api_key/api_key';
+import { ConnectorsCallout } from './connectors_callout';
 
 export const ElasticsearchOverview = () => {
   const [selectedLanguage, setSelectedLanguage] = useState<LanguageDefinition>(javaDefinition);
@@ -82,12 +81,6 @@ export const ElasticsearchOverview = () => {
     }
   }, [hash]);
 
-  const { data: _data } = useQuery({
-    queryKey: ['fetchConnectors'],
-    queryFn: () =>
-      http.fetch<{ connectors: Connector[] }>('/internal/serverless_search/connectors'),
-  });
-
   return (
     <EuiPageTemplate offset={0} grow restrictWidth data-test-subj="svlSearchOverviewPage">
       <EuiPageTemplate.Section alignment="top" className="serverlessSearchHeaderSection">
@@ -100,7 +93,7 @@ export const ElasticsearchOverview = () => {
         bottomBorder="extended"
         data-test-subj="select-client-section"
       >
-        <SelectClientPanel docLinks={docLinks} http={http}>
+        <SelectClientPanel docLinks={docLinks} http={http} callout={<ConnectorsCallout />}>
           <EuiFlexItem>
             <LanguageGrid
               assetBasePath={assetBasePath}
diff --git a/x-pack/plugins/serverless_search/public/application/hooks/api/use_create_connector.tsx b/x-pack/plugins/serverless_search/public/application/hooks/api/use_create_connector.tsx
new file mode 100644
index 00000000000000..fc9c74b94b84b2
--- /dev/null
+++ b/x-pack/plugins/serverless_search/public/application/hooks/api/use_create_connector.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useEffect } from 'react';
+import { generatePath } from 'react-router-dom';
+import { useMutation } from '@tanstack/react-query';
+import { Connector } from '@kbn/search-connectors';
+import { EDIT_CONNECTOR_PATH } from '../../components/connectors_router';
+import { useKibanaServices } from '../use_kibana';
+
+export const useCreateConnector = () => {
+  const {
+    application: { navigateToUrl },
+    http,
+  } = useKibanaServices();
+  const {
+    data: connector,
+    isLoading,
+    isSuccess,
+    mutate,
+  } = useMutation({
+    mutationFn: async () => {
+      const result = await http.post<{ connector: Connector }>(
+        '/internal/serverless_search/connectors'
+      );
+      return result.connector;
+    },
+  });
+
+  useEffect(() => {
+    if (isSuccess) {
+      navigateToUrl(generatePath(EDIT_CONNECTOR_PATH, { id: connector?.id || '' }));
+    }
+  }, [connector, isSuccess, navigateToUrl]);
+
+  const createConnector = () => mutate();
+  return { createConnector, isLoading };
+};
diff --git a/x-pack/plugins/serverless_search/public/index.ts b/x-pack/plugins/serverless_search/public/index.ts
index 5031ccc61d1ac5..a0f2c3c6eceb93 100644
--- a/x-pack/plugins/serverless_search/public/index.ts
+++ b/x-pack/plugins/serverless_search/public/index.ts
@@ -4,7 +4,6 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import { ServerlessSearchPlugin } from './plugin';
 
 // This exports static code and TypeScript types,
diff --git a/x-pack/plugins/serverless_search/public/plugin.ts b/x-pack/plugins/serverless_search/public/plugin.ts
index 6f1cb6465106c5..42039256503853 100644
--- a/x-pack/plugins/serverless_search/public/plugin.ts
+++ b/x-pack/plugins/serverless_search/public/plugin.ts
@@ -15,6 +15,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { appIds } from '@kbn/management-cards-navigation';
 import { AuthenticatedUser } from '@kbn/security-plugin/common';
+import { createIndexMappingsDocsLinkContent as createIndexMappingsContent } from './application/components/index_mappings_docs_link';
 import { createServerlessSearchSideNavComponent as createComponent } from './layout/nav';
 import { docLinks } from '../common/doc_links';
 import {
@@ -85,7 +86,7 @@ export class ServerlessSearchPlugin
 
   public start(
     core: CoreStart,
-    { serverless, management, cloud }: ServerlessSearchPluginStartDependencies
+    { serverless, management, cloud, indexManagement }: ServerlessSearchPluginStartDependencies
   ): ServerlessSearchPluginStart {
     serverless.setProjectHome('/app/elasticsearch');
     serverless.setSideNavComponent(createComponent(core, { serverless, cloud }));
@@ -94,6 +95,7 @@ export class ServerlessSearchPlugin
       enabled: true,
       hideLinksTo: [appIds.MAINTENANCE_WINDOWS],
     });
+    indexManagement?.extensionsService.setIndexMappingsContent(createIndexMappingsContent(core));
     return {};
   }
 
diff --git a/x-pack/plugins/serverless_search/public/types.ts b/x-pack/plugins/serverless_search/public/types.ts
index 5b984289e2bd7e..039353fa4e8671 100644
--- a/x-pack/plugins/serverless_search/public/types.ts
+++ b/x-pack/plugins/serverless_search/public/types.ts
@@ -10,6 +10,7 @@ import { ManagementSetup, ManagementStart } from '@kbn/management-plugin/public'
 import { SecurityPluginStart } from '@kbn/security-plugin/public';
 import { ServerlessPluginSetup, ServerlessPluginStart } from '@kbn/serverless/public';
 import { SharePluginStart } from '@kbn/share-plugin/public';
+import { IndexManagementPluginStart } from '@kbn/index-management-plugin/public';
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface ServerlessSearchPluginSetup {}
@@ -29,4 +30,5 @@ export interface ServerlessSearchPluginStartDependencies {
   security: SecurityPluginStart;
   serverless: ServerlessPluginStart;
   share: SharePluginStart;
+  indexManagement?: IndexManagementPluginStart;
 }
diff --git a/x-pack/plugins/serverless_search/tsconfig.json b/x-pack/plugins/serverless_search/tsconfig.json
index 1886f0ccb21b9e..c07cff77aa19ee 100644
--- a/x-pack/plugins/serverless_search/tsconfig.json
+++ b/x-pack/plugins/serverless_search/tsconfig.json
@@ -36,5 +36,6 @@
     "@kbn/search-connectors",
     "@kbn/shared-ux-router",
     "@kbn/kibana-utils-plugin",
+    "@kbn/index-management-plugin",
   ]
 }
diff --git a/x-pack/plugins/session_view/server/index.ts b/x-pack/plugins/session_view/server/index.ts
index cd524ea86cde2a..f7fc70fd490a98 100644
--- a/x-pack/plugins/session_view/server/index.ts
+++ b/x-pack/plugins/session_view/server/index.ts
@@ -6,8 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SessionViewPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { SessionViewPlugin } = await import('./plugin');
   return new SessionViewPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/snapshot_restore/server/index.ts b/x-pack/plugins/snapshot_restore/server/index.ts
index 1375cec6846fe6..dd2cab68dbdf4d 100644
--- a/x-pack/plugins/snapshot_restore/server/index.ts
+++ b/x-pack/plugins/snapshot_restore/server/index.ts
@@ -6,8 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { SnapshotRestoreServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { SnapshotRestoreServerPlugin } = await import('./plugin');
+  return new SnapshotRestoreServerPlugin(ctx);
+};
diff --git a/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx b/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
index 5a418286596e3f..2c3f613db50a01 100644
--- a/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
+++ b/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
@@ -93,6 +93,7 @@ describe('spacesManagementApp', () => {
       <div>
         <div
           css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+          data-test-subj="kbnRedirectAppLink"
         >
           Spaces Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/","search":"","hash":""}},"maxSpaces":1000}
         </div>
@@ -119,6 +120,7 @@ describe('spacesManagementApp', () => {
       <div>
         <div
           css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+          data-test-subj="kbnRedirectAppLink"
         >
           Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{}},"history":{"action":"PUSH","length":1,"location":{"pathname":"/create","search":"","hash":""}},"allowFeatureVisibility":true}
         </div>
@@ -151,6 +153,7 @@ describe('spacesManagementApp', () => {
       <div>
         <div
           css="You have tried to stringify object returned from \`css\` function. It isn't supposed to be used directly (e.g. as value of the \`className\` prop), but rather handed to emotion so it can handle it (e.g. as value of \`css\` prop)."
+          data-test-subj="kbnRedirectAppLink"
         >
           Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{}},"spaceId":"some-space","history":{"action":"PUSH","length":1,"location":{"pathname":"/edit/some-space","search":"","hash":""}},"allowFeatureVisibility":true}
         </div>
diff --git a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
index e3183185022f65..b5d9be07d91af7 100644
--- a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
+++ b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
@@ -63,14 +63,19 @@ function toggleDisabledFeatures(
 ) {
   const disabledFeatureKeys = activeSpace.disabledFeatures;
 
-  const [enabledFeatures, disabledFeatures] = features.reduce(
+  const { enabledFeatures, disabledFeatures } = features.reduce(
     (acc, feature) => {
       if (disabledFeatureKeys.includes(feature.id)) {
-        return [acc[0], [...acc[1], feature]];
+        acc.disabledFeatures.push(feature);
+      } else {
+        acc.enabledFeatures.push(feature);
       }
-      return [[...acc[0], feature], acc[1]];
+      return acc;
     },
-    [[], []] as [KibanaFeature[], KibanaFeature[]]
+    { enabledFeatures: [], disabledFeatures: [] } as {
+      enabledFeatures: KibanaFeature[];
+      disabledFeatures: KibanaFeature[];
+    }
   );
 
   const navLinks = capabilities.navLinks;
diff --git a/x-pack/plugins/spaces/server/index.ts b/x-pack/plugins/spaces/server/index.ts
index b7b97692f803eb..ba949628c56e11 100644
--- a/x-pack/plugins/spaces/server/index.ts
+++ b/x-pack/plugins/spaces/server/index.ts
@@ -8,7 +8,6 @@
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 
 import { ConfigSchema } from './config';
-import { SpacesPlugin } from './plugin';
 
 // These exports are part of public Spaces plugin contract, any change in signature of exported
 // functions or removal of exports should be considered as a breaking change. Ideally we should
@@ -37,5 +36,7 @@ export const config: PluginConfigDescriptor = {
   },
 };
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new SpacesPlugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { SpacesPlugin } = await import('./plugin');
+  return new SpacesPlugin(initializerContext);
+};
diff --git a/x-pack/plugins/stack_alerts/server/index.ts b/x-pack/plugins/stack_alerts/server/index.ts
index d6ca5109007d7e..92fcf8730ec78a 100644
--- a/x-pack/plugins/stack_alerts/server/index.ts
+++ b/x-pack/plugins/stack_alerts/server/index.ts
@@ -7,7 +7,6 @@
 import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { AlertingBuiltinsPlugin } from './plugin';
 export { ID as INDEX_THRESHOLD_ID } from './rule_types/index_threshold/rule_type';
 
 export const configSchema = schema.object({});
@@ -34,4 +33,7 @@ export const config: PluginConfigDescriptor<Config> = {
   ],
 };
 
-export const plugin = (ctx: PluginInitializerContext) => new AlertingBuiltinsPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { AlertingBuiltinsPlugin } = await import('./plugin');
+  return new AlertingBuiltinsPlugin(ctx);
+};
diff --git a/x-pack/plugins/stack_connectors/common/experimental_features.ts b/x-pack/plugins/stack_connectors/common/experimental_features.ts
index 4ac02dd9f06db8..b7f1fe2c1b87b2 100644
--- a/x-pack/plugins/stack_connectors/common/experimental_features.ts
+++ b/x-pack/plugins/stack_connectors/common/experimental_features.ts
@@ -12,7 +12,7 @@ export type ExperimentalFeatures = typeof allowedExperimentalValues;
  * This object is then used to validate and parse the value entered.
  */
 export const allowedExperimentalValues = Object.freeze({
-  isMustacheAutocompleteOn: false,
+  isMustacheAutocompleteOn: true,
   sentinelOneConnectorOn: false,
 });
 
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/email/email_params.tsx b/x-pack/plugins/stack_connectors/public/connector_types/email/email_params.tsx
index 2100e2b0d823c7..7da7ae0ce417d4 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/email/email_params.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/email/email_params.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useState, useEffect, useMemo } from 'react';
+import React, { useState, useEffect } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiComboBox, EuiButtonEmpty, EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
@@ -15,8 +15,6 @@ import {
   TextAreaWithMessageVariables,
 } from '@kbn/triggers-actions-ui-plugin/public';
 import { EmailActionParams } from '../types';
-import { getIsExperimentalFeatureEnabled } from '../../common/get_experimental_features';
-import { TextAreaWithAutocomplete } from '../../components/text_area_with_autocomplete';
 
 const noop = () => {};
 
@@ -32,8 +30,8 @@ export const EmailParamsFields = ({
   onBlur = noop,
   showEmailSubjectAndMessage = true,
   useDefaultMessage,
+  ruleTypeId,
 }: ActionParamsProps<EmailActionParams>) => {
-  const isMustacheAutocompleteOn = getIsExperimentalFeatureEnabled('isMustacheAutocompleteOn');
   const { to, cc, bcc, subject, message } = actionParams;
   const toOptions = to ? to.map((label: string) => ({ label })) : [];
   const ccOptions = cc ? cc.map((label: string) => ({ label })) : [];
@@ -64,10 +62,6 @@ export const EmailParamsFields = ({
   const isBCCInvalid: boolean =
     errors.bcc !== undefined && errors.bcc.length > 0 && bcc !== undefined;
 
-  const TextAreaComponent = useMemo(() => {
-    return isMustacheAutocompleteOn ? TextAreaWithAutocomplete : TextAreaWithMessageVariables;
-  }, [isMustacheAutocompleteOn]);
-
   return (
     <>
       <EuiFormRow
@@ -239,7 +233,7 @@ export const EmailParamsFields = ({
         </EuiFormRow>
       )}
       {showEmailSubjectAndMessage && (
-        <TextAreaComponent
+        <TextAreaWithMessageVariables
           index={index}
           editAction={editAction}
           messageVariables={messageVariables}
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/opsgenie/params.test.tsx b/x-pack/plugins/stack_connectors/public/connector_types/opsgenie/params.test.tsx
index 562fd66d031dd6..741a8b126664cf 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/opsgenie/params.test.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/opsgenie/params.test.tsx
@@ -13,7 +13,6 @@ import { ActionConnectorMode } from '@kbn/triggers-actions-ui-plugin/public';
 import { MockCodeEditor } from '@kbn/triggers-actions-ui-plugin/public/application/code_editor.mock';
 import { OpsgenieSubActions } from '../../../common';
 import type { OpsgenieActionParams } from '../../../server/connector_types';
-
 const kibanaReactPath = '../../../../../../src/plugins/kibana_react/public';
 
 jest.mock(kibanaReactPath, () => {
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/server_log/server_log_params.tsx b/x-pack/plugins/stack_connectors/public/connector_types/server_log/server_log_params.tsx
index 7c742452898333..95314c5fb71269 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/server_log/server_log_params.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/server_log/server_log_params.tsx
@@ -37,7 +37,7 @@ export const ServerLogParamsFields: React.FunctionComponent<
       editAction('level', 'info', index);
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
+  }, [actionParams.level]);
 
   const [[isUsingDefault, defaultMessageUsed], setDefaultMessageUsage] = useState<
     [boolean, string | undefined]
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/slack/action_form.test.tsx b/x-pack/plugins/stack_connectors/public/connector_types/slack/action_form.test.tsx
index 4e86a25ed26d86..ed36daef3abf4c 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/slack/action_form.test.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/slack/action_form.test.tsx
@@ -16,6 +16,7 @@ import { IToasts } from '@kbn/core/public';
 import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import { getConnectorType as getSlackConnectorType } from './slack';
 import { getSlackApiConnectorType } from '../slack_api';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 
 jest.mock('@kbn/triggers-actions-ui-plugin/public/common/lib/kibana');
 jest.mock('@kbn/kibana-react-plugin/public/ui_settings/use_ui_setting', () => ({
@@ -51,6 +52,14 @@ const { loadActionTypes } = jest.requireMock(
   '@kbn/triggers-actions-ui-plugin/public/application/lib/action_connector_api/connector_types'
 );
 const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+      cacheTime: 0,
+    },
+  },
+});
 
 // GET api/actions/connector_types?feature_id=alerting
 loadActionTypes.mockResolvedValue([
@@ -95,6 +104,7 @@ actionTypeRegistry.register(getSlackApiConnectorType());
 const baseProps = {
   actions: [],
   defaultActionGroupId: 'metrics.inventory_threshold.fired',
+  ruleTypeId: 'metrics.inventory_threshold',
   hasAlertsMappings: true,
   featureId: 'alerting',
   recoveryActionGroup: 'recovered',
@@ -170,7 +180,9 @@ describe('ActionForm - Slack API Connector', () => {
 
     render(
       <IntlProvider locale="en">
-        <ActionForm {...testProps} />
+        <QueryClientProvider client={queryClient}>
+          <ActionForm {...testProps} />
+        </QueryClientProvider>
       </IntlProvider>
     );
 
diff --git a/x-pack/plugins/stack_connectors/server/index.ts b/x-pack/plugins/stack_connectors/server/index.ts
index c41b13ee2b15ca..4b8ae8580cf960 100644
--- a/x-pack/plugins/stack_connectors/server/index.ts
+++ b/x-pack/plugins/stack_connectors/server/index.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { StackConnectorsPlugin } from './plugin';
 import { configSchema, ConfigSchema } from './config';
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
@@ -15,5 +14,7 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
 };
 
-export const plugin = (initContext: PluginInitializerContext) =>
-  new StackConnectorsPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { StackConnectorsPlugin } = await import('./plugin');
+  return new StackConnectorsPlugin(initContext);
+};
diff --git a/x-pack/plugins/stack_connectors/tsconfig.json b/x-pack/plugins/stack_connectors/tsconfig.json
index 4e47b703bf4334..e577ce018bdf3f 100644
--- a/x-pack/plugins/stack_connectors/tsconfig.json
+++ b/x-pack/plugins/stack_connectors/tsconfig.json
@@ -8,7 +8,7 @@
     // have to declare *.json explicitly due to https://github.com/microsoft/TypeScript/issues/25636
     "server/**/*.json",
     "common/**/*",
-    "public/**/*"
+    "public/**/*",
   ],
   "kbn_references": [
     "@kbn/core",
@@ -33,7 +33,6 @@
     "@kbn/core-saved-objects-common",
     "@kbn/core-http-browser-mocks",
     "@kbn/core-saved-objects-api-server-mocks",
-    "@kbn/alerts-ui-shared",
     "@kbn/alerting-plugin",
     "@kbn/securitysolution-ecs",
     "@kbn/ui-theme",
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx
index bac16812f1bf29..5a6492f552fc9b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/synthetics_app.tsx
@@ -10,11 +10,8 @@ import { Router } from '@kbn/shared-ux-router';
 import { EuiErrorBoundary } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { APP_WRAPPER_CLASS } from '@kbn/core/public';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  RedirectAppLinks,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
 import { InspectorContextProvider } from '@kbn/observability-shared-plugin/public';
 import { ObservabilityAIAssistantProvider } from '@kbn/observability-ai-assistant-plugin/public';
@@ -110,8 +107,9 @@ const Application = (props: SyntheticsAppProps) => {
                             <SyntheticsStartupPluginsContextProvider {...startPlugins}>
                               <div className={APP_WRAPPER_CLASS} data-test-subj="syntheticsApp">
                                 <RedirectAppLinks
-                                  className={APP_WRAPPER_CLASS}
-                                  application={core.application}
+                                  coreStart={{
+                                    application: core.application,
+                                  }}
                                 >
                                   <InspectorContextProvider>
                                     <PageRouter />
diff --git a/x-pack/plugins/synthetics/server/index.ts b/x-pack/plugins/synthetics/server/index.ts
index 3ed326d1fc143f..80cbe388a3015d 100644
--- a/x-pack/plugins/synthetics/server/index.ts
+++ b/x-pack/plugins/synthetics/server/index.ts
@@ -6,9 +6,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { Plugin } from './plugin';
-
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new Plugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { Plugin } = await import('./plugin');
+  return new Plugin(initializerContext);
+};
 
 export { config } from '../common/config';
diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/monitor_validation.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/monitor_validation.ts
index 4fbaed74173153..8b983c0c8f93c7 100644
--- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/monitor_validation.ts
+++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/monitor_validation.ts
@@ -18,23 +18,23 @@ import {
   DataStream,
   DataStreamCodec,
   HTTPFieldsCodec,
-  ICMPSimpleFieldsCodec,
   MonitorFields,
   TCPFieldsCodec,
   SyntheticsMonitor,
   Locations,
+  ICMPFieldsCodec,
 } from '../../../common/runtime_types';
 
 import { ALLOWED_SCHEDULES_IN_MINUTES } from '../../../common/constants/monitor_defaults';
 
 type MonitorCodecType =
-  | typeof ICMPSimpleFieldsCodec
+  | typeof ICMPFieldsCodec
   | typeof TCPFieldsCodec
   | typeof HTTPFieldsCodec
   | typeof BrowserFieldsCodec;
 
 const monitorTypeToCodecMap: Record<DataStream, MonitorCodecType> = {
-  [DataStream.ICMP]: ICMPSimpleFieldsCodec,
+  [DataStream.ICMP]: ICMPFieldsCodec,
   [DataStream.TCP]: TCPFieldsCodec,
   [DataStream.HTTP]: HTTPFieldsCodec,
   [DataStream.BROWSER]: BrowserFieldsCodec,
@@ -67,7 +67,7 @@ export function validateMonitor(monitorFields: MonitorFields): ValidationResult
   }
 
   // Cast it to ICMPCodec to satisfy typing. During runtime, correct codec will be used to decode.
-  const SyntheticsMonitorCodec = monitorTypeToCodecMap[monitorType] as typeof ICMPSimpleFieldsCodec;
+  const SyntheticsMonitorCodec = monitorTypeToCodecMap[monitorType] as typeof ICMPFieldsCodec;
 
   if (!SyntheticsMonitorCodec) {
     return {
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
index aabedbe96443b7..1602a7d29f12fd 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
@@ -423,6 +423,9 @@ export class SyntheticsService {
     };
 
     for await (const result of finder.find()) {
+      if (result.saved_objects.length === 0) {
+        return;
+      }
       try {
         if (!output) {
           output = await this.getOutput();
diff --git a/x-pack/plugins/synthetics/tsconfig.json b/x-pack/plugins/synthetics/tsconfig.json
index ff288ec3cee97d..4492a20771d8ca 100644
--- a/x-pack/plugins/synthetics/tsconfig.json
+++ b/x-pack/plugins/synthetics/tsconfig.json
@@ -79,6 +79,7 @@
     "@kbn/observability-ai-assistant-plugin",
     "@kbn/unified-doc-viewer-plugin",
     "@kbn/discover-utils",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/task_manager/server/index.ts b/x-pack/plugins/task_manager/server/index.ts
index a6e9943df2d3cb..a7555b3316a8e2 100644
--- a/x-pack/plugins/task_manager/server/index.ts
+++ b/x-pack/plugins/task_manager/server/index.ts
@@ -7,10 +7,12 @@
 
 import { get } from 'lodash';
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
-import { TaskManagerPlugin } from './plugin';
 import { configSchema, TaskManagerConfig, MAX_WORKERS_LIMIT } from './config';
 
-export const plugin = (initContext: PluginInitializerContext) => new TaskManagerPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) => {
+  const { TaskManagerPlugin } = await import('./plugin');
+  return new TaskManagerPlugin(initContext);
+};
 
 export type {
   TaskInstance,
@@ -34,7 +36,12 @@ export {
   isEphemeralTaskRejectedDueToCapacityError,
   isSkipError,
   createSkipError,
+  createTaskRunError,
+  TaskErrorSource,
 } from './task_running';
+
+export type { DecoratedError } from './task_running';
+
 export type { RunNowResult, BulkUpdateTaskResult } from './task_scheduling';
 export { getOldestIdleActionTask } from './queries/oldest_idle_action_task';
 export {
diff --git a/x-pack/plugins/task_manager/server/lib/calculate_health_status.test.ts b/x-pack/plugins/task_manager/server/lib/calculate_health_status.test.ts
index 16caafb9828860..6c9a9efeb558ef 100644
--- a/x-pack/plugins/task_manager/server/lib/calculate_health_status.test.ts
+++ b/x-pack/plugins/task_manager/server/lib/calculate_health_status.test.ts
@@ -267,7 +267,7 @@ describe('calculateHealthStatus', () => {
         true,
         logger
       )
-    ).toEqual({ status: HealthStatus.Warning, reason: `no health stats available` });
+    ).toEqual({ status: HealthStatus.Uninitialized, reason: `no health stats available` });
   });
 
   test('should return error status if any stat has status error', () => {
diff --git a/x-pack/plugins/task_manager/server/lib/calculate_health_status.ts b/x-pack/plugins/task_manager/server/lib/calculate_health_status.ts
index 7826b701551d9b..15a206625efa84 100644
--- a/x-pack/plugins/task_manager/server/lib/calculate_health_status.ts
+++ b/x-pack/plugins/task_manager/server/lib/calculate_health_status.ts
@@ -21,7 +21,7 @@ export function calculateHealthStatus(
 
   // if stats are empty, return a warning
   if (isEmpty(summarizedStats.stats)) {
-    return { status: HealthStatus.Warning, reason: `no health stats available` };
+    return { status: HealthStatus.Uninitialized, reason: `no health stats available` };
   }
 
   // if "hot" health stats are any more stale than monitored_stats_required_freshness
diff --git a/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts b/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
index 62505a34d7f89a..a05eca7079ca4d 100644
--- a/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
+++ b/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
@@ -55,6 +55,7 @@ export interface MonitoringStats {
 }
 
 export enum HealthStatus {
+  Uninitialized = 'uninitialized',
   OK = 'OK',
   Warning = 'warn',
   Error = 'error',
diff --git a/x-pack/plugins/task_manager/server/polling/task_poller.ts b/x-pack/plugins/task_manager/server/polling/task_poller.ts
index 5c046b0c68a3d2..812f29d170e962 100644
--- a/x-pack/plugins/task_manager/server/polling/task_poller.ts
+++ b/x-pack/plugins/task_manager/server/polling/task_poller.ts
@@ -13,6 +13,7 @@ import { Observable, Subject } from 'rxjs';
 
 import { Option, none } from 'fp-ts/lib/Option';
 import { Logger } from '@kbn/core/server';
+import { TaskErrorSource } from '../task_running';
 import { Result, asOk, asErr } from '../lib/result_type';
 
 type WorkFn<H> = () => Promise<H>;
@@ -128,10 +129,12 @@ function asPollingError<T>(err: string | Error, type: PollingErrorType, data: Op
 export class PollingError<T> extends Error {
   public readonly type: PollingErrorType;
   public readonly data: Option<T>;
+  public readonly source: TaskErrorSource;
   constructor(message: string, type: PollingErrorType, data: Option<T>) {
     super(message);
     Object.setPrototypeOf(this, new.target.prototype);
     this.type = type;
     this.data = data;
+    this.source = TaskErrorSource.FRAMEWORK;
   }
 }
diff --git a/x-pack/plugins/task_manager/server/routes/health.ts b/x-pack/plugins/task_manager/server/routes/health.ts
index 7a348147b0b760..f6c6dfb88aad40 100644
--- a/x-pack/plugins/task_manager/server/routes/health.ts
+++ b/x-pack/plugins/task_manager/server/routes/health.ts
@@ -14,7 +14,7 @@ import {
 } from '@kbn/core/server';
 import { IClusterClient, DocLinksServiceSetup } from '@kbn/core/server';
 import { Observable, Subject } from 'rxjs';
-import { tap, map } from 'rxjs/operators';
+import { tap, map, filter } from 'rxjs/operators';
 import { throttleTime } from 'rxjs/operators';
 import { UsageCounter } from '@kbn/usage-collection-plugin/server';
 import { Logger, ServiceStatus, ServiceStatusLevels } from '@kbn/core/server';
@@ -114,7 +114,8 @@ export function healthRoute(params: HealthRouteParams): {
       }),
       // Only calculate the summarized stats (calculates all running averages and evaluates state)
       // when needed by throttling down to the requiredHotStatsFreshness
-      map((stats) => withServiceStatus(getHealthStatus(stats)))
+      map((stats) => withServiceStatus(getHealthStatus(stats))),
+      filter(([monitoredHealth]) => monitoredHealth.status !== HealthStatus.Uninitialized)
     )
     .subscribe(([monitoredHealth, serviceStatus]) => {
       serviceStatus$.next(serviceStatus);
diff --git a/x-pack/plugins/task_manager/server/task.ts b/x-pack/plugins/task_manager/server/task.ts
index b4c7d38e4ec3ae..b00f06b6a2395f 100644
--- a/x-pack/plugins/task_manager/server/task.ts
+++ b/x-pack/plugins/task_manager/server/task.ts
@@ -8,6 +8,7 @@
 import { ObjectType, schema, TypeOf } from '@kbn/config-schema';
 import { isErr, tryAsResult } from './lib/result_type';
 import { Interval, isInterval, parseIntervalAsMillisecond } from './lib/intervals';
+import { DecoratedError } from './task_running';
 
 /*
  * Type definitions and validations for tasks.
@@ -47,7 +48,7 @@ export type SuccessfulRunResult = {
    * recurring task). See the RunContext type definition for more details.
    */
   state: Record<string, unknown>;
-  hasError?: boolean;
+  taskRunError?: DecoratedError;
 } & (
   | // ensure a SuccessfulRunResult can either specify a new `runAt` or a new `schedule`, but not both
   {
@@ -75,7 +76,7 @@ export type FailedRunResult = SuccessfulRunResult & {
    * If specified, indicates that the task failed to accomplish its work. This is
    * logged out as a warning, and the task will be reattempted after a delay.
    */
-  error: Error;
+  error: DecoratedError;
 };
 
 export type RunResult = FailedRunResult | SuccessfulRunResult;
diff --git a/x-pack/plugins/task_manager/server/task_events.ts b/x-pack/plugins/task_manager/server/task_events.ts
index 277eddee6e435a..c0ae11528f843a 100644
--- a/x-pack/plugins/task_manager/server/task_events.ts
+++ b/x-pack/plugins/task_manager/server/task_events.ts
@@ -12,7 +12,7 @@ import { ConcreteTaskInstance } from './task';
 import { Result, Err } from './lib/result_type';
 import { ClaimAndFillPoolResult } from './lib/fill_pool';
 import { PollingError } from './polling';
-import { TaskRunResult } from './task_running';
+import { DecoratedError, TaskRunResult } from './task_running';
 import { EphemeralTaskInstanceRequest } from './ephemeral_task_lifecycle';
 import type { EventLoopDelayConfig } from './config';
 import { TaskManagerMetrics } from './metrics/task_metrics_collector';
@@ -75,7 +75,7 @@ export interface RanTask {
   isExpired: boolean;
 }
 export type ErroredTask = RanTask & {
-  error: Error;
+  error: DecoratedError;
 };
 
 export type TaskMarkRunning = TaskEvent<ConcreteTaskInstance, Error>;
diff --git a/x-pack/plugins/task_manager/server/task_running/errors.ts b/x-pack/plugins/task_manager/server/task_running/errors.ts
index 690615c4422353..2d8e09b5c24e00 100644
--- a/x-pack/plugins/task_manager/server/task_running/errors.ts
+++ b/x-pack/plugins/task_manager/server/task_running/errors.ts
@@ -13,10 +13,17 @@ const CODE_SKIP = 'TaskManager/skip';
 
 const code = Symbol('TaskManagerErrorCode');
 const retry = Symbol('TaskManagerErrorRetry');
+const source = Symbol('TaskManagerErrorSource');
+
+export enum TaskErrorSource {
+  FRAMEWORK = 'framework',
+  USER = 'user',
+}
 
 export interface DecoratedError extends Error {
   [code]?: string;
   [retry]?: Date | boolean;
+  [source]?: TaskErrorSource;
 }
 
 export class EphemeralTaskRejectedDueToCapacityError extends Error {
@@ -40,8 +47,9 @@ export function isUnrecoverableError(error: Error | DecoratedError) {
   return isTaskManagerError(error) && error[code] === CODE_UNRECOVERABLE;
 }
 
-export function throwUnrecoverableError(error: Error) {
+export function throwUnrecoverableError(error: Error, errorSource = TaskErrorSource.FRAMEWORK) {
   (error as DecoratedError)[code] = CODE_UNRECOVERABLE;
+  (error as DecoratedError)[source] = errorSource;
   throw error;
 }
 
@@ -52,14 +60,10 @@ export function isRetryableError(error: Error | DecoratedError) {
   return null;
 }
 
-export function createRetryableError(error: Error, shouldRetry: Date | boolean): DecoratedError {
+export function throwRetryableError(error: Error, shouldRetry: Date | boolean) {
   (error as DecoratedError)[code] = CODE_RETRYABLE;
   (error as DecoratedError)[retry] = shouldRetry;
-  return error;
-}
-
-export function throwRetryableError(error: Error, shouldRetry: Date | boolean) {
-  throw createRetryableError(error, shouldRetry);
+  throw error;
 }
 
 export function isSkipError(error: Error | DecoratedError) {
@@ -74,6 +78,14 @@ export function createSkipError(error: Error): DecoratedError {
   return error;
 }
 
+export function createTaskRunError(
+  error: Error,
+  errorSource = TaskErrorSource.FRAMEWORK
+): DecoratedError {
+  (error as DecoratedError)[source] = errorSource;
+  return error;
+}
+
 export function isEphemeralTaskRejectedDueToCapacityError(
   error: Error | EphemeralTaskRejectedDueToCapacityError
 ) {
diff --git a/x-pack/plugins/task_manager/server/task_running/task_runner.test.ts b/x-pack/plugins/task_manager/server/task_running/task_runner.test.ts
index 1ae176d6993b32..f59a88400fb53e 100644
--- a/x-pack/plugins/task_manager/server/task_running/task_runner.test.ts
+++ b/x-pack/plugins/task_manager/server/task_running/task_runner.test.ts
@@ -9,7 +9,13 @@ import _ from 'lodash';
 import sinon from 'sinon';
 import { secondsFromNow } from '../lib/intervals';
 import { asOk, asErr } from '../lib/result_type';
-import { TaskManagerRunner, TaskRunningStage, TaskRunResult } from '.';
+import {
+  createTaskRunError,
+  TaskErrorSource,
+  TaskManagerRunner,
+  TaskRunningStage,
+  TaskRunResult,
+} from '.';
 import {
   TaskEvent,
   asTaskRunEvent,
@@ -1393,7 +1399,7 @@ describe('TaskManagerRunner', () => {
         );
       });
 
-      test('emits TaskEvent when a recurring task returns a success result with hasError=true', async () => {
+      test('emits TaskEvent when a recurring task returns a success result with taskRunError', async () => {
         const id = _.random(1, 20).toString();
         const runAt = minutesFromNow(_.random(5));
         const onTaskEvent = jest.fn();
@@ -1408,7 +1414,11 @@ describe('TaskManagerRunner', () => {
               title: 'Bar!',
               createTaskRunner: () => ({
                 async run() {
-                  return { runAt, state: {}, hasError: true };
+                  return {
+                    runAt,
+                    state: {},
+                    taskRunError: createTaskRunError(new Error('test'), TaskErrorSource.FRAMEWORK),
+                  };
                 },
               }),
             },
@@ -1433,7 +1443,7 @@ describe('TaskManagerRunner', () => {
         );
       });
 
-      test('emits TaskEvent when a recurring task returns a success result with hasError=true but completes after timeout', async () => {
+      test('emits TaskEvent when a recurring task returns a success result with taskRunError but completes after timeout', async () => {
         fakeTimer = sinon.useFakeTimers(new Date(2023, 1, 1, 0, 0, 0, 0).valueOf());
         const id = _.random(1, 20).toString();
         const runAt = minutesFromNow(_.random(5));
@@ -1450,7 +1460,11 @@ describe('TaskManagerRunner', () => {
               timeout: `1s`,
               createTaskRunner: () => ({
                 async run() {
-                  return { runAt, state: {}, hasError: true };
+                  return {
+                    runAt,
+                    state: {},
+                    taskRunError: createTaskRunError(new Error('test'), TaskErrorSource.FRAMEWORK),
+                  };
                 },
               }),
             },
@@ -2061,6 +2075,8 @@ describe('TaskManagerRunner', () => {
       });
 
       test('does not resets skip attempts for a recurring task as long as there is an error', async () => {
+        const taskRunError = createTaskRunError(new Error('test'), TaskErrorSource.FRAMEWORK);
+
         const mockTaskInstance: Partial<ConcreteTaskInstance> = {
           schedule: { interval: '10m' },
           status: TaskStatus.Running,
@@ -2086,7 +2102,10 @@ describe('TaskManagerRunner', () => {
                   return { data: { indirectParams: { foo: 'bar' } } };
                 },
                 async run() {
-                  return { state: {}, hasError: true };
+                  return {
+                    state: {},
+                    taskRunError,
+                  };
                 },
               }),
               indirectParamsSchema: schema.object({
@@ -2103,7 +2122,12 @@ describe('TaskManagerRunner', () => {
         const instance = store.update.mock.calls[0][0];
         expect(instance.numSkippedRuns).toBe(mockTaskInstance.numSkippedRuns);
         expect(logger.warn).not.toHaveBeenCalled();
-        expect(result).toEqual(asOk({ state: {}, hasError: true }));
+        expect(result).toEqual(
+          asOk({
+            state: {},
+            taskRunError,
+          })
+        );
       });
 
       test('does not resets skip attempts for a non-recurring task as long as there is an error', async () => {
@@ -2212,6 +2236,8 @@ describe('TaskManagerRunner', () => {
       });
 
       test('stops skipping when the max skip limit is reached', async () => {
+        const taskRunError = createTaskRunError(new Error('test'), TaskErrorSource.FRAMEWORK);
+
         const mockTaskInstance: Partial<ConcreteTaskInstance> = {
           status: TaskStatus.Running,
           startedAt: new Date(),
@@ -2238,7 +2264,10 @@ describe('TaskManagerRunner', () => {
                   return { data: { indirectParams: { baz: 'bar' } } };
                 },
                 async run() {
-                  return { state: {}, hasError: true };
+                  return {
+                    state: {},
+                    taskRunError,
+                  };
                 },
               }),
               indirectParamsSchema: schema.object({
@@ -2267,7 +2296,12 @@ describe('TaskManagerRunner', () => {
         expect(logger.warn).toHaveBeenCalledWith(
           'Task Manager has reached the max skip attempts for task bar/foo'
         );
-        expect(result).toEqual(asOk({ state: {}, hasError: true }));
+        expect(result).toEqual(
+          asOk({
+            state: {},
+            taskRunError,
+          })
+        );
       });
     });
   });
diff --git a/x-pack/plugins/task_manager/server/task_running/task_runner.ts b/x-pack/plugins/task_manager/server/task_running/task_runner.ts
index 63f520ade10311..62cb733980e577 100644
--- a/x-pack/plugins/task_manager/server/task_running/task_runner.ts
+++ b/x-pack/plugins/task_manager/server/task_running/task_runner.ts
@@ -664,12 +664,12 @@ export class TaskManagerRunner implements TaskRunner {
           skipAttempts,
         }: SuccessfulRunResult & { attempts: number; skipAttempts: number }) => {
           const { startedAt, schedule, numSkippedRuns } = this.instance.task;
-          const { hasError } = unwrap(result);
+          const { taskRunError } = unwrap(result);
           let requeueInvalidTaskAttempts = skipAttempts || numSkippedRuns || 0;
 
           // Alerting TaskRunner returns SuccessResult even though there is an error
-          // therefore we use "hasError" to be sure that there wasn't any error
-          if (isUndefined(skipAttempts) && !hasError) {
+          // therefore we use "taskRunError" to be sure that there wasn't any error
+          if (isUndefined(skipAttempts) && taskRunError === undefined) {
             requeueInvalidTaskAttempts = 0;
           }
 
@@ -747,7 +747,7 @@ export class TaskManagerRunner implements TaskRunner {
 
     await eitherAsync(
       result,
-      async ({ runAt, schedule, hasError }: SuccessfulRunResult) => {
+      async ({ runAt, schedule, taskRunError }: SuccessfulRunResult) => {
         const processedResult = {
           task,
           persistence:
@@ -757,10 +757,11 @@ export class TaskManagerRunner implements TaskRunner {
             : this.processResultWhenDone()),
         };
 
-        // Alerting task runner returns SuccessfulRunResult with hasError=true
+        // Alerting task runner returns SuccessfulRunResult with taskRunError
         // when the alerting task fails, so we check for this condition in order
         // to emit the correct task run event for metrics collection
-        const taskRunEvent = hasError
+        // taskRunError contains the "source" (TaskErrorSource) data
+        const taskRunEvent = !!taskRunError
           ? asTaskRunEvent(
               this.id,
               asErr({
@@ -804,7 +805,6 @@ export class TaskManagerRunner implements TaskRunner {
         }
       );
     }
-
     return result;
   }
 
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/index.ts b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
index aab1bdb58fe59f..85a3adc243236f 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/index.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
@@ -5,13 +5,12 @@
  * 2.0.
  */
 
-import { TelemetryCollectionXpackPlugin } from './plugin';
-
 export type { ESLicense } from './telemetry_collection';
 
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin() {
+export async function plugin() {
+  const { TelemetryCollectionXpackPlugin } = await import('./plugin');
   return new TelemetryCollectionXpackPlugin();
 }
diff --git a/x-pack/plugins/threat_intelligence/server/index.ts b/x-pack/plugins/threat_intelligence/server/index.ts
index c658a352a6077c..ac4810ed948033 100644
--- a/x-pack/plugins/threat_intelligence/server/index.ts
+++ b/x-pack/plugins/threat_intelligence/server/index.ts
@@ -6,8 +6,8 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { ThreatIntelligencePlugin } from './plugin';
 
-export const plugin = (context: PluginInitializerContext) => {
+export const plugin = async (context: PluginInitializerContext) => {
+  const { ThreatIntelligencePlugin } = await import('./plugin');
   return new ThreatIntelligencePlugin(context);
 };
diff --git a/x-pack/plugins/timelines/server/index.ts b/x-pack/plugins/timelines/server/index.ts
index c1f4c17e7d7571..acdcc26a0a1aa1 100644
--- a/x-pack/plugins/timelines/server/index.ts
+++ b/x-pack/plugins/timelines/server/index.ts
@@ -6,9 +6,9 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { TimelinesPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
+export async function plugin(initializerContext: PluginInitializerContext) {
+  const { TimelinesPlugin } = await import('./plugin');
   return new TimelinesPlugin(initializerContext);
 }
 
diff --git a/x-pack/plugins/transform/common/api_schemas/audit_messages.ts b/x-pack/plugins/transform/common/api_schemas/audit_messages.ts
index 438310f495e700..5027dba58f05ce 100644
--- a/x-pack/plugins/transform/common/api_schemas/audit_messages.ts
+++ b/x-pack/plugins/transform/common/api_schemas/audit_messages.ts
@@ -5,9 +5,20 @@
  * 2.0.
  */
 
+import { schema, TypeOf } from '@kbn/config-schema';
+
 import { TransformMessage } from '../types/messages';
 
 export interface GetTransformsAuditMessagesResponseSchema {
   messages: TransformMessage[];
   total: number;
 }
+
+export const getTransformAuditMessagesQuerySchema = schema.object({
+  sortField: schema.string(),
+  sortDirection: schema.oneOf([schema.literal('asc'), schema.literal('desc')]),
+});
+
+export type GetTransformAuditMessagesQuerySchema = TypeOf<
+  typeof getTransformAuditMessagesQuerySchema
+>;
diff --git a/x-pack/plugins/transform/common/constants.ts b/x-pack/plugins/transform/common/constants.ts
index ec26333a834a79..8ee030b2a953d7 100644
--- a/x-pack/plugins/transform/common/constants.ts
+++ b/x-pack/plugins/transform/common/constants.ts
@@ -216,3 +216,5 @@ export const DEFAULT_TRANSFORM_SETTINGS_MAX_PAGE_SEARCH_SIZE = 500;
 
 // Used in the transform list's expanded row for the messages and issues table.
 export const TIME_FORMAT = 'YYYY-MM-DD HH:mm:ss';
+
+export const TRANSFORM_NOTIFICATIONS_INDEX = '.transform-notifications-read';
diff --git a/x-pack/plugins/transform/common/types/transform.ts b/x-pack/plugins/transform/common/types/transform.ts
index 8c6690641873a8..2e244e69b70fa0 100644
--- a/x-pack/plugins/transform/common/types/transform.ts
+++ b/x-pack/plugins/transform/common/types/transform.ts
@@ -70,3 +70,12 @@ export interface LatestFunctionConfigUI {
   unique_key: Array<EuiComboBoxOptionOption<string>> | undefined;
   sort: EuiComboBoxOptionOption<string> | undefined;
 }
+
+export enum TRANSFORM_ACTIONS {
+  DELETE = 'delete',
+  REAUTHORIZE = 'reauthorize',
+  RESET = 'reset',
+  SCHEDULE_NOW = 'schedule_now',
+  STOP = 'stop',
+  START = 'start',
+}
diff --git a/x-pack/plugins/transform/server/index.ts b/x-pack/plugins/transform/server/index.ts
index 0688210a781379..2ae5ffbd3ccdf0 100644
--- a/x-pack/plugins/transform/server/index.ts
+++ b/x-pack/plugins/transform/server/index.ts
@@ -7,8 +7,9 @@
 
 import { PluginInitializerContext } from '@kbn/core/server';
 
-import { TransformServerPlugin } from './plugin';
-
-export const plugin = (ctx: PluginInitializerContext) => new TransformServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { TransformServerPlugin } = await import('./plugin');
+  return new TransformServerPlugin(ctx);
+};
 
 export { registerTransformHealthRuleType } from './lib/alerting';
diff --git a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
index 5c218a40abb455..8bf3fb16f6a0fe 100644
--- a/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
+++ b/x-pack/plugins/transform/server/lib/alerting/transform_health_rule_type/transform_health_service.ts
@@ -16,6 +16,7 @@ import { TransformHealthRuleParams } from './schema';
 import {
   ALL_TRANSFORMS_SELECTION,
   TRANSFORM_HEALTH_CHECK_NAMES,
+  TRANSFORM_NOTIFICATIONS_INDEX,
   TRANSFORM_RULE_TYPE,
   TRANSFORM_STATE,
 } from '../../../../common/constants';
@@ -27,7 +28,6 @@ import type {
 } from './register_transform_health_rule_type';
 import type { TransformHealthAlertRule } from '../../../../common/types/alerting';
 import { isContinuousTransform } from '../../../../common/types/transform';
-import { ML_DF_NOTIFICATION_INDEX_PATTERN } from '../../../routes/api/transforms_audit_messages';
 
 interface TestResult {
   isHealthy: boolean;
@@ -169,7 +169,7 @@ export function transformHealthServiceProvider({
         unknown,
         Record<'by_transform', estypes.AggregationsMultiBucketAggregateBase<TransformErrorsBucket>>
       >({
-        index: ML_DF_NOTIFICATION_INDEX_PATTERN,
+        index: TRANSFORM_NOTIFICATIONS_INDEX,
         size: 0,
         query: {
           bool: {
diff --git a/x-pack/plugins/transform/server/routes/api/audit_messages/register_route.ts b/x-pack/plugins/transform/server/routes/api/audit_messages/register_route.ts
new file mode 100644
index 00000000000000..be665d9acc890d
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/audit_messages/register_route.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { addInternalBasePath } from '../../../../common/constants';
+import {
+  transformIdParamSchema,
+  TransformIdParamSchema,
+} from '../../../../common/api_schemas/common';
+import {
+  getTransformAuditMessagesQuerySchema,
+  type GetTransformAuditMessagesQuerySchema,
+} from '../../../../common/api_schemas/audit_messages';
+
+import { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms Audit Messages
+   *
+   * @api {get} /internal/transform/transforms/:transformId/messages Transforms Messages
+   * @apiName GetTransformsMessages
+   * @apiDescription Get transforms audit messages
+   *
+   * @apiSchema (params) transformIdParamSchema
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms/{transformId}/messages'),
+      access: 'internal',
+    })
+    .addVersion<TransformIdParamSchema, GetTransformAuditMessagesQuerySchema, undefined>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: transformIdParamSchema,
+            query: getTransformAuditMessagesQuerySchema,
+          },
+        },
+      },
+      license.guardApiRoute<
+        TransformIdParamSchema,
+        GetTransformAuditMessagesQuerySchema,
+        undefined
+      >(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/audit_messages/route_handler.ts b/x-pack/plugins/transform/server/routes/api/audit_messages/route_handler.ts
new file mode 100644
index 00000000000000..81d1ee01645d52
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/audit_messages/route_handler.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import {
+  DEFAULT_MAX_AUDIT_MESSAGE_SIZE,
+  TRANSFORM_NOTIFICATIONS_INDEX,
+} from '../../../../common/constants';
+import type { TransformIdParamSchema } from '../../../../common/api_schemas/common';
+import { AuditMessage } from '../../../../common/types/messages';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+interface BoolQuery {
+  bool: { [key: string]: any };
+}
+
+interface TransformMessageQuery {
+  sortField: string;
+  sortDirection: 'asc' | 'desc';
+}
+
+export const routeHandler: RequestHandler<
+  TransformIdParamSchema,
+  TransformMessageQuery,
+  undefined
+> = async (ctx, req, res) => {
+  const { transformId } = req.params;
+  const sortField = req.query?.sortField ?? 'timestamp';
+  const sortDirection = req.query?.sortDirection ?? 'desc';
+
+  // search for audit messages,
+  // transformId is optional. without it, all transforms will be listed.
+  const query: BoolQuery = {
+    bool: {
+      filter: [
+        {
+          bool: {
+            must_not: {
+              term: {
+                level: 'activity',
+              },
+            },
+          },
+        },
+      ],
+    },
+  };
+
+  // if no transformId specified, load all of the messages
+  if (transformId !== undefined) {
+    query.bool.filter.push({
+      bool: {
+        should: [
+          {
+            term: {
+              transform_id: '', // catch system messages
+            },
+          },
+          {
+            term: {
+              transform_id: transformId, // messages for specified transformId
+            },
+          },
+        ],
+      },
+    });
+  }
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const resp = await esClient.asCurrentUser.search<AuditMessage>({
+      index: TRANSFORM_NOTIFICATIONS_INDEX,
+      ignore_unavailable: true,
+      size: DEFAULT_MAX_AUDIT_MESSAGE_SIZE,
+      body: {
+        sort: [
+          { [sortField]: { order: sortDirection } },
+          { transform_id: { order: 'asc' as const } },
+        ],
+        query,
+      },
+      track_total_hits: true,
+    });
+    const totalHits =
+      typeof resp.hits.total === 'number' ? resp.hits.total : resp.hits.total!.value;
+
+    let messages: AuditMessage[] = [];
+    // TODO: remove typeof checks when appropriate overloading is added for the `search` API
+    if (
+      (typeof resp.hits.total === 'number' && resp.hits.total > 0) ||
+      (typeof resp.hits.total === 'object' && resp.hits.total.value > 0)
+    ) {
+      messages = resp.hits.hits.map((hit) => hit._source!);
+    }
+    return res.ok({ body: { messages, total: totalHits } });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/delete_transforms/delete_transforms.ts b/x-pack/plugins/transform/server/routes/api/delete_transforms/delete_transforms.ts
new file mode 100644
index 00000000000000..00c0f4b40acfbe
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/delete_transforms/delete_transforms.ts
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { KibanaResponseFactory, RequestHandlerContext } from '@kbn/core/server';
+import type { DataViewsService } from '@kbn/data-views-plugin/common';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import { TRANSFORM_STATE } from '../../../../common/constants';
+import type { ResponseStatus } from '../../../../common/api_schemas/common';
+import type {
+  DeleteTransformsRequestSchema,
+  DeleteTransformsResponseSchema,
+} from '../../../../common/api_schemas/delete_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+async function getDataViewId(indexName: string, dataViewsService: DataViewsService) {
+  const dv = (await dataViewsService.find(indexName)).find(({ title }) => title === indexName);
+  return dv?.id;
+}
+
+async function deleteDestDataViewById(dataViewId: string, dataViewsService: DataViewsService) {
+  return await dataViewsService.delete(dataViewId);
+}
+
+export async function deleteTransforms(
+  reqBody: DeleteTransformsRequestSchema,
+  ctx: RequestHandlerContext,
+  response: KibanaResponseFactory,
+  dataViewsService: DataViewsService
+) {
+  const { transformsInfo } = reqBody;
+
+  // Cast possible undefineds as booleans
+  const deleteDestIndex = !!reqBody.deleteDestIndex;
+  const deleteDestDataView = !!reqBody.deleteDestDataView;
+  const shouldForceDelete = !!reqBody.forceDelete;
+
+  const results: DeleteTransformsResponseSchema = {};
+
+  const coreContext = await ctx.core;
+  const esClient = coreContext.elasticsearch.client;
+
+  for (const transformInfo of transformsInfo) {
+    let destinationIndex: string | undefined;
+
+    const transformDeleted: ResponseStatus = { success: false };
+    const destIndexDeleted: ResponseStatus = { success: false };
+    const destDataViewDeleted: ResponseStatus = {
+      success: false,
+    };
+    const transformId = transformInfo.id;
+    // force delete only if the transform has failed
+    let needToForceDelete = false;
+
+    try {
+      if (transformInfo.state === TRANSFORM_STATE.FAILED) {
+        needToForceDelete = true;
+      }
+      if (!shouldForceDelete) {
+        // Grab destination index info to delete
+        try {
+          const body = await esClient.asCurrentUser.transform.getTransform({
+            transform_id: transformId,
+          });
+          const transformConfig = body.transforms[0];
+          destinationIndex = transformConfig.dest.index;
+        } catch (getTransformConfigError) {
+          transformDeleted.error = getTransformConfigError.meta.body.error;
+          results[transformId] = {
+            transformDeleted,
+            destIndexDeleted,
+            destDataViewDeleted,
+            destinationIndex,
+          };
+          // No need to perform further delete attempts
+          continue;
+        }
+      }
+
+      // Delete the data view if there's a data view that matches the name of dest index
+      if (destinationIndex && deleteDestDataView) {
+        try {
+          const dataViewId = await getDataViewId(destinationIndex, dataViewsService);
+          if (dataViewId) {
+            await deleteDestDataViewById(dataViewId, dataViewsService);
+            destDataViewDeleted.success = true;
+          }
+        } catch (deleteDestDataViewError) {
+          destDataViewDeleted.error = deleteDestDataViewError.meta.body.error;
+        }
+      }
+
+      try {
+        await esClient.asCurrentUser.transform.deleteTransform({
+          transform_id: transformId,
+          force: shouldForceDelete && needToForceDelete,
+          // @ts-expect-error ES type needs to be updated
+          delete_dest_index: deleteDestIndex,
+        });
+        transformDeleted.success = true;
+        destIndexDeleted.success = deleteDestIndex;
+      } catch (deleteTransformJobError) {
+        transformDeleted.error = deleteTransformJobError.meta.body.error;
+        if (deleteTransformJobError.statusCode === 403) {
+          return response.forbidden();
+        }
+      }
+
+      results[transformId] = {
+        transformDeleted,
+        destIndexDeleted,
+        destDataViewDeleted,
+        destinationIndex,
+      };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformInfo.id,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.DELETE,
+        });
+      }
+      results[transformId] = { transformDeleted: { success: false, error: e.meta.body.error } };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/delete_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/delete_transforms/register_route.ts
new file mode 100644
index 00000000000000..cdb58c02d96641
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/delete_transforms/register_route.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  deleteTransformsRequestSchema,
+  type DeleteTransformsRequestSchema,
+} from '../../../../common/api_schemas/delete_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandlerFactory } from './route_handler_factory';
+
+export function registerRoute(routeDependencies: RouteDependencies) {
+  const { router, license } = routeDependencies;
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/delete_transforms Post delete transforms
+   * @apiName DeleteTransforms
+   * @apiDescription Deletes transforms
+   *
+   * @apiSchema (body) deleteTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('delete_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, DeleteTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: deleteTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, DeleteTransformsRequestSchema>(
+        routeHandlerFactory(routeDependencies)
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/delete_transforms/route_handler_factory.ts b/x-pack/plugins/transform/server/routes/api/delete_transforms/route_handler_factory.ts
new file mode 100644
index 00000000000000..81b51cabb62097
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/delete_transforms/route_handler_factory.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import { type DeleteTransformsRequestSchema } from '../../../../common/api_schemas/delete_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+import { RouteDependencies } from '../../../types';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { deleteTransforms } from './delete_transforms';
+
+export const routeHandlerFactory: (
+  routeDependencies: RouteDependencies
+) => RequestHandler<
+  undefined,
+  undefined,
+  DeleteTransformsRequestSchema,
+  TransformRequestHandlerContext
+> =
+  ({ coreStart, dataViews }) =>
+  async (ctx, req, res) => {
+    try {
+      const { savedObjects, elasticsearch } = coreStart;
+      const savedObjectsClient = savedObjects.getScopedClient(req);
+      const esClient = elasticsearch.client.asScoped(req).asCurrentUser;
+
+      const dataViewsService = await dataViews.dataViewsServiceFactory(
+        savedObjectsClient,
+        esClient,
+        req
+      );
+      const body = await deleteTransforms(req.body, ctx, res, dataViewsService);
+
+      if (body && body.status) {
+        if (body.status === 404) {
+          return res.notFound();
+        }
+        if (body.status === 403) {
+          return res.forbidden();
+        }
+      }
+
+      return res.ok({
+        body,
+      });
+    } catch (e) {
+      return res.customError(wrapError(wrapEsError(e)));
+    }
+  };
diff --git a/x-pack/plugins/transform/server/routes/api/field_histograms.ts b/x-pack/plugins/transform/server/routes/api/field_histograms.ts
deleted file mode 100644
index 39020201bdd6ff..00000000000000
--- a/x-pack/plugins/transform/server/routes/api/field_histograms.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { fetchHistogramsForFields } from '@kbn/ml-agg-utils';
-import { addInternalBasePath } from '../../../common/constants';
-
-import { dataViewTitleSchema, DataViewTitleSchema } from '../../../common/api_schemas/common';
-import {
-  fieldHistogramsRequestSchema,
-  FieldHistogramsRequestSchema,
-} from '../../../common/api_schemas/field_histograms';
-import { RouteDependencies } from '../../types';
-
-import { wrapError, wrapEsError } from './error_utils';
-
-export function registerFieldHistogramsRoutes({ router, license }: RouteDependencies) {
-  router.versioned
-    .post({
-      path: addInternalBasePath('field_histograms/{dataViewTitle}'),
-      access: 'internal',
-    })
-    .addVersion<DataViewTitleSchema, undefined, FieldHistogramsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: dataViewTitleSchema,
-            body: fieldHistogramsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<DataViewTitleSchema, undefined, FieldHistogramsRequestSchema>(
-        async (ctx, req, res) => {
-          const { dataViewTitle } = req.params;
-          const { query, fields, runtimeMappings, samplerShardSize } = req.body;
-
-          try {
-            const esClient = (await ctx.core).elasticsearch.client;
-            const resp = await fetchHistogramsForFields(
-              esClient.asCurrentUser,
-              dataViewTitle,
-              query,
-              fields,
-              samplerShardSize,
-              runtimeMappings
-            );
-
-            return res.ok({ body: resp });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-}
diff --git a/x-pack/plugins/transform/server/routes/api/field_histograms/register_route.ts b/x-pack/plugins/transform/server/routes/api/field_histograms/register_route.ts
new file mode 100644
index 00000000000000..5cba0b49675da6
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/field_histograms/register_route.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { addInternalBasePath } from '../../../../common/constants';
+
+import { dataViewTitleSchema, DataViewTitleSchema } from '../../../../common/api_schemas/common';
+import {
+  fieldHistogramsRequestSchema,
+  FieldHistogramsRequestSchema,
+} from '../../../../common/api_schemas/field_histograms';
+import { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  router.versioned
+    .post({
+      path: addInternalBasePath('field_histograms/{dataViewTitle}'),
+      access: 'internal',
+    })
+    .addVersion<DataViewTitleSchema, undefined, FieldHistogramsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: dataViewTitleSchema,
+            body: fieldHistogramsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<DataViewTitleSchema, undefined, FieldHistogramsRequestSchema>(
+        routeHandler
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/field_histograms/route_handler.ts b/x-pack/plugins/transform/server/routes/api/field_histograms/route_handler.ts
new file mode 100644
index 00000000000000..365813860462ae
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/field_histograms/route_handler.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+import { fetchHistogramsForFields } from '@kbn/ml-agg-utils';
+
+import type { DataViewTitleSchema } from '../../../../common/api_schemas/common';
+import type { FieldHistogramsRequestSchema } from '../../../../common/api_schemas/field_histograms';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  DataViewTitleSchema,
+  undefined,
+  FieldHistogramsRequestSchema
+> = async (ctx, req, res) => {
+  const { dataViewTitle } = req.params;
+  const { query, fields, runtimeMappings, samplerShardSize } = req.body;
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const resp = await fetchHistogramsForFields(
+      esClient.asCurrentUser,
+      dataViewTitle,
+      query,
+      fields,
+      samplerShardSize,
+      runtimeMappings
+    );
+
+    return res.ok({ body: resp });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/reauthorize_and_start_transforms.ts b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/reauthorize_and_start_transforms.ts
new file mode 100644
index 00000000000000..45d78999223a17
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/reauthorize_and_start_transforms.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient } from '@kbn/core/server';
+import type { TransportRequestOptions } from '@elastic/elasticsearch';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import type {
+  ReauthorizeTransformsRequestSchema,
+  ReauthorizeTransformsResponseSchema,
+} from '../../../../common/api_schemas/reauthorize_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+export async function reauthorizeAndStartTransforms(
+  transformsInfo: ReauthorizeTransformsRequestSchema,
+  esClient: ElasticsearchClient,
+  options?: TransportRequestOptions
+) {
+  const results: ReauthorizeTransformsResponseSchema = {};
+
+  for (const transformInfo of transformsInfo) {
+    const transformId = transformInfo.id;
+    try {
+      await esClient.transform.updateTransform(
+        {
+          body: {},
+          transform_id: transformId,
+        },
+        options ?? {}
+      );
+
+      await esClient.transform.startTransform(
+        {
+          transform_id: transformId,
+        },
+        { ignore: [409] }
+      );
+
+      results[transformId] = { success: true };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformId,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.REAUTHORIZE,
+        });
+      }
+      results[transformId] = { success: false, error: e.meta.body.error };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/register_route.ts
new file mode 100644
index 00000000000000..017aa98e76304c
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/register_route.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { StartTransformsRequestSchema } from '../../../../common/api_schemas/start_transforms';
+import { reauthorizeTransformsRequestSchema } from '../../../../common/api_schemas/reauthorize_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandlerFactory } from './route_handler_factory';
+
+export function registerRoute(routeDependencies: RouteDependencies) {
+  const { router, license } = routeDependencies;
+  /**
+   * @apiGroup Reauthorize transforms with API key generated from currently logged in user
+   * @api {post} /internal/transform/reauthorize_transforms Post reauthorize transforms
+   * @apiName Reauthorize Transforms
+   * @apiDescription Reauthorize transforms by generating an API Key for current user
+   * and update transform's es-secondary-authorization headers with the generated key,
+   * then start the transform.
+   * @apiSchema (body) reauthorizeTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('reauthorize_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, StartTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: reauthorizeTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, StartTransformsRequestSchema>(
+        routeHandlerFactory(routeDependencies)
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/route_handler_factory.ts b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/route_handler_factory.ts
new file mode 100644
index 00000000000000..acefdec0257a9d
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reauthorize_transforms/route_handler_factory.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import { generateTransformSecondaryAuthHeaders } from '../../../../common/utils/transform_api_key';
+import type { StartTransformsRequestSchema } from '../../../../common/api_schemas/start_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import type { RouteDependencies } from '../../../types';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { reauthorizeAndStartTransforms } from './reauthorize_and_start_transforms';
+
+export const routeHandlerFactory: (
+  routeDependencies: RouteDependencies
+) => RequestHandler<
+  undefined,
+  undefined,
+  StartTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = (routeDependencies) => async (ctx, req, res) => {
+  const { coreStart, security: securityStart } = routeDependencies;
+
+  try {
+    const transformsInfo = req.body;
+    const { elasticsearch } = coreStart;
+    const esClient = elasticsearch.client.asScoped(req).asCurrentUser;
+
+    let apiKeyWithCurrentUserPermission;
+
+    // If security is not enabled or available, user should not have the need to reauthorize
+    // in that case, start anyway
+    if (securityStart) {
+      apiKeyWithCurrentUserPermission = await securityStart.authc.apiKeys.grantAsInternalUser(req, {
+        name: `auto-generated-transform-api-key`,
+        role_descriptors: {},
+      });
+    }
+    const secondaryAuth = generateTransformSecondaryAuthHeaders(apiKeyWithCurrentUserPermission);
+
+    const authorizedTransforms = await reauthorizeAndStartTransforms(transformsInfo, esClient, {
+      ...(secondaryAuth ? secondaryAuth : {}),
+    });
+    return res.ok({ body: authorizedTransforms });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/reset_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/reset_transforms/register_route.ts
new file mode 100644
index 00000000000000..cae6245455810a
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reset_transforms/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  resetTransformsRequestSchema,
+  type ResetTransformsRequestSchema,
+} from '../../../../common/api_schemas/reset_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/reset_transforms Post reset transforms
+   * @apiName ResetTransforms
+   * @apiDescription resets transforms
+   *
+   * @apiSchema (body) resetTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('reset_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, ResetTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: resetTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, ResetTransformsRequestSchema>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/reset_transforms/reset_transforms.ts b/x-pack/plugins/transform/server/routes/api/reset_transforms/reset_transforms.ts
new file mode 100644
index 00000000000000..e9d2edd52f4409
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reset_transforms/reset_transforms.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { KibanaResponseFactory, RequestHandlerContext } from '@kbn/core/server';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import type { ResponseStatus } from '../../../../common/api_schemas/common';
+import type {
+  ResetTransformsRequestSchema,
+  ResetTransformsResponseSchema,
+} from '../../../../common/api_schemas/reset_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+export async function resetTransforms(
+  reqBody: ResetTransformsRequestSchema,
+  ctx: RequestHandlerContext,
+  response: KibanaResponseFactory
+) {
+  const { transformsInfo } = reqBody;
+
+  const results: ResetTransformsResponseSchema = {};
+  const esClient = (await ctx.core).elasticsearch.client;
+
+  for (const transformInfo of transformsInfo) {
+    const transformReset: ResponseStatus = { success: false };
+    const transformId = transformInfo.id;
+
+    try {
+      try {
+        await esClient.asCurrentUser.transform.resetTransform({
+          transform_id: transformId,
+        });
+        transformReset.success = true;
+      } catch (resetTransformJobError) {
+        transformReset.error = resetTransformJobError.meta.body.error;
+        if (resetTransformJobError.statusCode === 403) {
+          return response.forbidden();
+        }
+      }
+
+      results[transformId] = {
+        transformReset,
+      };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformInfo.id,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.RESET,
+        });
+      }
+      results[transformId] = { transformReset: { success: false, error: e.meta.body.error } };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/reset_transforms/route_handler.ts b/x-pack/plugins/transform/server/routes/api/reset_transforms/route_handler.ts
new file mode 100644
index 00000000000000..d10a093ae5ee2a
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/reset_transforms/route_handler.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { ResetTransformsRequestSchema } from '../../../../common/api_schemas/reset_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { resetTransforms } from './reset_transforms';
+
+export const routeHandler: RequestHandler<
+  undefined,
+  undefined,
+  ResetTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  try {
+    const body = await resetTransforms(req.body, ctx, res);
+
+    if (body && body.status) {
+      if (body.status === 404) {
+        return res.notFound();
+      }
+      if (body.status === 403) {
+        return res.forbidden();
+      }
+    }
+
+    return res.ok({
+      body,
+    });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/register_route.ts
new file mode 100644
index 00000000000000..cf19b56c316f1e
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  scheduleNowTransformsRequestSchema,
+  type ScheduleNowTransformsRequestSchema,
+} from '../../../../common/api_schemas/schedule_now_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/schedule_now_transforms Schedules transforms now
+   * @apiName PostScheduleNowTransforms
+   * @apiDescription Schedules transforms now
+   *
+   * @apiSchema (body) scheduleNowTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('schedule_now_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, ScheduleNowTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: scheduleNowTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, ScheduleNowTransformsRequestSchema>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/route_handler.ts b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/route_handler.ts
new file mode 100644
index 00000000000000..53099f7270b7a4
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/route_handler.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { ScheduleNowTransformsRequestSchema } from '../../../../common/api_schemas/schedule_now_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { scheduleNowTransforms } from './schedule_now_transforms';
+
+export const routeHandler: RequestHandler<
+  undefined,
+  undefined,
+  ScheduleNowTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const transformsInfo = req.body;
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    return res.ok({
+      body: await scheduleNowTransforms(transformsInfo, esClient.asCurrentUser),
+    });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/schedule_now_transforms.ts b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/schedule_now_transforms.ts
new file mode 100644
index 00000000000000..fddcaf78185d4e
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/schedule_now_transforms/schedule_now_transforms.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from '@kbn/core/server';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import type {
+  ScheduleNowTransformsRequestSchema,
+  ScheduleNowTransformsResponseSchema,
+} from '../../../../common/api_schemas/schedule_now_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+export async function scheduleNowTransforms(
+  transformsInfo: ScheduleNowTransformsRequestSchema,
+  esClient: ElasticsearchClient
+) {
+  const results: ScheduleNowTransformsResponseSchema = {};
+
+  for (const transformInfo of transformsInfo) {
+    const transformId = transformInfo.id;
+    try {
+      await esClient.transport.request({
+        method: 'POST',
+        path: `_transform/${transformId}/_schedule_now`,
+      });
+
+      results[transformId] = { success: true };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformId,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.SCHEDULE_NOW,
+        });
+      }
+      results[transformId] = { success: false, error: e.meta.body.error };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/start_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/start_transforms/register_route.ts
new file mode 100644
index 00000000000000..5cba3a5a01d70c
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/start_transforms/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  startTransformsRequestSchema,
+  type StartTransformsRequestSchema,
+} from '../../../../common/api_schemas/start_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/start_transforms Start transforms
+   * @apiName PostStartTransforms
+   * @apiDescription Starts transform
+   *
+   * @apiSchema (body) startTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('start_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, StartTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: startTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, StartTransformsRequestSchema>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/start_transforms/route_handler.ts b/x-pack/plugins/transform/server/routes/api/start_transforms/route_handler.ts
new file mode 100644
index 00000000000000..50bbf395a5ac7a
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/start_transforms/route_handler.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { StartTransformsRequestSchema } from '../../../../common/api_schemas/start_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { startTransforms } from './start_transforms';
+
+export const routeHandler: RequestHandler<
+  undefined,
+  undefined,
+  StartTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const transformsInfo = req.body;
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await startTransforms(transformsInfo, esClient.asCurrentUser);
+    return res.ok({
+      body,
+    });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/start_transforms/start_transforms.ts b/x-pack/plugins/transform/server/routes/api/start_transforms/start_transforms.ts
new file mode 100644
index 00000000000000..d8097001df9bbb
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/start_transforms/start_transforms.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient } from '@kbn/core/server';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import type {
+  StartTransformsRequestSchema,
+  StartTransformsResponseSchema,
+} from '../../../../common/api_schemas/start_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+export async function startTransforms(
+  transformsInfo: StartTransformsRequestSchema,
+  esClient: ElasticsearchClient
+) {
+  const results: StartTransformsResponseSchema = {};
+
+  for (const transformInfo of transformsInfo) {
+    const transformId = transformInfo.id;
+    try {
+      await esClient.transform.startTransform({
+        transform_id: transformId,
+      });
+      results[transformId] = { success: true };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformId,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.START,
+        });
+      }
+      results[transformId] = { success: false, error: e.meta.body.error };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/stop_transforms/register_route.ts b/x-pack/plugins/transform/server/routes/api/stop_transforms/register_route.ts
new file mode 100644
index 00000000000000..df9498f9ae0333
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/stop_transforms/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  stopTransformsRequestSchema,
+  type StopTransformsRequestSchema,
+} from '../../../../common/api_schemas/stop_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/stop_transforms Stop transforms
+   * @apiName PostStopTransforms
+   * @apiDescription Stops transform
+   *
+   * @apiSchema (body) stopTransformsRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('stop_transforms'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, StopTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: stopTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, StopTransformsRequestSchema>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/stop_transforms/route_handler.ts b/x-pack/plugins/transform/server/routes/api/stop_transforms/route_handler.ts
new file mode 100644
index 00000000000000..3ad753ec24c558
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/stop_transforms/route_handler.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { StopTransformsRequestSchema } from '../../../../common/api_schemas/stop_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+import { stopTransforms } from './stop_transforms';
+
+export const routeHandler: RequestHandler<
+  undefined,
+  undefined,
+  StopTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const transformsInfo = req.body;
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    return res.ok({
+      body: await stopTransforms(transformsInfo, esClient.asCurrentUser),
+    });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/stop_transforms/stop_transforms.ts b/x-pack/plugins/transform/server/routes/api/stop_transforms/stop_transforms.ts
new file mode 100644
index 00000000000000..2096c9f9f0ca51
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/stop_transforms/stop_transforms.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient } from '@kbn/core/server';
+
+import { TRANSFORM_ACTIONS } from '../../../../common/types/transform';
+import { TRANSFORM_STATE } from '../../../../common/constants';
+import type {
+  StopTransformsRequestSchema,
+  StopTransformsResponseSchema,
+} from '../../../../common/api_schemas/stop_transforms';
+
+import { isRequestTimeout, fillResultsWithTimeouts } from '../../utils/error_utils';
+
+export async function stopTransforms(
+  transformsInfo: StopTransformsRequestSchema,
+  esClient: ElasticsearchClient
+) {
+  const results: StopTransformsResponseSchema = {};
+
+  for (const transformInfo of transformsInfo) {
+    const transformId = transformInfo.id;
+    try {
+      await esClient.transform.stopTransform({
+        transform_id: transformId,
+        force:
+          transformInfo.state !== undefined
+            ? transformInfo.state === TRANSFORM_STATE.FAILED
+            : false,
+        wait_for_completion: true,
+      });
+      results[transformId] = { success: true };
+    } catch (e) {
+      if (isRequestTimeout(e)) {
+        return fillResultsWithTimeouts({
+          results,
+          id: transformId,
+          items: transformsInfo,
+          action: TRANSFORM_ACTIONS.STOP,
+        });
+      }
+      results[transformId] = { success: false, error: e.meta.body.error };
+    }
+  }
+  return results;
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms.ts b/x-pack/plugins/transform/server/routes/api/transforms.ts
deleted file mode 100644
index 80d44c0e907bf0..00000000000000
--- a/x-pack/plugins/transform/server/routes/api/transforms.ts
+++ /dev/null
@@ -1,1021 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-
-import {
-  ElasticsearchClient,
-  KibanaResponseFactory,
-  RequestHandler,
-  RequestHandlerContext,
-} from '@kbn/core/server';
-
-import { DataViewsService } from '@kbn/data-views-plugin/common';
-import type { TransportRequestOptions } from '@elastic/elasticsearch';
-import { generateTransformSecondaryAuthHeaders } from '../../../common/utils/transform_api_key';
-import {
-  reauthorizeTransformsRequestSchema,
-  ReauthorizeTransformsRequestSchema,
-  ReauthorizeTransformsResponseSchema,
-} from '../../../common/api_schemas/reauthorize_transforms';
-import { addInternalBasePath, TRANSFORM_STATE } from '../../../common/constants';
-import {
-  transformIdParamSchema,
-  ResponseStatus,
-  TransformIdParamSchema,
-} from '../../../common/api_schemas/common';
-import {
-  deleteTransformsRequestSchema,
-  DeleteTransformsRequestSchema,
-  DeleteTransformsResponseSchema,
-} from '../../../common/api_schemas/delete_transforms';
-import {
-  resetTransformsRequestSchema,
-  ResetTransformsRequestSchema,
-  ResetTransformsResponseSchema,
-} from '../../../common/api_schemas/reset_transforms';
-import {
-  startTransformsRequestSchema,
-  StartTransformsRequestSchema,
-  StartTransformsResponseSchema,
-} from '../../../common/api_schemas/start_transforms';
-import {
-  stopTransformsRequestSchema,
-  StopTransformsRequestSchema,
-  StopTransformsResponseSchema,
-} from '../../../common/api_schemas/stop_transforms';
-import {
-  scheduleNowTransformsRequestSchema,
-  ScheduleNowTransformsRequestSchema,
-  ScheduleNowTransformsResponseSchema,
-} from '../../../common/api_schemas/schedule_now_transforms';
-import {
-  postTransformsUpdateRequestSchema,
-  PostTransformsUpdateRequestSchema,
-} from '../../../common/api_schemas/update_transforms';
-import {
-  postTransformsPreviewRequestSchema,
-  PostTransformsPreviewRequestSchema,
-  putTransformsRequestSchema,
-  PutTransformsRequestSchema,
-  PutTransformsResponseSchema,
-} from '../../../common/api_schemas/transforms';
-
-import { RouteDependencies } from '../../types';
-
-import { isRequestTimeout, fillResultsWithTimeouts, wrapError, wrapEsError } from './error_utils';
-import { registerTransformsAuditMessagesRoutes } from './transforms_audit_messages';
-import { registerTransformNodesRoutes } from './transforms_nodes';
-import { isLatestTransform } from '../../../common/types/transform';
-import { isKeywordDuplicate } from '../../../common/utils/field_utils';
-import { transformHealthServiceProvider } from '../../lib/alerting/transform_health_rule_type/transform_health_service';
-
-enum TRANSFORM_ACTIONS {
-  DELETE = 'delete',
-  REAUTHORIZE = 'reauthorize',
-  RESET = 'reset',
-  SCHEDULE_NOW = 'schedule_now',
-  STOP = 'stop',
-  START = 'start',
-}
-
-export function registerTransformsRoutes(routeDependencies: RouteDependencies) {
-  const { router, license, coreStart, dataViews, security: securityStart } = routeDependencies;
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {get} /internal/transform/transforms Get transforms
-   * @apiName GetTransforms
-   * @apiDescription Returns transforms
-   *
-   * @apiSchema (params) jobAuditMessagesJobIdSchema
-   * @apiSchema (query) jobAuditMessagesQuerySchema
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms'),
-      access: 'internal',
-    })
-    .addVersion(
-      {
-        version: '1',
-        validate: false,
-      },
-      license.guardApiRoute<estypes.TransformGetTransformRequest, undefined, undefined>(
-        async (ctx, req, res) => {
-          try {
-            const esClient = (await ctx.core).elasticsearch.client;
-            const body = await esClient.asCurrentUser.transform.getTransform({
-              size: 1000,
-              ...req.params,
-            });
-
-            const alerting = await ctx.alerting;
-            if (alerting) {
-              const transformHealthService = transformHealthServiceProvider({
-                esClient: esClient.asCurrentUser,
-                rulesClient: alerting.getRulesClient(),
-              });
-
-              // @ts-ignore
-              await transformHealthService.populateTransformsWithAssignedRules(body.transforms);
-            }
-
-            return res.ok({ body });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {get} /internal/transform/transforms/:transformId Get transform
-   * @apiName GetTransform
-   * @apiDescription Returns a single transform
-   *
-   * @apiSchema (params) transformIdParamSchema
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms/{transformId}'),
-      access: 'internal',
-    })
-    .addVersion<TransformIdParamSchema, undefined, undefined>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: transformIdParamSchema,
-          },
-        },
-      },
-      license.guardApiRoute<TransformIdParamSchema, undefined, undefined>(async (ctx, req, res) => {
-        const { transformId } = req.params;
-        try {
-          const esClient = (await ctx.core).elasticsearch.client;
-          const body = await esClient.asCurrentUser.transform.getTransform({
-            transform_id: transformId,
-          });
-          return res.ok({ body });
-        } catch (e) {
-          return res.customError(wrapError(wrapEsError(e)));
-        }
-      })
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {get} /internal/transform/transforms/_stats Get transforms stats
-   * @apiName GetTransformsStats
-   * @apiDescription Returns transforms stats
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms/_stats'),
-      access: 'internal',
-    })
-    .addVersion(
-      {
-        version: '1',
-        validate: false,
-      },
-      license.guardApiRoute<estypes.TransformGetTransformStatsResponse, undefined, undefined>(
-        async (ctx, req, res) => {
-          try {
-            const esClient = (await ctx.core).elasticsearch.client;
-            const body = await esClient.asCurrentUser.transform.getTransformStats(
-              {
-                size: 1000,
-                transform_id: '_all',
-              },
-              { maxRetries: 0 }
-            );
-            return res.ok({ body });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {get} /internal/transform/transforms/:transformId/_stats Get transform stats
-   * @apiName GetTransformStats
-   * @apiDescription Returns stats for a single transform
-   *
-   * @apiSchema (params) transformIdParamSchema
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms/{transformId}/_stats'),
-      access: 'internal',
-    })
-    .addVersion<TransformIdParamSchema, undefined, undefined>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: transformIdParamSchema,
-          },
-        },
-      },
-      license.guardApiRoute<TransformIdParamSchema, undefined, undefined>(async (ctx, req, res) => {
-        const { transformId } = req.params;
-        try {
-          const esClient = (await ctx.core).elasticsearch.client;
-          const body = await esClient.asCurrentUser.transform.getTransformStats(
-            {
-              transform_id: transformId,
-            },
-            { maxRetries: 0 }
-          );
-          return res.ok({ body });
-        } catch (e) {
-          return res.customError(wrapError(wrapEsError(e)));
-        }
-      })
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {put} /internal/transform/transforms/:transformId Put transform
-   * @apiName PutTransform
-   * @apiDescription Creates a transform
-   *
-   * @apiSchema (params) transformIdParamSchema
-   * @apiSchema (body) putTransformsRequestSchema
-   */
-  router.versioned
-    .put({
-      path: addInternalBasePath('transforms/{transformId}'),
-      access: 'internal',
-    })
-    .addVersion<TransformIdParamSchema, undefined, PutTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: transformIdParamSchema,
-            body: putTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<TransformIdParamSchema, undefined, PutTransformsRequestSchema>(
-        async (ctx, req, res) => {
-          const { transformId } = req.params;
-
-          const response: PutTransformsResponseSchema = {
-            transformsCreated: [],
-            errors: [],
-          };
-
-          const esClient = (await ctx.core).elasticsearch.client;
-          await esClient.asCurrentUser.transform
-            .putTransform({
-              // @ts-expect-error @elastic/elasticsearch group_by is expected to be optional in TransformPivot
-              body: req.body,
-              transform_id: transformId,
-            })
-            .then(() => {
-              response.transformsCreated.push({ transform: transformId });
-            })
-            .catch((e) =>
-              response.errors.push({
-                id: transformId,
-                error: wrapEsError(e),
-              })
-            );
-
-          return res.ok({ body: response });
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/transforms/:transformId/_update Post transform update
-   * @apiName PostTransformUpdate
-   * @apiDescription Updates a transform
-   *
-   * @apiSchema (params) transformIdParamSchema
-   * @apiSchema (body) postTransformsUpdateRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('transforms/{transformId}/_update'),
-      access: 'internal',
-    })
-    .addVersion<TransformIdParamSchema, undefined, PostTransformsUpdateRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: transformIdParamSchema,
-            body: postTransformsUpdateRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<TransformIdParamSchema, undefined, PostTransformsUpdateRequestSchema>(
-        async (ctx, req, res) => {
-          const { transformId } = req.params;
-
-          try {
-            const esClient = (await ctx.core).elasticsearch.client;
-            const body = await esClient.asCurrentUser.transform.updateTransform({
-              // @ts-expect-error query doesn't satisfy QueryDslQueryContainer from @elastic/elasticsearch
-              body: req.body,
-              transform_id: transformId,
-            });
-            return res.ok({
-              body,
-            });
-          } catch (e) {
-            return res.customError(wrapError(e));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Reauthorize transforms with API key generated from currently logged in user
-   * @api {post} /internal/transform/reauthorize_transforms Post reauthorize transforms
-   * @apiName Reauthorize Transforms
-   * @apiDescription Reauthorize transforms by generating an API Key for current user
-   * and update transform's es-secondary-authorization headers with the generated key,
-   * then start the transform.
-   * @apiSchema (body) reauthorizeTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('reauthorize_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, StartTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: reauthorizeTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, StartTransformsRequestSchema>(
-        async (ctx, req, res) => {
-          try {
-            const transformsInfo = req.body;
-            const { elasticsearch } = coreStart;
-            const esClient = elasticsearch.client.asScoped(req).asCurrentUser;
-
-            let apiKeyWithCurrentUserPermission;
-
-            // If security is not enabled or available, user should not have the need to reauthorize
-            // in that case, start anyway
-            if (securityStart) {
-              apiKeyWithCurrentUserPermission =
-                await securityStart.authc.apiKeys.grantAsInternalUser(req, {
-                  name: `auto-generated-transform-api-key`,
-                  role_descriptors: {},
-                });
-            }
-            const secondaryAuth = generateTransformSecondaryAuthHeaders(
-              apiKeyWithCurrentUserPermission
-            );
-
-            const authorizedTransforms = await reauthorizeAndStartTransforms(
-              transformsInfo,
-              esClient,
-              {
-                ...(secondaryAuth ? secondaryAuth : {}),
-              }
-            );
-            return res.ok({ body: authorizedTransforms });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/delete_transforms Post delete transforms
-   * @apiName DeleteTransforms
-   * @apiDescription Deletes transforms
-   *
-   * @apiSchema (body) deleteTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('delete_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, DeleteTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: deleteTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, DeleteTransformsRequestSchema>(
-        async (ctx, req, res) => {
-          try {
-            const { savedObjects, elasticsearch } = coreStart;
-            const savedObjectsClient = savedObjects.getScopedClient(req);
-            const esClient = elasticsearch.client.asScoped(req).asCurrentUser;
-
-            const dataViewsService = await dataViews.dataViewsServiceFactory(
-              savedObjectsClient,
-              esClient,
-              req
-            );
-            const body = await deleteTransforms(req.body, ctx, res, dataViewsService);
-
-            if (body && body.status) {
-              if (body.status === 404) {
-                return res.notFound();
-              }
-              if (body.status === 403) {
-                return res.forbidden();
-              }
-            }
-
-            return res.ok({
-              body,
-            });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/reset_transforms Post reset transforms
-   * @apiName ResetTransforms
-   * @apiDescription resets transforms
-   *
-   * @apiSchema (body) resetTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('reset_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, ResetTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: resetTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, ResetTransformsRequestSchema>(
-        async (ctx, req, res) => {
-          try {
-            const body = await resetTransforms(req.body, ctx, res);
-
-            if (body && body.status) {
-              if (body.status === 404) {
-                return res.notFound();
-              }
-              if (body.status === 403) {
-                return res.forbidden();
-              }
-            }
-
-            return res.ok({
-              body,
-            });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/transforms/_preview Preview transform
-   * @apiName PreviewTransform
-   * @apiDescription Previews transform
-   *
-   * @apiSchema (body) postTransformsPreviewRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('transforms/_preview'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, PostTransformsPreviewRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: postTransformsPreviewRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, PostTransformsPreviewRequestSchema>(
-        previewTransformHandler
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/start_transforms Start transforms
-   * @apiName PostStartTransforms
-   * @apiDescription Starts transform
-   *
-   * @apiSchema (body) startTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('start_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, StartTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: startTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, StartTransformsRequestSchema>(
-        startTransformsHandler
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/stop_transforms Stop transforms
-   * @apiName PostStopTransforms
-   * @apiDescription Stops transform
-   *
-   * @apiSchema (body) stopTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('stop_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, StopTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: stopTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, StopTransformsRequestSchema>(
-        stopTransformsHandler
-      )
-    );
-
-  /**
-   * @apiGroup Transforms
-   *
-   * @api {post} /internal/transform/schedule_now_transforms Schedules transforms now
-   * @apiName PostScheduleNowTransforms
-   * @apiDescription Schedules transforms now
-   *
-   * @apiSchema (body) scheduleNowTransformsRequestSchema
-   */
-  router.versioned
-    .post({
-      path: addInternalBasePath('schedule_now_transforms'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, ScheduleNowTransformsRequestSchema>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            body: scheduleNowTransformsRequestSchema,
-          },
-        },
-      },
-      license.guardApiRoute<undefined, undefined, ScheduleNowTransformsRequestSchema>(
-        scheduleNowTransformsHandler
-      )
-    );
-
-  registerTransformsAuditMessagesRoutes(routeDependencies);
-  registerTransformNodesRoutes(routeDependencies);
-}
-
-async function getDataViewId(indexName: string, dataViewsService: DataViewsService) {
-  const dv = (await dataViewsService.find(indexName)).find(({ title }) => title === indexName);
-  return dv?.id;
-}
-
-async function deleteDestDataViewById(dataViewId: string, dataViewsService: DataViewsService) {
-  return await dataViewsService.delete(dataViewId);
-}
-
-async function deleteTransforms(
-  reqBody: DeleteTransformsRequestSchema,
-  ctx: RequestHandlerContext,
-  response: KibanaResponseFactory,
-  dataViewsService: DataViewsService
-) {
-  const { transformsInfo } = reqBody;
-
-  // Cast possible undefineds as booleans
-  const deleteDestIndex = !!reqBody.deleteDestIndex;
-  const deleteDestDataView = !!reqBody.deleteDestDataView;
-  const shouldForceDelete = !!reqBody.forceDelete;
-
-  const results: DeleteTransformsResponseSchema = {};
-
-  const coreContext = await ctx.core;
-  const esClient = coreContext.elasticsearch.client;
-
-  for (const transformInfo of transformsInfo) {
-    let destinationIndex: string | undefined;
-
-    const transformDeleted: ResponseStatus = { success: false };
-    const destIndexDeleted: ResponseStatus = { success: false };
-    const destDataViewDeleted: ResponseStatus = {
-      success: false,
-    };
-    const transformId = transformInfo.id;
-    // force delete only if the transform has failed
-    let needToForceDelete = false;
-
-    try {
-      if (transformInfo.state === TRANSFORM_STATE.FAILED) {
-        needToForceDelete = true;
-      }
-      if (!shouldForceDelete) {
-        // Grab destination index info to delete
-        try {
-          const body = await esClient.asCurrentUser.transform.getTransform({
-            transform_id: transformId,
-          });
-          const transformConfig = body.transforms[0];
-          destinationIndex = transformConfig.dest.index;
-        } catch (getTransformConfigError) {
-          transformDeleted.error = getTransformConfigError.meta.body.error;
-          results[transformId] = {
-            transformDeleted,
-            destIndexDeleted,
-            destDataViewDeleted,
-            destinationIndex,
-          };
-          // No need to perform further delete attempts
-          continue;
-        }
-      }
-
-      // Delete the data view if there's a data view that matches the name of dest index
-      if (destinationIndex && deleteDestDataView) {
-        try {
-          const dataViewId = await getDataViewId(destinationIndex, dataViewsService);
-          if (dataViewId) {
-            await deleteDestDataViewById(dataViewId, dataViewsService);
-            destDataViewDeleted.success = true;
-          }
-        } catch (deleteDestDataViewError) {
-          destDataViewDeleted.error = deleteDestDataViewError.meta.body.error;
-        }
-      }
-
-      try {
-        await esClient.asCurrentUser.transform.deleteTransform({
-          transform_id: transformId,
-          force: shouldForceDelete && needToForceDelete,
-          // @ts-expect-error ES type needs to be updated
-          delete_dest_index: deleteDestIndex,
-        });
-        transformDeleted.success = true;
-        destIndexDeleted.success = deleteDestIndex;
-      } catch (deleteTransformJobError) {
-        transformDeleted.error = deleteTransformJobError.meta.body.error;
-        if (deleteTransformJobError.statusCode === 403) {
-          return response.forbidden();
-        }
-      }
-
-      results[transformId] = {
-        transformDeleted,
-        destIndexDeleted,
-        destDataViewDeleted,
-        destinationIndex,
-      };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformInfo.id,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.DELETE,
-        });
-      }
-      results[transformId] = { transformDeleted: { success: false, error: e.meta.body.error } };
-    }
-  }
-  return results;
-}
-
-async function resetTransforms(
-  reqBody: ResetTransformsRequestSchema,
-  ctx: RequestHandlerContext,
-  response: KibanaResponseFactory
-) {
-  const { transformsInfo } = reqBody;
-
-  const results: ResetTransformsResponseSchema = {};
-  const esClient = (await ctx.core).elasticsearch.client;
-
-  for (const transformInfo of transformsInfo) {
-    const transformReset: ResponseStatus = { success: false };
-    const transformId = transformInfo.id;
-
-    try {
-      try {
-        await esClient.asCurrentUser.transform.resetTransform({
-          transform_id: transformId,
-        });
-        transformReset.success = true;
-      } catch (resetTransformJobError) {
-        transformReset.error = resetTransformJobError.meta.body.error;
-        if (resetTransformJobError.statusCode === 403) {
-          return response.forbidden();
-        }
-      }
-
-      results[transformId] = {
-        transformReset,
-      };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformInfo.id,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.RESET,
-        });
-      }
-      results[transformId] = { transformReset: { success: false, error: e.meta.body.error } };
-    }
-  }
-  return results;
-}
-
-const previewTransformHandler: RequestHandler<
-  undefined,
-  undefined,
-  PostTransformsPreviewRequestSchema
-> = async (ctx, req, res) => {
-  try {
-    const reqBody = req.body;
-    const esClient = (await ctx.core).elasticsearch.client;
-    const body = await esClient.asCurrentUser.transform.previewTransform(
-      {
-        body: reqBody,
-      },
-      { maxRetries: 0 }
-    );
-    if (isLatestTransform(reqBody)) {
-      // for the latest transform mappings properties have to be retrieved from the source
-      const fieldCapsResponse = await esClient.asCurrentUser.fieldCaps(
-        {
-          index: reqBody.source.index,
-          fields: '*',
-          include_unmapped: false,
-        },
-        { maxRetries: 0 }
-      );
-
-      const fieldNamesSet = new Set(Object.keys(fieldCapsResponse.fields));
-
-      const fields = Object.entries(
-        fieldCapsResponse.fields as Record<string, Record<string, { type: string }>>
-      ).reduce((acc, [fieldName, fieldCaps]) => {
-        const fieldDefinition = Object.values(fieldCaps)[0];
-        const isMetaField = fieldDefinition.type.startsWith('_') || fieldName === '_doc_count';
-        if (isMetaField || isKeywordDuplicate(fieldName, fieldNamesSet)) {
-          return acc;
-        }
-        acc[fieldName] = { ...fieldDefinition };
-        return acc;
-      }, {} as Record<string, { type: string }>);
-
-      body.generated_dest_index.mappings!.properties = fields as Record<
-        string,
-        estypes.MappingProperty
-      >;
-    }
-    return res.ok({ body });
-  } catch (e) {
-    return res.customError(wrapError(wrapEsError(e)));
-  }
-};
-
-const startTransformsHandler: RequestHandler<
-  undefined,
-  undefined,
-  StartTransformsRequestSchema
-> = async (ctx, req, res) => {
-  const transformsInfo = req.body;
-
-  try {
-    const esClient = (await ctx.core).elasticsearch.client;
-    const body = await startTransforms(transformsInfo, esClient.asCurrentUser);
-    return res.ok({
-      body,
-    });
-  } catch (e) {
-    return res.customError(wrapError(wrapEsError(e)));
-  }
-};
-
-async function startTransforms(
-  transformsInfo: StartTransformsRequestSchema,
-  esClient: ElasticsearchClient
-) {
-  const results: StartTransformsResponseSchema = {};
-
-  for (const transformInfo of transformsInfo) {
-    const transformId = transformInfo.id;
-    try {
-      await esClient.transform.startTransform({
-        transform_id: transformId,
-      });
-      results[transformId] = { success: true };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformId,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.START,
-        });
-      }
-      results[transformId] = { success: false, error: e.meta.body.error };
-    }
-  }
-  return results;
-}
-
-const stopTransformsHandler: RequestHandler<
-  undefined,
-  undefined,
-  StopTransformsRequestSchema
-> = async (ctx, req, res) => {
-  const transformsInfo = req.body;
-
-  try {
-    const esClient = (await ctx.core).elasticsearch.client;
-    return res.ok({
-      body: await stopTransforms(transformsInfo, esClient.asCurrentUser),
-    });
-  } catch (e) {
-    return res.customError(wrapError(wrapEsError(e)));
-  }
-};
-
-async function stopTransforms(
-  transformsInfo: StopTransformsRequestSchema,
-  esClient: ElasticsearchClient
-) {
-  const results: StopTransformsResponseSchema = {};
-
-  for (const transformInfo of transformsInfo) {
-    const transformId = transformInfo.id;
-    try {
-      await esClient.transform.stopTransform({
-        transform_id: transformId,
-        force:
-          transformInfo.state !== undefined
-            ? transformInfo.state === TRANSFORM_STATE.FAILED
-            : false,
-        wait_for_completion: true,
-      });
-      results[transformId] = { success: true };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformId,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.STOP,
-        });
-      }
-      results[transformId] = { success: false, error: e.meta.body.error };
-    }
-  }
-  return results;
-}
-
-const scheduleNowTransformsHandler: RequestHandler<
-  undefined,
-  undefined,
-  ScheduleNowTransformsRequestSchema
-> = async (ctx, req, res) => {
-  const transformsInfo = req.body;
-
-  try {
-    const esClient = (await ctx.core).elasticsearch.client;
-    return res.ok({
-      body: await scheduleNowTransforms(transformsInfo, esClient.asCurrentUser),
-    });
-  } catch (e) {
-    return res.customError(wrapError(wrapEsError(e)));
-  }
-};
-
-async function scheduleNowTransforms(
-  transformsInfo: ScheduleNowTransformsRequestSchema,
-  esClient: ElasticsearchClient
-) {
-  const results: ScheduleNowTransformsResponseSchema = {};
-
-  for (const transformInfo of transformsInfo) {
-    const transformId = transformInfo.id;
-    try {
-      await esClient.transport.request({
-        method: 'POST',
-        path: `_transform/${transformId}/_schedule_now`,
-      });
-
-      results[transformId] = { success: true };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformId,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.SCHEDULE_NOW,
-        });
-      }
-      results[transformId] = { success: false, error: e.meta.body.error };
-    }
-  }
-  return results;
-}
-
-async function reauthorizeAndStartTransforms(
-  transformsInfo: ReauthorizeTransformsRequestSchema,
-  esClient: ElasticsearchClient,
-  options?: TransportRequestOptions
-) {
-  const results: ReauthorizeTransformsResponseSchema = {};
-
-  for (const transformInfo of transformsInfo) {
-    const transformId = transformInfo.id;
-    try {
-      await esClient.transform.updateTransform(
-        {
-          body: {},
-          transform_id: transformId,
-        },
-        options ?? {}
-      );
-
-      await esClient.transform.startTransform(
-        {
-          transform_id: transformId,
-        },
-        { ignore: [409] }
-      );
-
-      results[transformId] = { success: true };
-    } catch (e) {
-      if (isRequestTimeout(e)) {
-        return fillResultsWithTimeouts({
-          results,
-          id: transformId,
-          items: transformsInfo,
-          action: TRANSFORM_ACTIONS.REAUTHORIZE,
-        });
-      }
-      results[transformId] = { success: false, error: e.meta.body.error };
-    }
-  }
-  return results;
-}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_all/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_all/register_route.ts
new file mode 100644
index 00000000000000..e808e0e8fafc2f
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_all/register_route.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {get} /internal/transform/transforms Get transforms
+   * @apiName GetTransforms
+   * @apiDescription Returns transforms
+   *
+   * @apiSchema (params) jobAuditMessagesJobIdSchema
+   * @apiSchema (query) jobAuditMessagesQuerySchema
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms'),
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: '1',
+        validate: false,
+      },
+      license.guardApiRoute<estypes.TransformGetTransformRequest, undefined, undefined>(
+        routeHandler
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_all/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_all/route_handler.ts
new file mode 100644
index 00000000000000..10d52b86f8df83
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_all/route_handler.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import { TransformRequestHandlerContext } from '../../../services/license';
+import { transformHealthServiceProvider } from '../../../lib/alerting/transform_health_rule_type/transform_health_service';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  estypes.TransformGetTransformRequest,
+  undefined,
+  undefined,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.getTransform({
+      size: 1000,
+      ...req.params,
+    });
+
+    const alerting = await ctx.alerting;
+    if (alerting) {
+      const transformHealthService = transformHealthServiceProvider({
+        esClient: esClient.asCurrentUser,
+        rulesClient: alerting.getRulesClient(),
+      });
+
+      // @ts-ignore
+      await transformHealthService.populateTransformsWithAssignedRules(body.transforms);
+    }
+
+    return res.ok({ body });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_audit_messages.ts b/x-pack/plugins/transform/server/routes/api/transforms_audit_messages.ts
deleted file mode 100644
index 5aeecf399bbd3b..00000000000000
--- a/x-pack/plugins/transform/server/routes/api/transforms_audit_messages.ts
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema } from '@kbn/config-schema';
-import { addInternalBasePath, DEFAULT_MAX_AUDIT_MESSAGE_SIZE } from '../../../common/constants';
-import { transformIdParamSchema, TransformIdParamSchema } from '../../../common/api_schemas/common';
-import { AuditMessage } from '../../../common/types/messages';
-
-import { RouteDependencies } from '../../types';
-
-import { wrapError, wrapEsError } from './error_utils';
-
-export const ML_DF_NOTIFICATION_INDEX_PATTERN = '.transform-notifications-read';
-
-interface BoolQuery {
-  bool: { [key: string]: any };
-}
-
-interface TransformMessageQuery {
-  sortField: string;
-  sortDirection: 'asc' | 'desc';
-}
-
-export function registerTransformsAuditMessagesRoutes({ router, license }: RouteDependencies) {
-  /**
-   * @apiGroup Transforms Audit Messages
-   *
-   * @api {get} /internal/transform/transforms/:transformId/messages Transforms Messages
-   * @apiName GetTransformsMessages
-   * @apiDescription Get transforms audit messages
-   *
-   * @apiSchema (params) transformIdParamSchema
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms/{transformId}/messages'),
-      access: 'internal',
-    })
-    .addVersion<TransformIdParamSchema, TransformMessageQuery, undefined>(
-      {
-        version: '1',
-        validate: {
-          request: {
-            params: transformIdParamSchema,
-            query: schema.object({
-              sortField: schema.string(),
-              sortDirection: schema.oneOf([schema.literal('asc'), schema.literal('desc')]),
-            }),
-          },
-        },
-      },
-      license.guardApiRoute<TransformIdParamSchema, TransformMessageQuery, undefined>(
-        async (ctx, req, res) => {
-          const { transformId } = req.params;
-          const sortField = req.query?.sortField ?? 'timestamp';
-          const sortDirection = req.query?.sortDirection ?? 'desc';
-
-          // search for audit messages,
-          // transformId is optional. without it, all transforms will be listed.
-          const query: BoolQuery = {
-            bool: {
-              filter: [
-                {
-                  bool: {
-                    must_not: {
-                      term: {
-                        level: 'activity',
-                      },
-                    },
-                  },
-                },
-              ],
-            },
-          };
-
-          // if no transformId specified, load all of the messages
-          if (transformId !== undefined) {
-            query.bool.filter.push({
-              bool: {
-                should: [
-                  {
-                    term: {
-                      transform_id: '', // catch system messages
-                    },
-                  },
-                  {
-                    term: {
-                      transform_id: transformId, // messages for specified transformId
-                    },
-                  },
-                ],
-              },
-            });
-          }
-
-          try {
-            const esClient = (await ctx.core).elasticsearch.client;
-            const resp = await esClient.asCurrentUser.search<AuditMessage>({
-              index: ML_DF_NOTIFICATION_INDEX_PATTERN,
-              ignore_unavailable: true,
-              size: DEFAULT_MAX_AUDIT_MESSAGE_SIZE,
-              body: {
-                sort: [
-                  { [sortField]: { order: sortDirection } },
-                  { transform_id: { order: 'asc' as const } },
-                ],
-                query,
-              },
-              track_total_hits: true,
-            });
-            const totalHits =
-              typeof resp.hits.total === 'number' ? resp.hits.total : resp.hits.total!.value;
-
-            let messages: AuditMessage[] = [];
-            // TODO: remove typeof checks when appropriate overloading is added for the `search` API
-            if (
-              (typeof resp.hits.total === 'number' && resp.hits.total > 0) ||
-              (typeof resp.hits.total === 'object' && resp.hits.total.value > 0)
-            ) {
-              messages = resp.hits.hits.map((hit) => hit._source!);
-            }
-            return res.ok({ body: { messages, total: totalHits } });
-          } catch (e) {
-            return res.customError(wrapError(wrapEsError(e)));
-          }
-        }
-      )
-    );
-}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_create/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_create/register_route.ts
new file mode 100644
index 00000000000000..d7d8614efb7cee
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_create/register_route.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  transformIdParamSchema,
+  type TransformIdParamSchema,
+} from '../../../../common/api_schemas/common';
+import {
+  putTransformsRequestSchema,
+  type PutTransformsRequestSchema,
+} from '../../../../common/api_schemas/transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {put} /internal/transform/transforms/:transformId Put transform
+   * @apiName PutTransform
+   * @apiDescription Creates a transform
+   *
+   * @apiSchema (params) transformIdParamSchema
+   * @apiSchema (body) putTransformsRequestSchema
+   */
+  router.versioned
+    .put({
+      path: addInternalBasePath('transforms/{transformId}'),
+      access: 'internal',
+    })
+    .addVersion<TransformIdParamSchema, undefined, PutTransformsRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: transformIdParamSchema,
+            body: putTransformsRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<TransformIdParamSchema, undefined, PutTransformsRequestSchema>(
+        routeHandler
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_create/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_create/route_handler.ts
new file mode 100644
index 00000000000000..87f9dab13b8789
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_create/route_handler.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { TransformIdParamSchema } from '../../../../common/api_schemas/common';
+import type {
+  PutTransformsRequestSchema,
+  PutTransformsResponseSchema,
+} from '../../../../common/api_schemas/transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  TransformIdParamSchema,
+  undefined,
+  PutTransformsRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const { transformId } = req.params;
+
+  const response: PutTransformsResponseSchema = {
+    transformsCreated: [],
+    errors: [],
+  };
+
+  const esClient = (await ctx.core).elasticsearch.client;
+
+  try {
+    const resp = await esClient.asCurrentUser.transform.putTransform({
+      // @ts-expect-error @elastic/elasticsearch group_by is expected to be optional in TransformPivot
+      body: req.body,
+      transform_id: transformId,
+    });
+
+    if (resp.acknowledged) {
+      response.transformsCreated.push({ transform: transformId });
+    } else {
+      response.errors.push({
+        id: transformId,
+        error: wrapEsError(resp),
+      });
+    }
+  } catch (e) {
+    response.errors.push({
+      id: transformId,
+      error: wrapEsError(e),
+    });
+  }
+
+  return res.ok({ body: response });
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_nodes.ts b/x-pack/plugins/transform/server/routes/api/transforms_nodes.ts
deleted file mode 100644
index 5f9b51d0fa4339..00000000000000
--- a/x-pack/plugins/transform/server/routes/api/transforms_nodes.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import Boom from '@hapi/boom';
-
-import { isPopulatedObject } from '@kbn/ml-is-populated-object';
-
-import { addInternalBasePath, NODES_INFO_PRIVILEGES } from '../../../common/constants';
-
-import { RouteDependencies } from '../../types';
-
-import { wrapError, wrapEsError } from './error_utils';
-
-const NODE_ROLES = 'roles';
-
-interface NodesAttributes {
-  roles: string[];
-}
-
-type Nodes = Record<string, NodesAttributes>;
-
-export const isNodes = (arg: unknown): arg is Nodes => {
-  return (
-    isPopulatedObject(arg) &&
-    Object.values(arg).every(
-      (node) => isPopulatedObject(node, [NODE_ROLES]) && Array.isArray(node.roles)
-    )
-  );
-};
-
-export function registerTransformNodesRoutes({ router, license }: RouteDependencies) {
-  /**
-   * @apiGroup Transform Nodes
-   *
-   * @api {get} /internal/transforms/_nodes Transform Nodes
-   * @apiName GetTransformNodes
-   * @apiDescription Get transform nodes
-   */
-  router.versioned
-    .get({
-      path: addInternalBasePath('transforms/_nodes'),
-      access: 'internal',
-    })
-    .addVersion<undefined, undefined, undefined>(
-      {
-        version: '1',
-        validate: false,
-      },
-      license.guardApiRoute<undefined, undefined, undefined>(async (ctx, req, res) => {
-        try {
-          const esClient = (await ctx.core).elasticsearch.client;
-          // If security is enabled, check that the user has at least permission to
-          // view transforms before calling the _nodes endpoint with the internal user.
-          if (license.getStatus().isSecurityEnabled === true) {
-            const { has_all_requested: hasAllPrivileges } =
-              await esClient.asCurrentUser.security.hasPrivileges({
-                body: {
-                  cluster: NODES_INFO_PRIVILEGES,
-                },
-              });
-
-            if (!hasAllPrivileges) {
-              return res.customError(wrapError(new Boom.Boom('Forbidden', { statusCode: 403 })));
-            }
-          }
-
-          const { nodes } = await esClient.asInternalUser.nodes.info({
-            filter_path: `nodes.*.${NODE_ROLES}`,
-          });
-
-          let count = 0;
-          if (isNodes(nodes)) {
-            for (const { roles } of Object.values(nodes)) {
-              if (roles.includes('transform')) {
-                count++;
-              }
-            }
-          }
-
-          return res.ok({ body: { count } });
-        } catch (e) {
-          return res.customError(wrapError(wrapEsError(e)));
-        }
-      })
-    );
-}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_nodes/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_nodes/register_route.ts
new file mode 100644
index 00000000000000..ba22d01dfa016f
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_nodes/register_route.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { addInternalBasePath } from '../../../../common/constants';
+
+import { RouteDependencies } from '../../../types';
+
+import { routeHandlerFactory } from './route_handler_factory';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transform Nodes
+   *
+   * @api {get} /internal/transforms/_nodes Transform Nodes
+   * @apiName GetTransformNodes
+   * @apiDescription Get transform nodes
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms/_nodes'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, undefined>(
+      {
+        version: '1',
+        validate: false,
+      },
+      license.guardApiRoute<undefined, undefined, undefined>(routeHandlerFactory(license))
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_nodes.test.ts b/x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.test.ts
similarity index 96%
rename from x-pack/plugins/transform/server/routes/api/transforms_nodes.test.ts
rename to x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.test.ts
index 462a4688ad4557..00664a0326f145 100644
--- a/x-pack/plugins/transform/server/routes/api/transforms_nodes.test.ts
+++ b/x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isNodes } from './transforms_nodes';
+import { isNodes } from './route_handler_factory';
 
 describe('Transform: Nodes API endpoint', () => {
   test('isNodes()', () => {
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.ts b/x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.ts
new file mode 100644
index 00000000000000..8eed2ad119d385
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_nodes/route_handler_factory.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Boom from '@hapi/boom';
+import type { RequestHandler } from '@kbn/core/server';
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+
+import { NODES_INFO_PRIVILEGES } from '../../../../common/constants';
+
+import { RouteDependencies } from '../../../types';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+const NODE_ROLES = 'roles';
+
+interface NodesAttributes {
+  roles: string[];
+}
+
+type Nodes = Record<string, NodesAttributes>;
+
+export const isNodes = (arg: unknown): arg is Nodes => {
+  return (
+    isPopulatedObject(arg) &&
+    Object.values(arg).every(
+      (node) => isPopulatedObject(node, [NODE_ROLES]) && Array.isArray(node.roles)
+    )
+  );
+};
+
+export const routeHandlerFactory: (
+  license: RouteDependencies['license']
+) => RequestHandler<undefined, undefined, undefined> = (license) => async (ctx, req, res) => {
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    // If security is enabled, check that the user has at least permission to
+    // view transforms before calling the _nodes endpoint with the internal user.
+    if (license.getStatus().isSecurityEnabled === true) {
+      const { has_all_requested: hasAllPrivileges } =
+        await esClient.asCurrentUser.security.hasPrivileges({
+          body: {
+            cluster: NODES_INFO_PRIVILEGES,
+          },
+        });
+
+      if (!hasAllPrivileges) {
+        return res.customError(wrapError(new Boom.Boom('Forbidden', { statusCode: 403 })));
+      }
+    }
+
+    const { nodes } = await esClient.asInternalUser.nodes.info({
+      filter_path: `nodes.*.${NODE_ROLES}`,
+    });
+
+    let count = 0;
+    if (isNodes(nodes)) {
+      for (const { roles } of Object.values(nodes)) {
+        if (roles.includes('transform')) {
+          count++;
+        }
+      }
+    }
+
+    return res.ok({ body: { count } });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_preview/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_preview/register_route.ts
new file mode 100644
index 00000000000000..1b22eae72ef146
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_preview/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  postTransformsPreviewRequestSchema,
+  PostTransformsPreviewRequestSchema,
+} from '../../../../common/api_schemas/transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/transforms/_preview Preview transform
+   * @apiName PreviewTransform
+   * @apiDescription Previews transform
+   *
+   * @apiSchema (body) postTransformsPreviewRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('transforms/_preview'),
+      access: 'internal',
+    })
+    .addVersion<undefined, undefined, PostTransformsPreviewRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            body: postTransformsPreviewRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<undefined, undefined, PostTransformsPreviewRequestSchema>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_preview/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_preview/route_handler.ts
new file mode 100644
index 00000000000000..2ce611260836e0
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_preview/route_handler.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { PostTransformsPreviewRequestSchema } from '../../../../common/api_schemas/transforms';
+import { isLatestTransform } from '../../../../common/types/transform';
+import { isKeywordDuplicate } from '../../../../common/utils/field_utils';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  undefined,
+  undefined,
+  PostTransformsPreviewRequestSchema
+> = async (ctx, req, res) => {
+  try {
+    const reqBody = req.body;
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.previewTransform(
+      {
+        body: reqBody,
+      },
+      { maxRetries: 0 }
+    );
+    if (isLatestTransform(reqBody)) {
+      // for the latest transform mappings properties have to be retrieved from the source
+      const fieldCapsResponse = await esClient.asCurrentUser.fieldCaps(
+        {
+          index: reqBody.source.index,
+          fields: '*',
+          include_unmapped: false,
+        },
+        { maxRetries: 0 }
+      );
+
+      const fieldNamesSet = new Set(Object.keys(fieldCapsResponse.fields));
+
+      const fields = Object.entries(
+        fieldCapsResponse.fields as Record<string, Record<string, { type: string }>>
+      ).reduce((acc, [fieldName, fieldCaps]) => {
+        const fieldDefinition = Object.values(fieldCaps)[0];
+        const isMetaField = fieldDefinition.type.startsWith('_') || fieldName === '_doc_count';
+        if (isMetaField || isKeywordDuplicate(fieldName, fieldNamesSet)) {
+          return acc;
+        }
+        acc[fieldName] = { ...fieldDefinition };
+        return acc;
+      }, {} as Record<string, { type: string }>);
+
+      body.generated_dest_index.mappings!.properties = fields as Record<
+        string,
+        estypes.MappingProperty
+      >;
+    }
+    return res.ok({ body });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_single/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_single/register_route.ts
new file mode 100644
index 00000000000000..e79446d3962c05
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_single/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { addInternalBasePath } from '../../../../common/constants';
+import {
+  transformIdParamSchema,
+  type TransformIdParamSchema,
+} from '../../../../common/api_schemas/common';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {get} /internal/transform/transforms/:transformId Get transform
+   * @apiName GetTransform
+   * @apiDescription Returns a single transform
+   *
+   * @apiSchema (params) transformIdParamSchema
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms/{transformId}'),
+      access: 'internal',
+    })
+    .addVersion<TransformIdParamSchema, undefined, undefined>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: transformIdParamSchema,
+          },
+        },
+      },
+      license.guardApiRoute<TransformIdParamSchema, undefined, undefined>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_single/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_single/route_handler.ts
new file mode 100644
index 00000000000000..623769707b0e27
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_single/route_handler.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { TransformIdParamSchema } from '../../../../common/api_schemas/common';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<TransformIdParamSchema, undefined, undefined> = async (
+  ctx,
+  req,
+  res
+) => {
+  const { transformId } = req.params;
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.getTransform({
+      transform_id: transformId,
+    });
+    return res.ok({ body });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_stats_all/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_stats_all/register_route.ts
new file mode 100644
index 00000000000000..0f2fa18b4665fc
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_stats_all/register_route.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {get} /internal/transform/transforms/_stats Get transforms stats
+   * @apiName GetTransformsStats
+   * @apiDescription Returns transforms stats
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms/_stats'),
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: '1',
+        validate: false,
+      },
+      license.guardApiRoute<estypes.TransformGetTransformStatsResponse, undefined, undefined>(
+        routeHandler
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_stats_all/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_stats_all/route_handler.ts
new file mode 100644
index 00000000000000..901afdd4ea8091
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_stats_all/route_handler.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  estypes.TransformGetTransformStatsResponse,
+  undefined,
+  undefined,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.getTransformStats(
+      {
+        size: 1000,
+        transform_id: '_all',
+      },
+      { maxRetries: 0 }
+    );
+    return res.ok({ body });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_stats_single/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_stats_single/register_route.ts
new file mode 100644
index 00000000000000..8c06c95892116a
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_stats_single/register_route.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  transformIdParamSchema,
+  type TransformIdParamSchema,
+} from '../../../../common/api_schemas/common';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {get} /internal/transform/transforms/:transformId/_stats Get transform stats
+   * @apiName GetTransformStats
+   * @apiDescription Returns stats for a single transform
+   *
+   * @apiSchema (params) transformIdParamSchema
+   */
+  router.versioned
+    .get({
+      path: addInternalBasePath('transforms/{transformId}/_stats'),
+      access: 'internal',
+    })
+    .addVersion<TransformIdParamSchema, undefined, undefined>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: transformIdParamSchema,
+          },
+        },
+      },
+      license.guardApiRoute<TransformIdParamSchema, undefined, undefined>(routeHandler)
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_stats_single/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_stats_single/route_handler.ts
new file mode 100644
index 00000000000000..29c6f39e7126bc
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_stats_single/route_handler.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { TransformIdParamSchema } from '../../../../common/api_schemas/common';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError, wrapEsError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  TransformIdParamSchema,
+  undefined,
+  undefined,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const { transformId } = req.params;
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.getTransformStats(
+      {
+        transform_id: transformId,
+      },
+      { maxRetries: 0 }
+    );
+    return res.ok({ body });
+  } catch (e) {
+    return res.customError(wrapError(wrapEsError(e)));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_update/register_route.ts b/x-pack/plugins/transform/server/routes/api/transforms_update/register_route.ts
new file mode 100644
index 00000000000000..366b4ea32fc926
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_update/register_route.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  transformIdParamSchema,
+  type TransformIdParamSchema,
+} from '../../../../common/api_schemas/common';
+import {
+  postTransformsUpdateRequestSchema,
+  type PostTransformsUpdateRequestSchema,
+} from '../../../../common/api_schemas/update_transforms';
+import { addInternalBasePath } from '../../../../common/constants';
+
+import type { RouteDependencies } from '../../../types';
+
+import { routeHandler } from './route_handler';
+
+export function registerRoute({ router, license }: RouteDependencies) {
+  /**
+   * @apiGroup Transforms
+   *
+   * @api {post} /internal/transform/transforms/:transformId/_update Post transform update
+   * @apiName PostTransformUpdate
+   * @apiDescription Updates a transform
+   *
+   * @apiSchema (params) transformIdParamSchema
+   * @apiSchema (body) postTransformsUpdateRequestSchema
+   */
+  router.versioned
+    .post({
+      path: addInternalBasePath('transforms/{transformId}/_update'),
+      access: 'internal',
+    })
+    .addVersion<TransformIdParamSchema, undefined, PostTransformsUpdateRequestSchema>(
+      {
+        version: '1',
+        validate: {
+          request: {
+            params: transformIdParamSchema,
+            body: postTransformsUpdateRequestSchema,
+          },
+        },
+      },
+      license.guardApiRoute<TransformIdParamSchema, undefined, PostTransformsUpdateRequestSchema>(
+        routeHandler
+      )
+    );
+}
diff --git a/x-pack/plugins/transform/server/routes/api/transforms_update/route_handler.ts b/x-pack/plugins/transform/server/routes/api/transforms_update/route_handler.ts
new file mode 100644
index 00000000000000..9a88c4da3d48ab
--- /dev/null
+++ b/x-pack/plugins/transform/server/routes/api/transforms_update/route_handler.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequestHandler } from '@kbn/core/server';
+
+import type { TransformIdParamSchema } from '../../../../common/api_schemas/common';
+import type { PostTransformsUpdateRequestSchema } from '../../../../common/api_schemas/update_transforms';
+
+import type { TransformRequestHandlerContext } from '../../../services/license';
+
+import { wrapError } from '../../utils/error_utils';
+
+export const routeHandler: RequestHandler<
+  TransformIdParamSchema,
+  undefined,
+  PostTransformsUpdateRequestSchema,
+  TransformRequestHandlerContext
+> = async (ctx, req, res) => {
+  const { transformId } = req.params;
+
+  try {
+    const esClient = (await ctx.core).elasticsearch.client;
+    const body = await esClient.asCurrentUser.transform.updateTransform({
+      // @ts-expect-error query doesn't satisfy QueryDslQueryContainer from @elastic/elasticsearch
+      body: req.body,
+      transform_id: transformId,
+    });
+    return res.ok({
+      body,
+    });
+  } catch (e) {
+    return res.customError(wrapError(e));
+  }
+};
diff --git a/x-pack/plugins/transform/server/routes/index.ts b/x-pack/plugins/transform/server/routes/index.ts
index aec4417f2a4212..d3d8bd48b8c0a0 100644
--- a/x-pack/plugins/transform/server/routes/index.ts
+++ b/x-pack/plugins/transform/server/routes/index.ts
@@ -7,10 +7,38 @@
 
 import { RouteDependencies } from '../types';
 
-import { registerFieldHistogramsRoutes } from './api/field_histograms';
-import { registerTransformsRoutes } from './api/transforms';
+import { registerRoute as registerFieldHistogramsRoute } from './api/field_histograms/register_route';
+import { registerRoute as registerAuditMessagesRoute } from './api/audit_messages/register_route';
+import { registerRoute as registerTransformsNodesRoute } from './api/transforms_nodes/register_route';
+import { registerRoute as registerTransformsAllRoute } from './api/transforms_all/register_route';
+import { registerRoute as registerTransformsSingleRoute } from './api/transforms_single/register_route';
+import { registerRoute as registerTransformsStatsAllRoute } from './api/transforms_stats_all/register_route';
+import { registerRoute as registerTransformsStatsSingleRoute } from './api/transforms_stats_single/register_route';
+import { registerRoute as registerTransformsCreateRoute } from './api/transforms_create/register_route';
+import { registerRoute as registerTransformsUpdateRoute } from './api/transforms_update/register_route';
+import { registerRoute as registerReauthorizeTransformsRoute } from './api/reauthorize_transforms/register_route';
+import { registerRoute as registerResetTransformsRoute } from './api/reset_transforms/register_route';
+import { registerRoute as registerTransformsPreviewRoute } from './api/transforms_preview/register_route';
+import { registerRoute as registerStartTransformsRoute } from './api/start_transforms/register_route';
+import { registerRoute as registerStopTransformsRoute } from './api/stop_transforms/register_route';
+import { registerRoute as registerDeleteTransformsRoute } from './api/delete_transforms/register_route';
+import { registerRoute as registerScheduleNowTransformsRoute } from './api/schedule_now_transforms/register_route';
 
 export function registerRoutes(dependencies: RouteDependencies) {
-  registerFieldHistogramsRoutes(dependencies);
-  registerTransformsRoutes(dependencies);
+  registerFieldHistogramsRoute(dependencies);
+  registerAuditMessagesRoute(dependencies);
+  registerTransformsNodesRoute(dependencies);
+  registerTransformsAllRoute(dependencies);
+  registerTransformsSingleRoute(dependencies);
+  registerTransformsStatsAllRoute(dependencies);
+  registerTransformsStatsSingleRoute(dependencies);
+  registerTransformsCreateRoute(dependencies);
+  registerTransformsUpdateRoute(dependencies);
+  registerReauthorizeTransformsRoute(dependencies);
+  registerResetTransformsRoute(dependencies);
+  registerTransformsPreviewRoute(dependencies);
+  registerStartTransformsRoute(dependencies);
+  registerStopTransformsRoute(dependencies);
+  registerDeleteTransformsRoute(dependencies);
+  registerScheduleNowTransformsRoute(dependencies);
 }
diff --git a/x-pack/plugins/transform/server/routes/api/error_utils.ts b/x-pack/plugins/transform/server/routes/utils/error_utils.ts
similarity index 100%
rename from x-pack/plugins/transform/server/routes/api/error_utils.ts
rename to x-pack/plugins/transform/server/routes/utils/error_utils.ts
diff --git a/x-pack/plugins/transform/server/services/license.ts b/x-pack/plugins/transform/server/services/license.ts
index 3a22b2e6bd27f2..4a5591bbe74e8a 100644
--- a/x-pack/plugins/transform/server/services/license.ts
+++ b/x-pack/plugins/transform/server/services/license.ts
@@ -36,7 +36,7 @@ interface SetupSettings {
   coreStart: CoreStart;
 }
 
-type TransformRequestHandlerContext = CustomRequestHandlerContext<{
+export type TransformRequestHandlerContext = CustomRequestHandlerContext<{
   alerting?: AlertingApiRequestHandlerContext;
 }>;
 
diff --git a/x-pack/plugins/translations/server/index.ts b/x-pack/plugins/translations/server/index.ts
index dfa3a2aa7211f5..f15dc4cc730a7a 100644
--- a/x-pack/plugins/translations/server/index.ts
+++ b/x-pack/plugins/translations/server/index.ts
@@ -15,4 +15,4 @@ class TranslationsPlugin {
   }
 }
 
-export const plugin = () => new TranslationsPlugin();
+export const plugin = async () => new TranslationsPlugin();
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index a5ed8527180052..bfb2b2bdfd6838 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -1204,7 +1204,6 @@
     "dashboard.createConfirmModal.continueButtonLabel": "Poursuivre les modifications",
     "dashboard.createConfirmModal.unsavedChangesSubtitle": "Poursuivez les modifications ou utilisez un tableau de bord vierge.",
     "dashboard.createConfirmModal.unsavedChangesTitle": "Nouveau tableau de bord déjà en cours",
-    "dashboard.dashboardAppBreadcrumbsTitle": "Tableau de bord",
     "dashboard.dashboardPageTitle": "Tableaux de bord",
     "dashboard.dashboardWasSavedSuccessMessage": "Le tableau de bord \"{dashTitle}\" a été enregistré.",
     "dashboard.deleteError.toastDescription": "Erreur rencontrée lors de la suppression du tableau de bord",
@@ -2456,7 +2455,6 @@
     "discover.notifications.notSavedSearchTitle": "La recherche \"{savedSearchTitle}\" n'a pas été enregistrée.",
     "discover.notifications.savedSearchTitle": "La recherche \"{savedSearchTitle}\" a été enregistrée.",
     "discover.pageTitleWithoutSavedSearch": "Discover - Recherche non encore enregistrée",
-    "discover.reloadSavedSearchButton": "Réinitialiser la recherche",
     "discover.rootBreadcrumb": "Découverte",
     "discover.sampleData.viewLinkLabel": "Découverte",
     "discover.savedSearch.savedObjectName": "Recherche enregistrée",
@@ -7956,7 +7954,7 @@
     "xpack.aiops.logRateAnalysis.resultsTable.impactLabelColumnTooltip": "Le niveau d'impact du champ sur la différence de taux de messages.",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardButtonLabel": "Copier dans le presse-papiers",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardGroupMessage": "Copier les éléments de groupe en tant que syntaxe KQL dans le Presse-papiers",
-    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantTermMessage": "Copier la paire clé-valeur en tant que syntaxe KQL dans le Presse-papiers",
+    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantItemMessage": "Copier la paire clé-valeur en tant que syntaxe KQL dans le Presse-papiers",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInDiscover": "Afficher dans Discover",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInLogPatternAnalysis": "Voir dans l'analyse du modèle de log",
     "xpack.aiops.logRateAnalysis.resultsTable.logPatternLinkNotAvailableTooltipMessage": "Le lien n'est pas disponible si l'élément du tableau est lui-même un modèle de log.",
@@ -20098,17 +20096,7 @@
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardDocsLabel": "Maximum de documents dans la partition principale",
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardSizeLabel": "Taille de partition principale maximale",
     "xpack.indexLifecycleMgmt.hotPhase.rolloverFieldTitle": "Substitution",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle": "Statut d'action",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader": "Action actuelle",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader": "Temps de l'action actuelle",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader": "Phase actuelle",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader": "Étape ayant échoué",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader": "Stratégie de cycle de vie",
     "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle": "Définition de la phase",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton": "Afficher la définition",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle": "Définition de la phase",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage": "Erreur de cycle de vie des index",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle": "Gestion du cycle de vie des index",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyButtonText": "Ajouter une stratégie",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexError": "Erreur lors de l'ajout d'une stratégie à l'index",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.cancelButtonText": "Annuler",
@@ -23597,7 +23585,6 @@
     "xpack.maps.source.esSearch.loadTooltipPropertiesErrorMsg": "Document introuvable, _id : {docId}",
     "xpack.maps.source.esSearch.mvtScalingJoinMsg": "Les tuiles vectorielles prennent en charge une seule liaison de terme. Votre calque a {numberOfJoins} liaisons. Le passage aux tuiles vectorielles conservera la première liaison de terme et supprimera toutes les autres liaisons de votre configuration de calque.",
     "xpack.maps.source.esSource.noGeoFieldErrorMessage": "La vue de données \"{indexPatternLabel}\" ne contient plus le champ géographique \"{geoField}\"",
-    "xpack.maps.source.esSource.requestFailedErrorMessage": "Échec de la demande de recherche Elasticsearch, erreur : {message}",
     "xpack.maps.source.esSource.stylePropsMetaRequestName": "{layerName} - Métadonnées",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlHelpMessage": "URL du service de cartographie vectoriel .mvt. Par exemple, {url}",
     "xpack.maps.source.pewPew.inspectorDescription": "Obtenir des chemins depuis la vue de données : {dataViewName} ; source : {sourceFieldName} ; destination : {destFieldName}",
@@ -29104,8 +29091,6 @@
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabel": "Dernière {lookback} {timeLabel}",
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabelWithGrouping": "Dernières {lookback} {timeLabel} de données pour {id}",
     "xpack.observability.customThreshold.rule.threshold.errorAlertReason": "Elasticsearch a échoué lors de l'interrogation des données pour {metric}",
-    "xpack.observability.customThreshold.rule.threshold.noDataAlertReason": "{metric} n'a signalé aucune donnée dans les dernières {interval} {group}",
-    "xpack.observability.customThreshold.rule.threshold.recoveredAlertReason": "{metric} est maintenant {comparator} un seuil de {threshold} (la valeur actuelle est {currentValue}) pour {group}",
     "xpack.observability.customThreshold.rule.threshold.thresholdRange": "{a} et {b}",
     "xpack.observability.customThreshold.rule.thresholdExtraTitle": "Alerte lorsque {comparator} {threshold}.",
     "xpack.observability.enableAgentExplorerDescription": "{betaLabel} Active la vue d'explorateur d'agent.",
@@ -29136,7 +29121,6 @@
     "xpack.observability.slo.list.sortByType": "Trier par {type}",
     "xpack.observability.slo.partitionByBadge": "Partition par {partitionKey}",
     "xpack.observability.slo.rules.burnRate.errors.invalidThresholdValue": "Le seuil du taux d'avancement doit être compris entre 1 et {maxBurnRate}.",
-    "xpack.observability.slo.rules.errorBudgetExhaustion.text": "{formatedHours} heures restantes avant l'épuisement du budget d'erreurs.",
     "xpack.observability.slo.rules.groupByMessage": "Le SLO que vous avez sélectionné a été créé avec une partition sur \"{groupByField}\". Cette règle surveille et génère une alerte pour chaque instance trouvée dans le champ de partition.",
     "xpack.observability.slo.rules.longWindowDuration.tooltip": "Période historique sur laquelle le taux d'avancement est calculé. Une période historique plus courte de {shortWindowDuration} minutes (1/12 de la période historique) sera utilisée pour une récupération plus rapide",
     "xpack.observability.slo.slo.activeAlertsBadge.label": "{count, plural, one {# alerte} many {# alertes} other {Alertes #}}",
@@ -29254,9 +29238,6 @@
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.count": "Compte du document",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.max": "Max",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.min": "Min",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p95": "95e centile",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p99": "99e centile",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.rate": "Taux",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.sum": "Somme",
     "xpack.observability.customThreshold.rule.alertFlyout.alertDescription": "Alerter quand un type de données Observability atteint ou dépasse une valeur donnée.",
     "xpack.observability.customThreshold.rule.alertFlyout.alertOnGroupDisappear": "Me prévenir si un groupe cesse de signaler les données",
@@ -29277,12 +29258,10 @@
     "xpack.observability.customThreshold.rule.alertFlyout.customEquationTooltip": "Ceci est compatible avec des calculs de base (A + B / C) et la logique booléenne (A < B ? A : B).",
     "xpack.observability.customThreshold.rule.alertFlyout.dataViewError.noTimestamp": "La vue de données sélectionnée ne dispose pas de champ d'horodatage. Veuillez sélectionner une autre vue de données.",
     "xpack.observability.customThreshold.rule.alertFlyout.defineTextQueryPrompt": "Définir le filtre de recherche (facultatif)",
-    "xpack.observability.customThreshold.rule.alertFlyout.docCountNoDataDisabledHelpText": "[Ce paramètre n’est pas applicable à l’agrégateur du nombre de documents.]",
     "xpack.observability.customThreshold.rule.alertFlyout.error.aggregationRequired": "L'agrégation est requise.",
     "xpack.observability.customThreshold.rule.alertFlyout.error.equation.invalidCharacters": "Le champ d'équation prend en charge uniquement les caractères suivants : A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, =",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidFilterQuery": "La requête de filtre n'est pas valide.",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidSearchConfiguration": "La vue de données est requise.",
-    "xpack.observability.customThreshold.rule.alertFlyout.error.metricRequired": "L'indicateur est requis.",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.aggTypeRequired": "L'agrégation est requise",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.fieldRequired": "Le champ est obligatoire",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metricsError": "Vous devez définir au moins 1 indicateur personnalisé",
@@ -30007,7 +29986,6 @@
     "xpack.osquery.updatePack.successToastMessageText": "Mise à jour réussie du pack \"{packName}\"",
     "xpack.osquery.viewSavedQuery.pageTitle": "Détails de \"{savedQueryId}\"",
     "xpack.osquery.action_details.fetchError": "Erreur lors de la récupération des détails d'action",
-    "xpack.osquery.action_policy_details.fetchError": "Erreur lors de la récupération des détails de politique",
     "xpack.osquery.action_results.errorSearchDescription": "Une erreur s'est produite lors de la recherche des résultats d'action",
     "xpack.osquery.action_results.failSearchDescription": "Impossible de récupérer les résultats d'action",
     "xpack.osquery.action_results.fetchError": "Erreur lors de la récupération des résultats d'action",
@@ -30028,7 +30006,6 @@
     "xpack.osquery.addSavedQuery.form.saveQueryButtonLabel": "Enregistrer la recherche",
     "xpack.osquery.addSavedQuery.pageTitle": "Ajouter une recherche enregistrée",
     "xpack.osquery.addSavedQuery.viewSavedQueriesListTitle": "Afficher toutes les recherches enregistrées",
-    "xpack.osquery.agent_groups.fetchError": "Erreur lors de la récupération des groupes d'agents",
     "xpack.osquery.agent_policies.fetchError": "Erreur lors de la récupération des politiques d'agents",
     "xpack.osquery.agent_policy_details.fetchError": "Erreur lors de la récupération des détails de politiques d'agents",
     "xpack.osquery.agent_status.fetchError": "Erreur lors de la récupération du statut des agents",
@@ -30688,7 +30665,6 @@
     "xpack.reporting.diagnostic.browserMissingDependency": "Le navigateur n'a pas pu démarrer correctement en raison de dépendances système manquantes. Veuillez consulter {url}",
     "xpack.reporting.diagnostic.browserMissingFonts": "Le navigateur n'a pas réussi à localiser de police par défaut. Consultez {url} pour corriger ce problème.",
     "xpack.reporting.diagnostic.noUsableSandbox": "Impossible d'utiliser la sandbox Chromium. Vous pouvez la désactiver à vos risques et périls avec \"xpack.screenshotting.browser.chromium.disableSandbox\". Veuillez consulter {url}",
-    "xpack.reporting.exportTypes.common.failedToDecryptReportJobDataErrorMessage": "Impossible de déchiffrer les données de la tâche de reporting. Veuillez vous assurer que {encryptionKey} est défini et générez à nouveau ce rapport. {err}",
     "xpack.reporting.jobResponse.errorHandler.notAuthorized": "Désolé, vous n'êtes pas autorisé à afficher ou supprimer les rapports {jobtype}",
     "xpack.reporting.jobsQuery.deleteError": "Impossible de supprimer le rapport : {error}",
     "xpack.reporting.jobStatusDetail.attemptXofY": "Tentative {attempts} sur {max_attempts}.",
@@ -30743,7 +30719,6 @@
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepThree": "Sous Gestion > Sécurité > Rôles, créez un ou plusieurs rôles permettant d'accorder le privilège de l'application Kibana à Reporting.",
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepTwo": "Supprimez le paramètre \"xpack.reporting.roles.allow\" du fichier kibana.yml, le cas échéant.",
     "xpack.reporting.errorHandler.unknownError": "Erreur inconnue",
-    "xpack.reporting.exportTypes.common.missingJobHeadersErrorMessage": "Les en-têtes de tâche sont manquants",
     "xpack.reporting.jobCreatedBy.unknownUserPlaceholderText": "Inconnu",
     "xpack.reporting.jobResponse.errorHandler.unknownError": "Erreur inconnue",
     "xpack.reporting.jobStatusDetail.deprecatedText": "Il s'agit d'un type d'exportation déclassé. L'automatisation de ce rapport devra être à nouveau créée pour une question de compatibilité avec les futures versions de Kibana.",
@@ -35070,7 +35045,6 @@
     "xpack.securitySolution.endpoint.policyNotFound": "Politique introuvable !",
     "xpack.securitySolution.endpoint.policyResponse.backLinkTitle": "Détails de point de terminaison",
     "xpack.securitySolution.endpoint.policyResponse.title": "Réponse de politique",
-    "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled": "Le manifeste est toujours mis à jour vers la dernière version disponible. Si vous voulez contrôler manuellement les mises à jour, désactivez \"Mettre à jour le manifeste automatiquement\".",
     "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabledTitle": "Mises à jour automatiques activées",
     "xpack.securitySolution.endpoint.protectionUpdates.cancel": "Annuler",
     "xpack.securitySolution.endpoint.protectionUpdates.deployedVersion.label": "Version actuellement déployée",
@@ -43333,6 +43307,8 @@
     "observabilityAlertDetails.alertThresholdTimeRangeRect.detailsTooltip": "Seuil",
     "randomSampling.ui.sliderControl.accuracyLabel": "Précision",
     "randomSampling.ui.sliderControl.performanceLabel": "Performances",
+    "reporting.commonExportTypesHelpers.missingJobHeadersErrorMessage": "Les en-têtes de tâche sont manquants",
+    "reporting.commonExportTypesHelpers.failedToDecryptReportJobDataErrorMessage": "Impossible de déchiffrer les données de la tâche de reporting. Veuillez vous assurer que {encryptionKey} est défini et générez à nouveau ce rapport. {err}",
     "reactPackages.mountPointPortal.errorMessage": "Erreur lors du rendu du contenu du portail.",
     "reporting.common.browserCouldNotLaunchErrorMessage": "Impossible de générer des captures d'écran, car le navigateur ne s’est pas lancé. Consultez les logs de serveur pour en savoir plus.",
     "reporting.common.cloud.insufficientSystemMemoryError": "Impossible de générer ce rapport en raison d’un manque de mémoire.",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 58375f665fa0cc..3819e84db48e4a 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -1218,7 +1218,6 @@
     "dashboard.createConfirmModal.continueButtonLabel": "編集を続行",
     "dashboard.createConfirmModal.unsavedChangesSubtitle": "編集を続行するか、空のダッシュボードで始めてください。",
     "dashboard.createConfirmModal.unsavedChangesTitle": "新しいダッシュボードはすでに実行中です",
-    "dashboard.dashboardAppBreadcrumbsTitle": "ダッシュボード",
     "dashboard.dashboardPageTitle": "ダッシュボード",
     "dashboard.dashboardWasSavedSuccessMessage": "ダッシュボード「{dashTitle}」が保存されました。",
     "dashboard.deleteError.toastDescription": "ダッシュボードの削除中にエラーが発生しました",
@@ -2470,7 +2469,6 @@
     "discover.notifications.notSavedSearchTitle": "検索「{savedSearchTitle}」は保存されませんでした。",
     "discover.notifications.savedSearchTitle": "検索「{savedSearchTitle}」が保存されました。",
     "discover.pageTitleWithoutSavedSearch": "Discover - 検索は保存されていません",
-    "discover.reloadSavedSearchButton": "検索をリセット",
     "discover.rootBreadcrumb": "Discover",
     "discover.sampleData.viewLinkLabel": "Discover",
     "discover.savedSearch.savedObjectName": "保存検索",
@@ -7971,7 +7969,7 @@
     "xpack.aiops.logRateAnalysis.resultsTable.impactLabelColumnTooltip": "メッセージレート差異に対するフィールドの影響のレベル。",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardButtonLabel": "クリップボードにコピー",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardGroupMessage": "グループアイテムをKQL構文としてクリップボードにコピー",
-    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantTermMessage": "フィールド/値のペアをKQL構文としてクリップボードにコピー",
+    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantItemMessage": "フィールド/値のペアをKQL構文としてクリップボードにコピー",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInDiscover": "Discoverに表示",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInLogPatternAnalysis": "ログパターン分析で表示",
     "xpack.aiops.logRateAnalysis.resultsTable.logPatternLinkNotAvailableTooltipMessage": "テーブル項目がログパターン自体の場合は、このリンクは使用できません。",
@@ -20111,17 +20109,7 @@
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardDocsLabel": "主シャードの最大ドキュメント数",
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardSizeLabel": "最大プライマリシャードサイズ",
     "xpack.indexLifecycleMgmt.hotPhase.rolloverFieldTitle": "ロールオーバー",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle": "アクションステータス",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader": "現在のステータス",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader": "現在のアクション時間",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader": "現在のフェーズ",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader": "失敗したステップ",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader": "ライフサイクルポリシー",
     "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle": "フェーズ検知",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton": "フェーズ検知を表示",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle": "フェーズ検知",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage": "インデックスライフサイクルエラー",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle": "インデックスライフサイクル管理",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyButtonText": "ポリシーを追加",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexError": "インデックスへのポリシーの追加中にエラーが発生しました",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.cancelButtonText": "キャンセル",
@@ -23611,7 +23599,6 @@
     "xpack.maps.source.esSearch.loadTooltipPropertiesErrorMsg": "ドキュメントが見つかりません。_id: {docId}",
     "xpack.maps.source.esSearch.mvtScalingJoinMsg": "ベクトルタイルは1つの用語結合をサポートします。レイヤーには{numberOfJoins}個の結合があります。ベクトルタイルに切り替えると、最初の結合が保持され、すべての他の用語結合がレイヤー構成から削除されます。",
     "xpack.maps.source.esSource.noGeoFieldErrorMessage": "データビュー\"{indexPatternLabel}\"には現在ジオフィールド\"{geoField}\"が含まれていません",
-    "xpack.maps.source.esSource.requestFailedErrorMessage": "Elasticsearch検索リクエストを実行できませんでした。エラー：{message}",
     "xpack.maps.source.esSource.stylePropsMetaRequestName": "{layerName} - メタデータ",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlHelpMessage": ".mvtベクトルタイルサービスのURL。例：{url}",
     "xpack.maps.source.pewPew.inspectorDescription": "データビューからパスを取得します：{dataViewName}、ソース：{sourceFieldName}、デスティネーション：{destFieldName}",
@@ -29103,8 +29090,6 @@
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabel": "最後の{lookback} {timeLabel}",
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabelWithGrouping": "{id}のデータの最後の{lookback} {timeLabel}",
     "xpack.observability.customThreshold.rule.threshold.errorAlertReason": "{metric}のデータのクエリを試行しているときに、Elasticsearchが失敗しました",
-    "xpack.observability.customThreshold.rule.threshold.noDataAlertReason": "{metric}は最後の{interval}{group}でデータがないことを報告しました",
-    "xpack.observability.customThreshold.rule.threshold.recoveredAlertReason": "{metric} が {comparator} に、{group} が {threshold} のしきい値（現在の値は {currentValue}）になりました",
     "xpack.observability.customThreshold.rule.threshold.thresholdRange": "{a}および{b}",
     "xpack.observability.customThreshold.rule.thresholdExtraTitle": "{comparator} {threshold}のときにアラートを通知",
     "xpack.observability.enableAgentExplorerDescription": "{betaLabel}エージェントエクスプローラー表示を有効にします。",
@@ -29135,7 +29120,6 @@
     "xpack.observability.slo.list.sortByType": "{type}で並べ替え",
     "xpack.observability.slo.partitionByBadge": "{partitionKey}でパーティション",
     "xpack.observability.slo.rules.burnRate.errors.invalidThresholdValue": "バーンレートしきい値は1以上{maxBurnRate}以下でなければなりません。",
-    "xpack.observability.slo.rules.errorBudgetExhaustion.text": "予算オーバーエラーまで{formatedHours}時間。",
     "xpack.observability.slo.rules.groupByMessage": "選択したSLOは\"{groupByField}\"にパーティションが作成されました。このルールは、パーティションフィールドで見つかったすべてのインスタンスを監視し、アラートを生成します。",
     "xpack.observability.slo.rules.longWindowDuration.tooltip": "バーンレートが計算されるルックバック期間。ルックバック期間を{shortWindowDuration}分（ルックバック期間の1/12）と短くすることで、より高速な復帰が可能になります",
     "xpack.observability.slo.slo.activeAlertsBadge.label": "{count, plural, other {#件のアラート}}",
@@ -29253,9 +29237,6 @@
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.count": "ドキュメントカウント",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.max": "最高",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.min": "最低",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p95": "95パーセンタイル",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p99": "99パーセンタイル",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.rate": "レート",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.sum": "合計",
     "xpack.observability.customThreshold.rule.alertFlyout.alertDescription": "オブザーバビリティデータタイプが特定の値以上になったときにアラートを送信します。",
     "xpack.observability.customThreshold.rule.alertFlyout.alertOnGroupDisappear": "グループがデータのレポートを停止する場合にアラートで通知する",
@@ -29276,12 +29257,10 @@
     "xpack.observability.customThreshold.rule.alertFlyout.customEquationTooltip": "これは基本的な数学ロジック（A + B / C）とブールロジック（A < B ?A :B）をサポートします。",
     "xpack.observability.customThreshold.rule.alertFlyout.dataViewError.noTimestamp": "選択したデータビューにタイムスタンプフィールドがありません。他のデータビューを選択してください。",
     "xpack.observability.customThreshold.rule.alertFlyout.defineTextQueryPrompt": "クエリフィルターを定義（任意）",
-    "xpack.observability.customThreshold.rule.alertFlyout.docCountNoDataDisabledHelpText": "[この設定は、ドキュメントカウントアグリゲーターには適用されません。]",
     "xpack.observability.customThreshold.rule.alertFlyout.error.aggregationRequired": "集約が必要です。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.equation.invalidCharacters": "等式フィールドでは次の文字のみを使用できます：A-Z、+、-、/、*、(、)、?、!、&、:、|、>、<、=",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidFilterQuery": "フィルタークエリは無効です。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidSearchConfiguration": "データビューが必要です。",
-    "xpack.observability.customThreshold.rule.alertFlyout.error.metricRequired": "メトリックが必要です。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.aggTypeRequired": "集約が必要です",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.fieldRequired": "フィールドが必要です",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metricsError": "1つ以上のカスタムメトリックを定義する必要があります",
@@ -30006,7 +29985,6 @@
     "xpack.osquery.updatePack.successToastMessageText": "正常に\"{packName}\"パックを更新しました",
     "xpack.osquery.viewSavedQuery.pageTitle": "\"{savedQueryId}\"詳細",
     "xpack.osquery.action_details.fetchError": "アクション詳細の取得中にエラーが発生しました",
-    "xpack.osquery.action_policy_details.fetchError": "ポリシー詳細の取得中にエラーが発生しました",
     "xpack.osquery.action_results.errorSearchDescription": "アクション結果検索でエラーが発生しました",
     "xpack.osquery.action_results.failSearchDescription": "アクション詳細を取得できませんでした",
     "xpack.osquery.action_results.fetchError": "アクション結果の取得中にエラーが発生しました",
@@ -30027,7 +30005,6 @@
     "xpack.osquery.addSavedQuery.form.saveQueryButtonLabel": "クエリを保存",
     "xpack.osquery.addSavedQuery.pageTitle": "保存されたクエリの追加",
     "xpack.osquery.addSavedQuery.viewSavedQueriesListTitle": "すべての保存されたクエリを表示",
-    "xpack.osquery.agent_groups.fetchError": "エージェントグループの取得中にエラーが発生しました",
     "xpack.osquery.agent_policies.fetchError": "エージェントポリシーの取得中にエラーが発生しました",
     "xpack.osquery.agent_policy_details.fetchError": "エージェントポリシー詳細の取得中にエラーが発生しました",
     "xpack.osquery.agent_status.fetchError": "エージェントステータスの取得中にエラーが発生しました",
@@ -30687,7 +30664,6 @@
     "xpack.reporting.diagnostic.browserMissingDependency": "システム依存関係が不足しているため、ブラウザーを正常に起動できませんでした。{url}を参照してください",
     "xpack.reporting.diagnostic.browserMissingFonts": "ブラウザーはデフォルトフォントを検索できませんでした。この問題を修正するには、{url}を参照してください。",
     "xpack.reporting.diagnostic.noUsableSandbox": "Chromiumサンドボックスを使用できません。これは「xpack.screenshotting.browser.chromium.disableSandbox」で無効にすることができます。この作業はご自身の責任で行ってください。{url}を参照してください",
-    "xpack.reporting.exportTypes.common.failedToDecryptReportJobDataErrorMessage": "レポートジョブデータの解読に失敗しました。{encryptionKey} が設定されていることを確認してこのレポートを再生成してください。{err}",
     "xpack.reporting.jobResponse.errorHandler.notAuthorized": "{jobtype}レポートを表示または削除する権限がありません",
     "xpack.reporting.jobsQuery.deleteError": "レポートを削除できません：{error}",
     "xpack.reporting.jobStatusDetail.attemptXofY": "{max_attempts}回中{attempts}回試行します。",
@@ -30742,7 +30718,6 @@
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepThree": "［管理］>［セキュリティ］>［ロール］から、レポートのKibanaアプリケーション権限を付与する1つ以上のロールを作成します。",
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepTwo": "存在する場合は、kibana.ymlで「xpack.reporting.roles.allow」を削除します。",
     "xpack.reporting.errorHandler.unknownError": "不明なエラー",
-    "xpack.reporting.exportTypes.common.missingJobHeadersErrorMessage": "ジョブヘッダーがありません",
     "xpack.reporting.jobCreatedBy.unknownUserPlaceholderText": "不明",
     "xpack.reporting.jobResponse.errorHandler.unknownError": "不明なエラー",
     "xpack.reporting.jobStatusDetail.deprecatedText": "これは廃止予定のエクスポートタイプです。将来のバージョンのKibanaとの互換性のためには、このレポートの自動化を再作成する必要があります。",
@@ -35068,7 +35043,6 @@
     "xpack.securitySolution.endpoint.policyNotFound": "ポリシーが見つかりません。",
     "xpack.securitySolution.endpoint.policyResponse.backLinkTitle": "エンドポイント詳細",
     "xpack.securitySolution.endpoint.policyResponse.title": "ポリシー応答",
-    "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled": "マニフェストは利用可能な最新バージョンに常に更新されます。更新を手動で管理する場合は、\"マニフェストを自動的に更新\"を無効にします。",
     "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabledTitle": "自動更新が有効です",
     "xpack.securitySolution.endpoint.protectionUpdates.cancel": "キャンセル",
     "xpack.securitySolution.endpoint.protectionUpdates.deployedVersion.label": "現在デプロイされているバージョン",
@@ -43323,6 +43297,8 @@
     "observabilityAlertDetails.alertThresholdTimeRangeRect.detailsTooltip": "しきい値",
     "randomSampling.ui.sliderControl.accuracyLabel": "精度",
     "randomSampling.ui.sliderControl.performanceLabel": "パフォーマンス",
+    "reporting.commonExportTypesHelpers.failedToDecryptReportJobDataErrorMessage": "レポートジョブデータの解読に失敗しました。{encryptionKey} が設定されていることを確認してこのレポートを再生成してください。{err}",
+    "reporting.commonExportTypesHelpers.missingJobHeadersErrorMessage": "ジョブヘッダーがありません",
     "reactPackages.mountPointPortal.errorMessage": "ポータルコンテンツのレンダリングエラー",
     "reporting.common.browserCouldNotLaunchErrorMessage": "ブラウザーが起動していないため、スクリーンショットを生成できません。詳細については、サーバーログを参照してください。",
     "reporting.common.cloud.insufficientSystemMemoryError": "メモリ不足のため、このレポートを生成できません。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 003312fef8d198..5f86f2816eeedf 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -1218,7 +1218,6 @@
     "dashboard.createConfirmModal.continueButtonLabel": "继续编辑",
     "dashboard.createConfirmModal.unsavedChangesSubtitle": "继续编辑或使用空白仪表板从头开始。",
     "dashboard.createConfirmModal.unsavedChangesTitle": "新仪表板已在创建中",
-    "dashboard.dashboardAppBreadcrumbsTitle": "仪表板",
     "dashboard.dashboardPageTitle": "仪表板",
     "dashboard.dashboardWasSavedSuccessMessage": "仪表板“{dashTitle}”已保存",
     "dashboard.deleteError.toastDescription": "删除仪表板时发生错误",
@@ -2470,7 +2469,6 @@
     "discover.notifications.notSavedSearchTitle": "搜索“{savedSearchTitle}”未保存。",
     "discover.notifications.savedSearchTitle": "搜索“{savedSearchTitle}”已保存",
     "discover.pageTitleWithoutSavedSearch": "Discover - 尚未保存搜索",
-    "discover.reloadSavedSearchButton": "重置搜索",
     "discover.rootBreadcrumb": "Discover",
     "discover.sampleData.viewLinkLabel": "Discover",
     "discover.savedSearch.savedObjectName": "已保存搜索",
@@ -7970,7 +7968,7 @@
     "xpack.aiops.logRateAnalysis.resultsTable.impactLabelColumnTooltip": "字段对消息速率差异的影响水平。",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardButtonLabel": "复制到剪贴板",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardGroupMessage": "将组项目作为 KQL 语法复制到剪贴板",
-    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantTermMessage": "将字段/值对作为 KQL 语法复制到剪贴板",
+    "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.copyToClipboardSignificantItemMessage": "将字段/值对作为 KQL 语法复制到剪贴板",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInDiscover": "在 Discover 中查看",
     "xpack.aiops.logRateAnalysis.resultsTable.linksMenu.viewInLogPatternAnalysis": "在日志模式分析中查看",
     "xpack.aiops.logRateAnalysis.resultsTable.logPatternLinkNotAvailableTooltipMessage": "如果表项目为日志模式本身，则此链接不可用。",
@@ -20111,17 +20109,7 @@
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardDocsLabel": "主要分片中的最大文档数",
     "xpack.indexLifecycleMgmt.hotPhase.maximumPrimaryShardSizeLabel": "最大主分片大小",
     "xpack.indexLifecycleMgmt.hotPhase.rolloverFieldTitle": "滚动更新",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.actionStatusTitle": "操作状态",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionHeader": "当前操作",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentActionTimeHeader": "当前操作名称",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.currentPhaseHeader": "当前阶段",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.failedStepHeader": "失败的步骤",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.headers.lifecyclePolicyHeader": "生命周期策略",
     "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.phaseDefinitionTitle": "阶段定义",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionButton": "显示阶段定义",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.showPhaseDefinitionDescriptionTitle": "阶段定义",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryErrorMessage": "索引生命周期错误",
-    "xpack.indexLifecycleMgmt.indexLifecycleMgmtSummary.summaryTitle": "索引生命周期管理",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyButtonText": "添加策略",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexError": "向索引添加策略时出错",
     "xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.cancelButtonText": "取消",
@@ -23611,7 +23599,6 @@
     "xpack.maps.source.esSearch.loadTooltipPropertiesErrorMsg": "找不到文档，_id：{docId}",
     "xpack.maps.source.esSearch.mvtScalingJoinMsg": "矢量磁贴支持一个词联接。您的图层具有 {numberOfJoins} 个联接。切换到矢量磁贴会保留第一个词联接，并从图层配置中移除所有其他联接。",
     "xpack.maps.source.esSource.noGeoFieldErrorMessage": "数据视图“{indexPatternLabel}”不再包含地理字段“{geoField}”",
-    "xpack.maps.source.esSource.requestFailedErrorMessage": "Elasticsearch 搜索请求失败，错误：{message}",
     "xpack.maps.source.esSource.stylePropsMetaRequestName": "{layerName} - 元数据",
     "xpack.maps.source.MVTSingleLayerVectorSourceEditor.urlHelpMessage": ".mvt 矢量磁帖服务的 URL。例如 {url}",
     "xpack.maps.source.pewPew.inspectorDescription": "获取路径的数据视图：{dataViewName}、源：{sourceFieldName}、目标：{destFieldName}",
@@ -29101,8 +29088,6 @@
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabel": "过去 {lookback} {timeLabel}",
     "xpack.observability.customThreshold.rule.alerts.dataTimeRangeLabelWithGrouping": "{id} 过去 {lookback} {timeLabel}的数据",
     "xpack.observability.customThreshold.rule.threshold.errorAlertReason": "Elasticsearch 尝试查询 {metric} 的数据时出现故障",
-    "xpack.observability.customThreshold.rule.threshold.noDataAlertReason": "对于 {group}，{metric} 在过去 {interval}中未报告数据",
-    "xpack.observability.customThreshold.rule.threshold.recoveredAlertReason": "对于 {group}，{metric} 现在{comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.observability.customThreshold.rule.threshold.thresholdRange": "{a} 和 {b}",
     "xpack.observability.customThreshold.rule.thresholdExtraTitle": "{comparator} {threshold} 时告警",
     "xpack.observability.enableAgentExplorerDescription": "{betaLabel} 启用代理浏览器视图。",
@@ -29133,7 +29118,6 @@
     "xpack.observability.slo.list.sortByType": "按 {type} 排序",
     "xpack.observability.slo.partitionByBadge": "按 {partitionKey} 分区",
     "xpack.observability.slo.rules.burnRate.errors.invalidThresholdValue": "消耗速度阈值必须介于 1 和 {maxBurnRate} 之间。",
-    "xpack.observability.slo.rules.errorBudgetExhaustion.text": "{formatedHours} 小时，直到错误预算耗尽。",
     "xpack.observability.slo.rules.groupByMessage": "已使用分区在“{groupByField}”上创建您选定的 SLO。此规则将监测在分区字段中发现的每个实例并为其生成告警。",
     "xpack.observability.slo.rules.longWindowDuration.tooltip": "在其间计算消耗速度的回顾期。将使用 {shortWindowDuration} 分钟的较短回顾期（1/12 的回顾期）以便更快恢复",
     "xpack.observability.slo.slo.activeAlertsBadge.label": "{count, plural, other {# 个告警}}",
@@ -29251,9 +29235,6 @@
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.count": "文档计数",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.max": "最大值",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.min": "最小值",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p95": "第 95 个百分位",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.p99": "第 99 个百分位",
-    "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.rate": "比率",
     "xpack.observability.customThreshold.rule.alertFlyout.aggregationText.sum": "求和",
     "xpack.observability.customThreshold.rule.alertFlyout.alertDescription": "任何 Observability 数据类型到达或超出给定值时告警。",
     "xpack.observability.customThreshold.rule.alertFlyout.alertOnGroupDisappear": "组停止报告数据时提醒我",
@@ -29274,12 +29255,10 @@
     "xpack.observability.customThreshold.rule.alertFlyout.customEquationTooltip": "这支持基本数学 (A + B / C) 和布尔逻辑 (A < B ?A :B)。",
     "xpack.observability.customThreshold.rule.alertFlyout.dataViewError.noTimestamp": "选定数据视图没有时间戳字段，请选择其他数据视图。",
     "xpack.observability.customThreshold.rule.alertFlyout.defineTextQueryPrompt": "定义查询筛选（可选）",
-    "xpack.observability.customThreshold.rule.alertFlyout.docCountNoDataDisabledHelpText": "[此设置不适用于文档计数聚合器。]",
     "xpack.observability.customThreshold.rule.alertFlyout.error.aggregationRequired": "“聚合”必填。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.equation.invalidCharacters": "方程字段仅支持以下字符：A-Z、+、-、/、*、(、)、?、!、&、:、|、>、<、=",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidFilterQuery": "筛选查询无效。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.invalidSearchConfiguration": "需要数据视图。",
-    "xpack.observability.customThreshold.rule.alertFlyout.error.metricRequired": "“指标”必填。",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.aggTypeRequired": "“聚合”必填",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metrics.fieldRequired": "“字段”必填",
     "xpack.observability.customThreshold.rule.alertFlyout.error.metricsError": "必须至少定义 1 个定制指标",
@@ -30004,7 +29983,6 @@
     "xpack.osquery.updatePack.successToastMessageText": "已成功更新“{packName}”包",
     "xpack.osquery.viewSavedQuery.pageTitle": "“{savedQueryId}”详情",
     "xpack.osquery.action_details.fetchError": "提取操作详情时出错",
-    "xpack.osquery.action_policy_details.fetchError": "提取策略详情时出错",
     "xpack.osquery.action_results.errorSearchDescription": "搜索操作结果时发生错误",
     "xpack.osquery.action_results.failSearchDescription": "无法获取操作结果",
     "xpack.osquery.action_results.fetchError": "提取操作结果时出错",
@@ -30025,7 +30003,6 @@
     "xpack.osquery.addSavedQuery.form.saveQueryButtonLabel": "保存查询",
     "xpack.osquery.addSavedQuery.pageTitle": "添加已保存查询",
     "xpack.osquery.addSavedQuery.viewSavedQueriesListTitle": "查看所有已保存查询",
-    "xpack.osquery.agent_groups.fetchError": "提取代理组时出错",
     "xpack.osquery.agent_policies.fetchError": "提取代理策略时出错",
     "xpack.osquery.agent_policy_details.fetchError": "提取代理策略详情时出错",
     "xpack.osquery.agent_status.fetchError": "提取代理状态时出错",
@@ -30685,7 +30662,6 @@
     "xpack.reporting.diagnostic.browserMissingDependency": "由于缺少系统依赖项，浏览器无法正常启动。请参见 {url}",
     "xpack.reporting.diagnostic.browserMissingFonts": "浏览器找不到默认字体。请参见 {url} 以解决此问题。",
     "xpack.reporting.diagnostic.noUsableSandbox": "无法使用 Chromium 沙盒。您自行承担使用“xpack.screenshotting.browser.chromium.disableSandbox”禁用此项的风险。请参见 {url}",
-    "xpack.reporting.exportTypes.common.failedToDecryptReportJobDataErrorMessage": "无法解密报告作业数据。请确保已设置 {encryptionKey}，然后重新生成此报告。{err}",
     "xpack.reporting.jobResponse.errorHandler.notAuthorized": "抱歉，您无权查看或删除 {jobtype} 报告",
     "xpack.reporting.jobsQuery.deleteError": "无法删除报告：{error}",
     "xpack.reporting.jobStatusDetail.attemptXofY": "尝试 {attempts} 次，最多可尝试 {max_attempts} 次。",
@@ -30740,7 +30716,6 @@
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepThree": "前往“管理”>“安全性”>“角色”以创建一个或多个针对 Reporting 授予 Kibana 应用程序权限的角色。",
     "xpack.reporting.deprecations.reportingRoleUsers.manualStepTwo": "移除 kibana.yml 中的“xpack.reporting.roles.allow”（如果存在）。",
     "xpack.reporting.errorHandler.unknownError": "未知错误",
-    "xpack.reporting.exportTypes.common.missingJobHeadersErrorMessage": "作业标头缺失",
     "xpack.reporting.jobCreatedBy.unknownUserPlaceholderText": "未知",
     "xpack.reporting.jobResponse.errorHandler.unknownError": "未知错误",
     "xpack.reporting.jobStatusDetail.deprecatedText": "这是已弃用的导出类型。此报告的自动化将需要重新创建，才能与未来版本的 Kibana 兼容。",
@@ -35064,7 +35039,6 @@
     "xpack.securitySolution.endpoint.policyNotFound": "未找到策略！",
     "xpack.securitySolution.endpoint.policyResponse.backLinkTitle": "终端详情",
     "xpack.securitySolution.endpoint.policyResponse.title": "策略响应",
-    "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabled": "会始终将清单更新到可用的最新版本。如果不想手动控制更新，请禁用“自动更新清单”。",
     "xpack.securitySolution.endpoint.protectionUpdates.automaticUpdates.enabledTitle": "已启用自动更新",
     "xpack.securitySolution.endpoint.protectionUpdates.cancel": "取消",
     "xpack.securitySolution.endpoint.protectionUpdates.deployedVersion.label": "当前部署的版本",
@@ -43317,6 +43291,8 @@
     "observabilityAlertDetails.alertThresholdTimeRangeRect.detailsTooltip": "阈值",
     "randomSampling.ui.sliderControl.accuracyLabel": "准确性",
     "randomSampling.ui.sliderControl.performanceLabel": "性能",
+    "reporting.commonExportTypesHelpers.missingJobHeadersErrorMessage": "作业标头缺失",
+    "reporting.commonExportTypesHelpers.failedToDecryptReportJobDataErrorMessage": "无法解密报告作业数据。请确保已设置 {encryptionKey}，然后重新生成此报告。{err}",
     "reactPackages.mountPointPortal.errorMessage": "呈现门户内容时出错",
     "reporting.common.browserCouldNotLaunchErrorMessage": "无法生成屏幕截图，因为浏览器未启动。有关更多信息，请查看服务器日志。",
     "reporting.common.cloud.insufficientSystemMemoryError": "由于内存不足，无法生成此报告。",
diff --git a/x-pack/plugins/triggers_actions_ui/common/experimental_features.ts b/x-pack/plugins/triggers_actions_ui/common/experimental_features.ts
index 501d9b7f222397..066487d5af6a49 100644
--- a/x-pack/plugins/triggers_actions_ui/common/experimental_features.ts
+++ b/x-pack/plugins/triggers_actions_ui/common/experimental_features.ts
@@ -19,6 +19,8 @@ export const allowedExperimentalValues = Object.freeze({
   rulesDetailLogs: true,
   ruleUseExecutionStatus: false,
   ruleKqlBar: false,
+  isMustacheAutocompleteOn: false,
+  showMustacheAutocompleteSwitch: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
@@ -29,7 +31,8 @@ const allowedKeys = Object.keys(allowedExperimentalValues) as Readonly<Experimen
 
 /**
  * Parses the string value used in `xpack.trigger_actions_ui.enableExperimental` kibana configuration,
- * which should be a string of values delimited by a comma (`,`)
+ * which should be a string of values delimited by a comma (`,`):
+ * xpack.trigger_actions_ui.enableExperimental: ['ruleStatusFilter', 'ruleTagFilter']
  *
  * @param configValue
  * @throws TriggersActionsUIInvalidExperimentalValue
diff --git a/x-pack/plugins/stack_connectors/public/components/text_area_with_autocomplete.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/index.tsx
similarity index 98%
rename from x-pack/plugins/stack_connectors/public/components/text_area_with_autocomplete.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/index.tsx
index 0f51b3ced86c62..53f0d7d500eedd 100644
--- a/x-pack/plugins/stack_connectors/public/components/text_area_with_autocomplete.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/index.tsx
@@ -22,8 +22,8 @@ import {
 import { ActionVariable } from '@kbn/alerting-plugin/common';
 import { AddMessageVariables } from '@kbn/alerts-ui-shared';
 import { euiThemeVars } from '@kbn/ui-theme';
-import { filterSuggestions } from '../lib/filter_suggestions_for_autocomplete';
-import { templateActionVariable } from '../lib/template_action_variable';
+import { filterSuggestions } from './lib/filter_suggestions_for_autocomplete';
+import { templateActionVariable } from './lib/template_action_variable';
 
 export interface TextAreaWithAutocompleteProps {
   editAction: (property: string, value: any, index: number) => void;
@@ -291,7 +291,6 @@ export const TextAreaWithAutocomplete: React.FunctionComponent<TextAreaWithAutoc
     }
   }, [editAction, index, inputTargetValue, isListOpen, paramsProperty]);
   const onClick = useCallback(() => closeList(), [closeList]);
-
   const onScroll = useCallback(
     (evt) => {
       // FUTURE ENGINEER -> we need to make sure to not close the autocomplete option list
diff --git a/x-pack/plugins/stack_connectors/public/lib/filter_suggestions_for_autocomplete.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/filter_suggestions_for_autocomplete.test.ts
similarity index 100%
rename from x-pack/plugins/stack_connectors/public/lib/filter_suggestions_for_autocomplete.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/filter_suggestions_for_autocomplete.test.ts
diff --git a/x-pack/plugins/stack_connectors/public/lib/filter_suggestions_for_autocomplete.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/filter_suggestions_for_autocomplete.ts
similarity index 100%
rename from x-pack/plugins/stack_connectors/public/lib/filter_suggestions_for_autocomplete.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/filter_suggestions_for_autocomplete.ts
diff --git a/x-pack/plugins/stack_connectors/public/lib/template_action_variable.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/template_action_variable.test.ts
similarity index 100%
rename from x-pack/plugins/stack_connectors/public/lib/template_action_variable.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/template_action_variable.test.ts
diff --git a/x-pack/plugins/stack_connectors/public/lib/template_action_variable.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/template_action_variable.ts
similarity index 100%
rename from x-pack/plugins/stack_connectors/public/lib/template_action_variable.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_autocomplete/lib/template_action_variable.ts
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx
index c19ac416b46950..e666082638ea71 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/text_area_with_message_variables.tsx
@@ -9,6 +9,8 @@ import React, { useState } from 'react';
 import { EuiTextArea, EuiFormRow } from '@elastic/eui';
 import { ActionVariable } from '@kbn/alerting-plugin/common';
 import { AddMessageVariables } from '@kbn/alerts-ui-shared';
+import { getIsExperimentalFeatureEnabled } from '../../common/get_experimental_features';
+import { TextAreaWithAutocomplete } from './text_area_with_autocomplete';
 import { templateActionVariable } from '../lib';
 
 interface Props {
@@ -23,7 +25,7 @@ interface Props {
   errors?: string[];
 }
 
-export const TextAreaWithMessageVariables: React.FunctionComponent<Props> = ({
+const TextAreaWithMessageVariablesLegacy: React.FunctionComponent<Props> = ({
   messageVariables,
   paramsProperty,
   index,
@@ -87,3 +89,15 @@ export const TextAreaWithMessageVariables: React.FunctionComponent<Props> = ({
     </EuiFormRow>
   );
 };
+
+export const TextAreaWithMessageVariables = (props: Props) => {
+  let isMustacheAutocompleteOn;
+  try {
+    isMustacheAutocompleteOn = getIsExperimentalFeatureEnabled('isMustacheAutocompleteOn');
+  } catch (e) {
+    isMustacheAutocompleteOn = false;
+  }
+
+  if (isMustacheAutocompleteOn) return TextAreaWithAutocomplete(props);
+  return TextAreaWithMessageVariablesLegacy(props);
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_rule_aad_template_fields.ts b/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_rule_aad_template_fields.ts
new file mode 100644
index 00000000000000..99be4c4b118b8a
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_rule_aad_template_fields.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { HttpStart } from '@kbn/core-http-browser';
+import { DataViewField } from '@kbn/data-views-plugin/common';
+import { BASE_RAC_ALERTS_API_PATH } from '@kbn/rule-registry-plugin/common';
+import { ActionVariable } from '@kbn/alerting-plugin/common';
+import { useEffect, useMemo, useState } from 'react';
+import { EcsFlat } from '@kbn/ecs';
+import { EcsMetadata } from '@kbn/alerts-as-data-utils/src/field_maps/types';
+import { isEmpty } from 'lodash';
+
+export const getDescription = (fieldName: string, ecsFlat: Record<string, EcsMetadata>) => {
+  let ecsField = ecsFlat[fieldName];
+  if (isEmpty(ecsField?.description ?? '') && fieldName.includes('kibana.alert.')) {
+    ecsField = ecsFlat[fieldName.replace('kibana.alert.', '')];
+  }
+  return ecsField?.description ?? '';
+};
+
+async function loadRuleTypeAadTemplateFields({
+  http,
+  ruleTypeId,
+}: {
+  http: HttpStart;
+  ruleTypeId: string;
+}): Promise<DataViewField[]> {
+  if (!ruleTypeId || !http) return [];
+  const fields = await http.get<DataViewField[]>(`${BASE_RAC_ALERTS_API_PATH}/aad_fields`, {
+    query: { ruleTypeId },
+  });
+
+  return fields;
+}
+
+export function useRuleTypeAadTemplateFields(
+  http: HttpStart,
+  ruleTypeId: string | undefined,
+  enabled: boolean
+): { isLoading: boolean; fields: ActionVariable[] } {
+  // Reimplement useQuery here; this hook is sometimes called in contexts without a QueryClientProvider
+  const [isLoading, setIsLoading] = useState(false);
+  const [data, setData] = useState<DataViewField[]>([]);
+
+  useEffect(() => {
+    if (enabled && data.length === 0 && ruleTypeId) {
+      setIsLoading(true);
+      loadRuleTypeAadTemplateFields({ http, ruleTypeId }).then((res) => {
+        setData(res);
+        setIsLoading(false);
+      });
+    }
+  }, [data, enabled, http, ruleTypeId]);
+
+  return useMemo(
+    () => ({
+      isLoading,
+      fields: data.map<ActionVariable>((d) => ({
+        name: d.name,
+        description: getDescription(d.name, EcsFlat),
+      })),
+    }),
+    [data, isLoading]
+  );
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/clone.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/clone.test.ts
index 54e987d18c9177..cc9b1ddab02183 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/clone.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/clone.test.ts
@@ -75,6 +75,7 @@ describe('cloneRule', () => {
               "level": "info",
               "message": "alert ",
             },
+            "useAlertDataForTemplate": undefined,
             "uuid": "123456",
           },
         ],
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
index e659cfbdfe4bd0..da0cd8419e0785 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/common_transformations.ts
@@ -16,11 +16,13 @@ const transformAction: RewriteRequestCase<RuleAction> = ({
   params,
   frequency,
   alerts_filter: alertsFilter,
+  use_alert_data_for_template: useAlertDataForTemplate,
 }) => ({
   group,
   id,
   params,
   actionTypeId,
+  useAlertDataForTemplate,
   ...(frequency
     ? {
         frequency: {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.ts
index d8b8c85ad26a52..a2ab9c5b4dc3c2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.ts
@@ -27,17 +27,20 @@ const rewriteBodyRequest: RewriteResponseCase<RuleCreateBody> = ({
 }): any => ({
   ...res,
   rule_type_id: ruleTypeId,
-  actions: actions.map(({ group, id, params, frequency, alertsFilter }) => ({
-    group,
-    id,
-    params,
-    frequency: {
-      notify_when: frequency!.notifyWhen,
-      throttle: frequency!.throttle,
-      summary: frequency!.summary,
-    },
-    alerts_filter: alertsFilter,
-  })),
+  actions: actions.map(
+    ({ group, id, params, frequency, alertsFilter, useAlertDataForTemplate }) => ({
+      group,
+      id,
+      params,
+      frequency: {
+        notify_when: frequency!.notifyWhen,
+        throttle: frequency!.throttle,
+        summary: frequency!.summary,
+      },
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+    })
+  ),
 });
 
 export async function createRule({
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/update.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/update.ts
index ee2418d22262b9..0d6371cfa1fdbd 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/update.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/update.ts
@@ -17,18 +17,21 @@ type RuleUpdatesBody = Pick<
 >;
 const rewriteBodyRequest: RewriteResponseCase<RuleUpdatesBody> = ({ actions, ...res }): any => ({
   ...res,
-  actions: actions.map(({ group, id, params, frequency, uuid, alertsFilter }) => ({
-    group,
-    id,
-    params,
-    frequency: {
-      notify_when: frequency!.notifyWhen,
-      throttle: frequency!.throttle,
-      summary: frequency!.summary,
-    },
-    alerts_filter: alertsFilter,
-    ...(uuid && { uuid }),
-  })),
+  actions: actions.map(
+    ({ group, id, params, frequency, uuid, alertsFilter, useAlertDataForTemplate }) => ({
+      group,
+      id,
+      params,
+      frequency: {
+        notify_when: frequency!.notifyWhen,
+        throttle: frequency!.throttle,
+        summary: frequency!.summary,
+      },
+      alerts_filter: alertsFilter,
+      use_alert_data_for_template: useAlertDataForTemplate,
+      ...(uuid && { uuid }),
+    })
+  ),
 });
 
 export async function updateRule({
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
index d515cd9510cc6d..6d91e1837b8300 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
@@ -60,6 +60,7 @@ export interface ActionAccordionFormProps {
   defaultActionMessage?: string;
   setActionIdByIndex: (id: string, index: number) => void;
   setActionGroupIdByIndex?: (group: string, index: number) => void;
+  setActionUseAlertDataForTemplate?: (enabled: boolean, index: number) => void;
   setActions: (actions: RuleAction[]) => void;
   setActionParamsProperty: (key: string, value: RuleActionParam, index: number) => void;
   setActionFrequencyProperty: (key: string, value: RuleActionParam, index: number) => void;
@@ -70,6 +71,7 @@ export interface ActionAccordionFormProps {
   ) => void;
   featureId: string;
   producerId: string;
+  ruleTypeId?: string;
   messageVariables?: ActionVariables;
   summaryMessageVariables?: ActionVariables;
   setHasActionsDisabled?: (value: boolean) => void;
@@ -84,7 +86,6 @@ export interface ActionAccordionFormProps {
   minimumThrottleInterval?: [number | undefined, string];
   notifyWhenSelectOptions?: NotifyWhenSelectOptions[];
   defaultRuleFrequency?: RuleActionFrequency;
-  ruleTypeId?: string;
   hasFieldsForAAD?: boolean;
   disableErrorMessages?: boolean;
 }
@@ -99,6 +100,7 @@ export const ActionForm = ({
   defaultActionGroupId,
   setActionIdByIndex,
   setActionGroupIdByIndex,
+  setActionUseAlertDataForTemplate,
   setActions,
   setActionParamsProperty,
   setActionFrequencyProperty,
@@ -437,6 +439,7 @@ export const ActionForm = ({
               actionConnector={actionConnector}
               index={index}
               key={`action-form-action-at-${actionItem.uuid}`}
+              setActionUseAlertDataForTemplate={setActionUseAlertDataForTemplate}
               setActionParamsProperty={setActionParamsProperty}
               setActionFrequencyProperty={setActionFrequencyProperty}
               setActionAlertsFilterProperty={setActionAlertsFilterProperty}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
index cc0594b365b9ef..8b774325af985b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.test.tsx
@@ -64,6 +64,19 @@ jest.mock('@kbn/kibana-react-plugin/public/ui_settings/use_ui_setting', () => ({
   useUiSetting: jest.fn().mockImplementation((_, defaultValue) => defaultValue),
 }));
 
+jest.mock('../../../common/get_experimental_features', () => ({
+  getIsExperimentalFeatureEnabled() {
+    return true;
+  },
+}));
+
+jest.mock('../../hooks/use_rule_aad_template_fields', () => ({
+  useRuleTypeAadTemplateFields: () => ({
+    isLoading: false,
+    fields: [],
+  }),
+}));
+
 describe('action_type_form', () => {
   afterEach(() => {
     jest.clearAllMocks();
@@ -402,6 +415,59 @@ describe('action_type_form', () => {
     ]);
   });
 
+  it('clears the default message when the user toggles the "Use template fields from alerts index" switch ', async () => {
+    const setActionParamsProperty = jest.fn();
+    const actionType = actionTypeRegistryMock.createMockActionTypeModel({
+      id: '.pagerduty',
+      iconClass: 'test',
+      selectMessage: 'test',
+      validateParams: (): Promise<GenericValidationResult<unknown>> => {
+        const validationResult = { errors: {} };
+        return Promise.resolve(validationResult);
+      },
+      actionConnectorFields: null,
+      actionParamsFields: mockedActionParamsFields,
+      defaultActionParams: {
+        dedupKey: '{{rule.id}}:{{alert.id}}',
+        eventAction: 'resolve',
+      },
+    });
+    actionTypeRegistry.get.mockReturnValue(actionType);
+
+    const wrapper = render(
+      <IntlProvider locale="en">
+        {getActionTypeForm({
+          index: 1,
+          ruleTypeId: 'test',
+          setActionParamsProperty,
+          actionItem: {
+            id: '123',
+            actionTypeId: '.pagerduty',
+            group: 'recovered',
+            params: {
+              eventAction: 'recovered',
+              dedupKey: '232323',
+              summary: '2323',
+              source: 'source',
+              severity: '1',
+              timestamp: new Date().toISOString(),
+              component: 'test',
+              group: 'group',
+              class: 'test class',
+            },
+          },
+        })}
+      </IntlProvider>
+    );
+
+    expect(wrapper.getByTestId('mustacheAutocompleteSwitch')).toBeTruthy();
+
+    await act(async () => {
+      wrapper.getByTestId('mustacheAutocompleteSwitch').click();
+    });
+    expect(setActionParamsProperty).toHaveBeenCalledWith('dedupKey', '', 1);
+  });
+
   describe('Customize notify when options', () => {
     it('should not have "On status changes" notify when option for summary actions', async () => {
       const actionType = actionTypeRegistryMock.createMockActionTypeModel({
@@ -523,6 +589,7 @@ function getActionTypeForm({
   onAddConnector,
   onDeleteAction,
   onConnectorSelected,
+  setActionParamsProperty,
   setActionFrequencyProperty,
   setActionAlertsFilterProperty,
   hasAlertsMappings = true,
@@ -530,6 +597,7 @@ function getActionTypeForm({
   summaryMessageVariables = { context: [], state: [], params: [] },
   notifyWhenSelectOptions,
   defaultNotifyWhenValue,
+  ruleTypeId,
 }: {
   index?: number;
   actionConnector?: ActionConnector<Record<string, unknown>, Record<string, unknown>>;
@@ -541,12 +609,14 @@ function getActionTypeForm({
   onDeleteAction?: () => void;
   onConnectorSelected?: (id: string) => void;
   setActionFrequencyProperty?: () => void;
+  setActionParamsProperty?: () => void;
   setActionAlertsFilterProperty?: () => void;
   hasAlertsMappings?: boolean;
   messageVariables?: ActionVariables;
   summaryMessageVariables?: ActionVariables;
   notifyWhenSelectOptions?: NotifyWhenSelectOptions[];
   defaultNotifyWhenValue?: RuleNotifyWhenType;
+  ruleTypeId?: string;
 }) {
   const actionConnectorDefault = {
     actionTypeId: '.pagerduty',
@@ -628,7 +698,7 @@ function getActionTypeForm({
       onDeleteAction={onDeleteAction ?? jest.fn()}
       onConnectorSelected={onConnectorSelected ?? jest.fn()}
       defaultActionGroupId={defaultActionGroupId ?? 'default'}
-      setActionParamsProperty={jest.fn()}
+      setActionParamsProperty={setActionParamsProperty ?? jest.fn()}
       setActionFrequencyProperty={setActionFrequencyProperty ?? jest.fn()}
       setActionAlertsFilterProperty={setActionAlertsFilterProperty ?? jest.fn()}
       index={index ?? 1}
@@ -641,6 +711,7 @@ function getActionTypeForm({
       defaultNotifyWhenValue={defaultNotifyWhenValue}
       producerId="infrastructure"
       featureId="infrastructure"
+      ruleTypeId={ruleTypeId}
     />
   );
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
index 3f0982b1b24f34..83ad089c8e691e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
@@ -29,6 +29,7 @@ import {
   EuiSplitPanel,
   useEuiTheme,
   EuiCallOut,
+  EuiSwitch,
 } from '@elastic/eui';
 import { isEmpty, partition, some } from 'lodash';
 import {
@@ -42,6 +43,8 @@ import {
   getDurationUnitValue,
   parseDuration,
 } from '@kbn/alerting-plugin/common/parse_duration';
+import { SavedObjectAttribute } from '@kbn/core-saved-objects-api-server';
+import { getIsExperimentalFeatureEnabled } from '../../../common/get_experimental_features';
 import { betaBadgeProps } from './beta_badge_props';
 import {
   IErrorObject,
@@ -64,6 +67,7 @@ import { validateParamsForWarnings } from '../../lib/validate_params_for_warning
 import { ActionAlertsFilterTimeframe } from './action_alerts_filter_timeframe';
 import { ActionAlertsFilterQuery } from './action_alerts_filter_query';
 import { validateActionFilterQuery } from '../../lib/value_validators';
+import { useRuleTypeAadTemplateFields } from '../../hooks/use_rule_aad_template_fields';
 
 export type ActionTypeFormProps = {
   actionItem: RuleAction;
@@ -72,6 +76,7 @@ export type ActionTypeFormProps = {
   onAddConnector: () => void;
   onConnectorSelected: (id: string) => void;
   onDeleteAction: () => void;
+  setActionUseAlertDataForTemplate?: (enabled: boolean, index: number) => void;
   setActionParamsProperty: (key: string, value: RuleActionParam, index: number) => void;
   setActionFrequencyProperty: (key: string, value: RuleActionParam, index: number) => void;
   setActionAlertsFilterProperty: (
@@ -120,6 +125,7 @@ export const ActionTypeForm = ({
   onAddConnector,
   onConnectorSelected,
   onDeleteAction,
+  setActionUseAlertDataForTemplate,
   setActionParamsProperty,
   setActionFrequencyProperty,
   setActionAlertsFilterProperty,
@@ -148,7 +154,7 @@ export const ActionTypeForm = ({
 }: ActionTypeFormProps) => {
   const {
     application: { capabilities },
-    http: { basePath },
+    http,
   } = useKibana().services;
   const { euiTheme } = useEuiTheme();
   const [isOpen, setIsOpen] = useState(true);
@@ -178,6 +184,53 @@ export const ActionTypeForm = ({
 
   const isSummaryAction = actionItem.frequency?.summary;
 
+  const [useAadTemplateFields, setUseAadTemplateField] = useState(
+    actionItem?.useAlertDataForTemplate ?? false
+  );
+  const [storedActionParamsForAadToggle, setStoredActionParamsForAadToggle] = useState<
+    Record<string, SavedObjectAttribute>
+  >({});
+
+  const { fields: aadTemplateFields } = useRuleTypeAadTemplateFields(
+    http,
+    ruleTypeId,
+    useAadTemplateFields
+  );
+
+  const templateFields = useMemo(
+    () => (useAadTemplateFields ? aadTemplateFields : availableActionVariables),
+    [aadTemplateFields, availableActionVariables, useAadTemplateFields]
+  );
+
+  let showMustacheAutocompleteSwitch;
+  try {
+    showMustacheAutocompleteSwitch =
+      getIsExperimentalFeatureEnabled('showMustacheAutocompleteSwitch') && ruleTypeId;
+  } catch (e) {
+    showMustacheAutocompleteSwitch = false;
+  }
+
+  const handleUseAadTemplateFields = useCallback(() => {
+    setUseAadTemplateField((prevVal) => {
+      if (setActionUseAlertDataForTemplate) {
+        setActionUseAlertDataForTemplate(!prevVal, index);
+      }
+      return !prevVal;
+    });
+    const currentActionParams = { ...actionItem.params };
+    for (const key of Object.keys(currentActionParams)) {
+      setActionParamsProperty(key, storedActionParamsForAadToggle[key] ?? '', index);
+    }
+    setStoredActionParamsForAadToggle(currentActionParams);
+  }, [
+    setActionUseAlertDataForTemplate,
+    storedActionParamsForAadToggle,
+    setStoredActionParamsForAadToggle,
+    setActionParamsProperty,
+    actionItem.params,
+    index,
+  ]);
+
   const getDefaultParams = async () => {
     const connectorType = await actionTypeRegistry.get(actionItem.actionTypeId);
     let defaultParams;
@@ -227,9 +280,15 @@ export const ActionTypeForm = ({
       const defaultParams = await getDefaultParams();
       if (defaultParams) {
         for (const [key, paramValue] of Object.entries(defaultParams)) {
+          const defaultAADParams: typeof defaultParams = {};
           if (actionItem.params[key] === undefined || actionItem.params[key] === null) {
             setActionParamsProperty(key, paramValue, index);
+            // Add default param to AAD defaults only if it does not contain any template code
+            if (typeof paramValue !== 'string' || !paramValue.match(/{{.*?}}/g)) {
+              defaultAADParams[key] = paramValue;
+            }
           }
+          setStoredActionParamsForAadToggle(defaultAADParams);
         }
       }
     })();
@@ -240,9 +299,14 @@ export const ActionTypeForm = ({
     (async () => {
       const defaultParams = await getDefaultParams();
       if (defaultParams && actionGroup) {
+        const defaultAADParams: typeof defaultParams = {};
         for (const [key, paramValue] of Object.entries(defaultParams)) {
           setActionParamsProperty(key, paramValue, index);
+          if (!paramValue.match(/{{.*?}}/g)) {
+            defaultAADParams[key] = paramValue;
+          }
         }
+        setStoredActionParamsForAadToggle(defaultAADParams);
       }
     })();
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -273,6 +337,12 @@ export const ActionTypeForm = ({
     })();
   }, [actionItem, disableErrorMessages]);
 
+  useEffect(() => {
+    if (isEmpty(storedActionParamsForAadToggle) && actionItem.params.subAction) {
+      setStoredActionParamsForAadToggle(actionItem.params);
+    }
+  }, [actionItem.params, storedActionParamsForAadToggle]);
+
   const canSave = hasSaveActionsCapability(capabilities);
 
   const actionGroupDisplay = (
@@ -463,39 +533,54 @@ export const ActionTypeForm = ({
       <EuiSplitPanel.Inner color="plain">
         {ParamsFieldsComponent ? (
           <EuiErrorBoundary>
-            <Suspense fallback={null}>
-              <ParamsFieldsComponent
-                actionParams={actionItem.params as any}
-                index={index}
-                errors={actionParamsErrors.errors}
-                editAction={(key: string, value: RuleActionParam, i: number) => {
-                  setWarning(
-                    validateParamsForWarnings(
-                      value,
-                      basePath.publicBaseUrl,
-                      availableActionVariables
-                    )
-                  );
-                  setActionParamsProperty(key, value, i);
-                }}
-                messageVariables={availableActionVariables}
-                defaultMessage={
-                  // if action is a summary action, show the default summary message
-                  isSummaryAction
-                    ? defaultSummaryMessage
-                    : selectedActionGroup?.defaultActionMessage ?? defaultActionMessage
-                }
-                useDefaultMessage={useDefaultMessage}
-                actionConnector={actionConnector}
-                executionMode={ActionConnectorMode.ActionForm}
-              />
-              {warning ? (
-                <>
-                  <EuiSpacer size="s" />
-                  <EuiCallOut size="s" color="warning" title={warning} />
-                </>
-              ) : null}
-            </Suspense>
+            <EuiFlexGroup gutterSize="m" direction="column">
+              {showMustacheAutocompleteSwitch && (
+                <EuiFlexItem>
+                  <EuiSwitch
+                    label="Use template fields from alerts index"
+                    checked={useAadTemplateFields}
+                    onChange={handleUseAadTemplateFields}
+                    data-test-subj="mustacheAutocompleteSwitch"
+                  />
+                </EuiFlexItem>
+              )}
+              <EuiFlexItem>
+                <Suspense fallback={null}>
+                  <ParamsFieldsComponent
+                    actionParams={actionItem.params as any}
+                    errors={actionParamsErrors.errors}
+                    index={index}
+                    editAction={(key: string, value: RuleActionParam, i: number) => {
+                      setWarning(
+                        validateParamsForWarnings(
+                          value,
+                          http.basePath.publicBaseUrl,
+                          availableActionVariables
+                        )
+                      );
+                      setActionParamsProperty(key, value, i);
+                    }}
+                    messageVariables={templateFields}
+                    defaultMessage={
+                      // if action is a summary action, show the default summary message
+                      isSummaryAction
+                        ? defaultSummaryMessage
+                        : selectedActionGroup?.defaultActionMessage ?? defaultActionMessage
+                    }
+                    useDefaultMessage={useDefaultMessage}
+                    actionConnector={actionConnector}
+                    executionMode={ActionConnectorMode.ActionForm}
+                    ruleTypeId={ruleTypeId}
+                  />
+                  {warning ? (
+                    <>
+                      <EuiSpacer size="s" />
+                      <EuiCallOut size="s" color="warning" title={warning} />
+                    </>
+                  ) : null}
+                </Suspense>
+              </EuiFlexItem>
+            </EuiFlexGroup>
           </EuiErrorBoundary>
         ) : null}
       </EuiSplitPanel.Inner>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
index 56bb1ed8e844ea..5b2a15b57d3b88 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
@@ -707,5 +707,19 @@ describe('AlertsTable', () => {
         expect(await screen.findByTestId('cases-components-tooltip')).toBeInTheDocument();
       });
     });
+
+    describe('dynamic row height mode', () => {
+      it('should render a non-virtualized grid body when the dynamicRowHeight option is on', async () => {
+        const { container } = render(<AlertsTableWithProviders {...tableProps} dynamicRowHeight />);
+
+        expect(container.querySelector('.euiDataGrid__customRenderBody')).toBeTruthy();
+      });
+
+      it('should render a virtualized grid body when the dynamicRowHeight option is off', async () => {
+        const { container } = render(<AlertsTableWithProviders {...tableProps} />);
+
+        expect(container.querySelector('.euiDataGrid__virtualized')).toBeTruthy();
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
index 3ba0f17e6188e4..2c98853b3c4e62 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
@@ -6,7 +6,16 @@
  */
 
 import { ALERT_UUID } from '@kbn/rule-data-utils';
-import React, { useState, Suspense, lazy, useCallback, useMemo, useEffect, useRef } from 'react';
+import React, {
+  useState,
+  Suspense,
+  lazy,
+  useCallback,
+  useMemo,
+  useEffect,
+  useRef,
+  memo,
+} from 'react';
 import {
   EuiDataGrid,
   EuiDataGridCellValueElementProps,
@@ -14,8 +23,11 @@ import {
   EuiSkeletonText,
   EuiDataGridRefProps,
   EuiFlexGroup,
+  EuiDataGridProps,
 } from '@elastic/eui';
 import { useQueryClient } from '@tanstack/react-query';
+import styled from '@emotion/styled';
+import { RuleRegistrySearchRequestPagination } from '@kbn/rule-registry-plugin/common';
 import { useSorting, usePagination, useBulkActions, useActionsColumn } from './hooks';
 import { AlertsTableProps, FetchAlertData } from '../../../types';
 import { ALERTS_TABLE_CONTROL_COLUMNS_ACTIONS_LABEL } from './translations';
@@ -59,6 +71,62 @@ const isSystemCell = (columnId: string): columnId is SystemCellId => {
   return systemCells.includes(columnId as SystemCellId);
 };
 
+const Row = styled.div`
+  display: flex;
+  min-width: fit-content;
+`;
+
+type CustomGridBodyProps = Pick<
+  Parameters<Exclude<EuiDataGridProps['renderCustomGridBody'], undefined>>['0'],
+  'Cell' | 'visibleColumns'
+> & {
+  alertsData: FetchAlertData['oldAlertsData'];
+  isLoading: boolean;
+  pagination: RuleRegistrySearchRequestPagination;
+  actualGridStyle: EuiDataGridStyle;
+  stripes?: boolean;
+};
+
+const CustomGridBody = memo(
+  ({
+    alertsData,
+    isLoading,
+    pagination,
+    actualGridStyle,
+    visibleColumns,
+    Cell,
+    stripes,
+  }: CustomGridBodyProps) => {
+    return (
+      <>
+        {alertsData
+          .concat(isLoading ? Array.from({ length: pagination.pageSize - alertsData.length }) : [])
+          .map((_row, rowIndex) => (
+            <Row
+              role="row"
+              key={`${rowIndex},${pagination.pageIndex}`}
+              // manually add stripes if props.gridStyle.stripes is true because presence of rowClasses
+              // overrides the props.gridStyle.stripes option. And rowClasses will always be there.
+              // Adding stripes only on even rows. It will be replaced by alertsTableHighlightedRow if
+              // shouldHighlightRow is correct
+              className={`euiDataGridRow ${
+                stripes && rowIndex % 2 !== 0 ? 'euiDataGridRow--striped' : ''
+              } ${actualGridStyle.rowClasses?.[rowIndex] ?? ''}`}
+            >
+              {visibleColumns.map((_col, colIndex) => (
+                <Cell
+                  colIndex={colIndex}
+                  visibleRowIndex={rowIndex}
+                  key={`${rowIndex},${colIndex}`}
+                />
+              ))}
+            </Row>
+          ))}
+      </>
+    );
+  }
+);
+
 const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTableProps) => {
   const dataGridRef = useRef<EuiDataGridRefProps>(null);
   const [activeRowClasses, setActiveRowClasses] = useState<
@@ -78,6 +146,7 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
     refresh: alertsRefresh,
     getInspectQuery,
   } = alertsData;
+
   const queryClient = useQueryClient();
   const { data: cases, isLoading: isLoadingCases } = props.cases;
   const { data: maintenanceWindows, isLoading: isLoadingMaintenanceWindows } =
@@ -284,14 +353,6 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
     if (shouldHighlightRowCheck) {
       mappedRowClasses = alerts.reduce<NonNullable<EuiDataGridStyle['rowClasses']>>(
         (rowClasses, alert, index) => {
-          if (props.gridStyle?.stripes && index % 2 !== 0) {
-            // manually add stripes if props.gridStyle.stripes is true because presence of rowClasses
-            // overrides the props.gridStyle.stripes option. And rowClasses will always be there.
-            // Adding strips only on even rows. It will be replace by alertsTableHighlightedRow if
-            // shouldHighlightRow is correct
-            rowClasses[index + pagination.pageIndex * pagination.pageSize] =
-              'euiDataGridRow--striped';
-          }
           if (shouldHighlightRowCheck(alert)) {
             rowClasses[index + pagination.pageIndex * pagination.pageSize] =
               'alertsTableHighlightedRow';
@@ -303,13 +364,7 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
       );
     }
     return mappedRowClasses;
-  }, [
-    props.shouldHighlightRow,
-    alerts,
-    pagination.pageIndex,
-    pagination.pageSize,
-    props.gridStyle,
-  ]);
+  }, [props.shouldHighlightRow, alerts, pagination.pageIndex, pagination.pageSize]);
 
   const handleFlyoutClose = useCallback(() => setFlyoutAlertIndex(-1), [setFlyoutAlertIndex]);
 
@@ -335,7 +390,6 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
         Object.entries(alert ?? {}).forEach(([key, value]) => {
           data.push({ field: key, value: value as string[] });
         });
-
         if (isSystemCell(_props.columnId)) {
           return (
             <SystemCellFactory
@@ -361,12 +415,12 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
     },
     [
       alerts,
-      ecsAlertsData,
       cases,
-      maintenanceWindows,
+      ecsAlertsData,
       isLoading,
       isLoadingCases,
       isLoadingMaintenanceWindows,
+      maintenanceWindows,
       pagination.pageIndex,
       pagination.pageSize,
       renderCellValue,
@@ -374,6 +428,16 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
     ]
   );
 
+  const dataGridPagination = useMemo(
+    () => ({
+      ...pagination,
+      pageSizeOptions: props.pageSizeOptions,
+      onChangeItemsPerPage: onChangePageSize,
+      onChangePage: onChangePageIndex,
+    }),
+    [onChangePageIndex, onChangePageSize, pagination, props.pageSizeOptions]
+  );
+
   const { getCellActions, visibleCellActions, disabledCellActions } = props.alertsTableConfiguration
     ?.useCellActions
     ? props.alertsTableConfiguration?.useCellActions({
@@ -441,6 +505,23 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
     return mergedGridStyle;
   }, [activeRowClasses, highlightedRowClasses, props.gridStyle]);
 
+  const renderCustomGridBody = useCallback<
+    Exclude<EuiDataGridProps['renderCustomGridBody'], undefined>
+  >(
+    ({ visibleColumns: _visibleColumns, Cell }) => (
+      <CustomGridBody
+        visibleColumns={_visibleColumns}
+        Cell={Cell}
+        actualGridStyle={actualGridStyle}
+        alertsData={oldAlertsData}
+        pagination={pagination}
+        isLoading={isLoading}
+        stripes={props.gridStyle?.stripes}
+      />
+    ),
+    [actualGridStyle, oldAlertsData, pagination, isLoading, props.gridStyle?.stripes]
+  );
+
   return (
     <InspectButtonContainer>
       <section style={{ width: '100%' }} data-test-subj={props['data-test-subj']}>
@@ -471,15 +552,11 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
             gridStyle={actualGridStyle}
             sorting={{ columns: sortingColumns, onSort }}
             toolbarVisibility={toolbarVisibility}
-            pagination={{
-              ...pagination,
-              pageSizeOptions: props.pageSizeOptions,
-              onChangeItemsPerPage: onChangePageSize,
-              onChangePage: onChangePageIndex,
-            }}
+            pagination={dataGridPagination}
             rowHeightsOptions={props.rowHeightsOptions}
             onColumnResize={onColumnResize}
             ref={dataGridRef}
+            renderCustomGridBody={props.dynamicRowHeight ? renderCustomGridBody : undefined}
           />
         )}
       </section>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx
index b74c8efe45f8cb..bc47845fb9d9e5 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table_state.tsx
@@ -74,6 +74,10 @@ export type AlertsTableStateProps = {
    * Allows to consumers of the table to decide to highlight a row based on the current alert.
    */
   shouldHighlightRow?: (alert: Alert) => boolean;
+  /**
+   * Enable when rows may have variable heights (disables virtualization)
+   */
+  dynamicRowHeight?: boolean;
 } & Partial<EuiDataGridProps>;
 
 export interface AlertsTableStorage {
@@ -158,6 +162,7 @@ const AlertsTableStateWithQueryProvider = ({
   showAlertStatusWithFlapping,
   toolbarVisibility,
   shouldHighlightRow,
+  dynamicRowHeight,
 }: AlertsTableStateProps) => {
   const { cases: casesService } = useKibana<{ cases?: CasesService }>().services;
 
@@ -404,6 +409,7 @@ const AlertsTableStateWithQueryProvider = ({
       showInspectButton,
       toolbarVisibility,
       shouldHighlightRow,
+      dynamicRowHeight,
       featureIds,
     }),
     [
@@ -431,6 +437,7 @@ const AlertsTableStateWithQueryProvider = ({
       showInspectButton,
       toolbarVisibility,
       shouldHighlightRow,
+      dynamicRowHeight,
       featureIds,
     ]
   );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_actions_column.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_actions_column.ts
index 679fe79b0b0365..33184e738a1858 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_actions_column.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_actions_column.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { useContext } from 'react';
+import { useCallback, useContext } from 'react';
 import { UseActionsColumnRegistry, BulkActionsVerbs } from '../../../../types';
 import { BulkActionsContext } from '../bulk_actions/context';
 
@@ -30,15 +30,17 @@ export const useActionsColumn = ({ options }: UseActionsColumnProps) => {
 
   // we save the rowIndex when creating the function to be used by the clients
   // so they don't have to manage it
-  const getSetIsActionLoadingCallback =
+  const getSetIsActionLoadingCallback = useCallback(
     (rowIndex: number) =>
-    (isLoading: boolean = true) => {
-      updateBulkActionsState({
-        action: BulkActionsVerbs.updateRowLoadingState,
-        rowIndex,
-        isLoading,
-      });
-    };
+      (isLoading: boolean = true) => {
+        updateBulkActionsState({
+          action: BulkActionsVerbs.updateRowLoadingState,
+          rowIndex,
+          isLoading,
+        });
+      },
+    [updateBulkActionsState]
+  );
 
   return {
     renderCustomActionsRow,
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts
index 90a1962d0d1f62..dfe5bbde8d98ea 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_bulk_actions.ts
@@ -242,9 +242,9 @@ export function useBulkActions({
   const [bulkActionsState, updateBulkActionsState] = useContext(BulkActionsContext);
   const configBulkActionPanels = useBulkActionsConfig(query);
 
-  const clearSelection = () => {
+  const clearSelection = useCallback(() => {
     updateBulkActionsState({ action: BulkActionsVerbs.clear });
-  };
+  }, [updateBulkActionsState]);
   const setIsBulkActionsLoading = (isLoading: boolean = true) => {
     updateBulkActionsState({ action: BulkActionsVerbs.updateAllLoadingState, isLoading });
   };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.tsx
index c88e3beba0cadc..c321ba5a01d7af 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_form/rule_form.tsx
@@ -839,6 +839,9 @@ export const RuleForm = ({
                 : { ...actionGroup, defaultActionMessage: ruleTypeModel?.defaultActionMessage }
             )}
             recoveryActionGroup={recoveryActionGroup}
+            setActionUseAlertDataForTemplate={(enabled: boolean, index: number) => {
+              setActionProperty('useAlertDataForTemplate', enabled, index);
+            }}
             setActionIdByIndex={(id: string, index: number) => setActionProperty('id', id, index)}
             setActionGroupIdByIndex={(group: string, index: number) =>
               setActionProperty('group', group, index)
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx
index 9988fd94eee59e..7e8eb5d6feee02 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx
@@ -115,6 +115,23 @@ describe('threshold expression', () => {
     expect(onChangeSelectedThresholdComparator).toHaveBeenCalled();
   });
 
+  it('renders threshold unit correctly', async () => {
+    const wrapper = mountWithIntl(
+      <ThresholdExpression
+        thresholdComparator={'>'}
+        threshold={[10]}
+        errors={{ threshold0: [], threshold1: [] }}
+        onChangeSelectedThreshold={jest.fn()}
+        onChangeSelectedThresholdComparator={jest.fn()}
+        unit="%"
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="thresholdPopover"]').last().text()).toMatchInlineSnapshot(
+      `"Is above 10%"`
+    );
+  });
+
   it('renders the correct number of threshold inputs', async () => {
     const wrapper = mountWithIntl(
       <ThresholdExpression
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
index 9f43a652cb2d40..fdbd0f6bc70220 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
@@ -46,6 +46,7 @@ export interface ThresholdExpressionProps {
     | 'rightUp'
     | 'rightDown';
   display?: 'fullWidth' | 'inline';
+  unit?: string;
 }
 
 export const ThresholdExpression = ({
@@ -57,6 +58,7 @@ export const ThresholdExpression = ({
   display = 'inline',
   threshold = [],
   popupPosition,
+  unit = '',
 }: ThresholdExpressionProps) => {
   const comparators = customComparators ?? builtInComparators;
   const [alertThresholdPopoverOpen, setAlertThresholdPopoverOpen] = useState(false);
@@ -88,7 +90,9 @@ export const ThresholdExpression = ({
         <EuiExpression
           data-test-subj="thresholdPopover"
           description={comparators[comparator].text}
-          value={(threshold || []).slice(0, numRequiredThresholds).join(` ${andThresholdText} `)}
+          value={
+            (threshold || []).slice(0, numRequiredThresholds).join(` ${andThresholdText} `) + unit
+          }
           isActive={Boolean(
             alertThresholdPopoverOpen ||
               (errors.threshold0 && errors.threshold0.length) ||
diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
index 9c9f08bc77b980..bc0ce10d461e6b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -217,6 +217,7 @@ export interface ActionParamsProps<TParams> {
   index: number;
   editAction: (key: string, value: RuleActionParam, index: number) => void;
   errors: IErrorObject;
+  ruleTypeId?: string;
   messageVariables?: ActionVariable[];
   defaultMessage?: string;
   useDefaultMessage?: boolean;
@@ -566,6 +567,10 @@ export type AlertsTableProps = {
    * Allows to consumers of the table to decide to highlight a row based on the current alert.
    */
   shouldHighlightRow?: (alert: Alert) => boolean;
+  /**
+   * Enable when rows may have variable heights (disables virtualization)
+   */
+  dynamicRowHeight?: boolean;
   featureIds?: ValidFeatureId[];
 } & Partial<Pick<EuiDataGridProps, 'gridStyle' | 'rowHeightsOptions'>>;
 
diff --git a/x-pack/plugins/triggers_actions_ui/server/index.ts b/x-pack/plugins/triggers_actions_ui/server/index.ts
index 2fb306e19402b8..4dfe9a569a4bd0 100644
--- a/x-pack/plugins/triggers_actions_ui/server/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/index.ts
@@ -6,7 +6,6 @@
  */
 import { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import { configSchema, ConfigSchema } from './config';
-import { TriggersActionsPlugin } from './plugin';
 
 export type { PluginStartContract } from './plugin';
 export type { TimeSeriesQuery, CoreQueryParams } from './data';
@@ -29,4 +28,7 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
 };
 
-export const plugin = (ctx: PluginInitializerContext) => new TriggersActionsPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { TriggersActionsPlugin } = await import('./plugin');
+  return new TriggersActionsPlugin(ctx);
+};
diff --git a/x-pack/plugins/triggers_actions_ui/tsconfig.json b/x-pack/plugins/triggers_actions_ui/tsconfig.json
index d2d91cca3486bf..600c5b6cdc7d53 100644
--- a/x-pack/plugins/triggers_actions_ui/tsconfig.json
+++ b/x-pack/plugins/triggers_actions_ui/tsconfig.json
@@ -55,7 +55,8 @@
     "@kbn/dashboard-plugin",
     "@kbn/licensing-plugin",
     "@kbn/expressions-plugin",
-    "@kbn/serverless",
+    "@kbn/core-saved-objects-api-server",
+    "@kbn/serverless"
   ],
   "exclude": ["target/**/*"]
 }
diff --git a/x-pack/plugins/upgrade_assistant/public/application/app.tsx b/x-pack/plugins/upgrade_assistant/public/application/app.tsx
index 90de3755c0d766..d1259df67e7299 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/app.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/app.tsx
@@ -163,18 +163,24 @@ export const RootComponent = (dependencies: AppDependencies) => {
   executionContext.set({ type: 'application', page: 'upgradeAssistant' });
 
   return (
-    <RedirectAppLinks application={application} className={APP_WRAPPER_CLASS}>
-      <AuthorizationProvider httpClient={http} privilegesEndpoint={`${API_BASE_PATH}/privileges`}>
-        <i18n.Context>
-          <KibanaThemeProvider theme$={dependencies.theme$}>
-            <AppContextProvider value={dependencies}>
-              <GlobalFlyoutProvider>
-                <App history={history} />
-              </GlobalFlyoutProvider>
-            </AppContextProvider>
-          </KibanaThemeProvider>
-        </i18n.Context>
-      </AuthorizationProvider>
-    </RedirectAppLinks>
+    <div className={APP_WRAPPER_CLASS}>
+      <RedirectAppLinks
+        coreStart={{
+          application,
+        }}
+      >
+        <AuthorizationProvider httpClient={http} privilegesEndpoint={`${API_BASE_PATH}/privileges`}>
+          <i18n.Context>
+            <KibanaThemeProvider theme$={dependencies.theme$}>
+              <AppContextProvider value={dependencies}>
+                <GlobalFlyoutProvider>
+                  <App history={history} />
+                </GlobalFlyoutProvider>
+              </AppContextProvider>
+            </KibanaThemeProvider>
+          </i18n.Context>
+        </AuthorizationProvider>
+      </RedirectAppLinks>
+    </div>
   );
 };
diff --git a/x-pack/plugins/upgrade_assistant/public/shared_imports.ts b/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
index cbed7f52584118..db3a4472c404d4 100644
--- a/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
+++ b/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
@@ -30,10 +30,11 @@ export { Storage } from '@kbn/kibana-utils-plugin/public';
 export {
   KibanaContextProvider,
   reactRouterNavigate,
-  RedirectAppLinks,
   KibanaThemeProvider,
 } from '@kbn/kibana-react-plugin/public';
 
+export { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+
 export type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 
 export { APP_WRAPPER_CLASS } from '@kbn/core/public';
diff --git a/x-pack/plugins/upgrade_assistant/server/index.ts b/x-pack/plugins/upgrade_assistant/server/index.ts
index 976e7f58bffc7e..589e2ced114cef 100644
--- a/x-pack/plugins/upgrade_assistant/server/index.ts
+++ b/x-pack/plugins/upgrade_assistant/server/index.ts
@@ -6,10 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { UpgradeAssistantServerPlugin } from './plugin';
 
 export { config } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => {
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { UpgradeAssistantServerPlugin } = await import('./plugin');
   return new UpgradeAssistantServerPlugin(ctx);
 };
diff --git a/x-pack/plugins/upgrade_assistant/tsconfig.json b/x-pack/plugins/upgrade_assistant/tsconfig.json
index 59d562c03c87d3..f905d49f380cdb 100644
--- a/x-pack/plugins/upgrade_assistant/tsconfig.json
+++ b/x-pack/plugins/upgrade_assistant/tsconfig.json
@@ -37,6 +37,7 @@
     "@kbn/utility-types",
     "@kbn/shared-ux-router",
     "@kbn/logs-shared-plugin",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx b/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx
index fb45099888592c..574e9ee9858120 100644
--- a/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx
+++ b/x-pack/plugins/uptime/public/legacy_uptime/app/uptime_app.tsx
@@ -11,11 +11,8 @@ import { EuiErrorBoundary } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { I18nStart, ChromeBreadcrumb, CoreStart, AppMountParameters } from '@kbn/core/public';
 import { APP_WRAPPER_CLASS } from '@kbn/core/public';
-import {
-  KibanaContextProvider,
-  KibanaThemeProvider,
-  RedirectAppLinks,
-} from '@kbn/kibana-react-plugin/public';
+import { KibanaContextProvider, KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import { EuiThemeProvider } from '@kbn/kibana-react-plugin/common';
 import { InspectorContextProvider } from '@kbn/observability-shared-plugin/public';
 import { ObservabilityAIAssistantProvider } from '@kbn/observability-ai-assistant-plugin/public';
@@ -140,8 +137,9 @@ const Application = (props: UptimeAppProps) => {
                             <UptimeDataViewContextProvider dataViews={startPlugins.dataViews}>
                               <div className={APP_WRAPPER_CLASS} data-test-subj="uptimeApp">
                                 <RedirectAppLinks
-                                  className={APP_WRAPPER_CLASS}
-                                  application={core.application}
+                                  coreStart={{
+                                    application: core.application,
+                                  }}
                                 >
                                   <InspectorContextProvider>
                                     <UptimeAlertsFlyoutWrapper />
diff --git a/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx b/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx
index 9bcfebd07ed870..65bc0294fa03b7 100644
--- a/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx
+++ b/x-pack/plugins/uptime/public/legacy_uptime/lib/alert_types/alert_messages.tsx
@@ -11,7 +11,8 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import React from 'react';
 import type { CoreTheme } from '@kbn/core/public';
 import { EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
-import { RedirectAppLinks, toMountPoint } from '@kbn/kibana-react-plugin/public';
+import { toMountPoint } from '@kbn/kibana-react-plugin/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import type { Rule } from '@kbn/triggers-actions-ui-plugin/public';
 import { ActionConnector } from '../../../../common/rules/types';
 import { kibanaService } from '../../state/kibana_service';
@@ -29,7 +30,11 @@ export const simpleAlertEnabled = (
       defaultMessage: 'Rule successfully enabled ',
     }),
     text: toMountPoint(
-      <RedirectAppLinks application={kibanaService.core.application}>
+      <RedirectAppLinks
+        coreStart={{
+          application: kibanaService.core.application,
+        }}
+      >
         <EuiText>
           <FormattedMessage
             id="xpack.uptime.overview.alerts.enabled.success.description"
diff --git a/x-pack/plugins/uptime/server/index.ts b/x-pack/plugins/uptime/server/index.ts
index 3ed326d1fc143f..f1434bbd822dc3 100644
--- a/x-pack/plugins/uptime/server/index.ts
+++ b/x-pack/plugins/uptime/server/index.ts
@@ -6,9 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { Plugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new Plugin(initializerContext);
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { Plugin } = await import('./plugin');
+  return new Plugin(initializerContext);
+};
 
 export { config } from '../common/config';
diff --git a/x-pack/plugins/uptime/tsconfig.json b/x-pack/plugins/uptime/tsconfig.json
index dc93878a42464b..9013c984de263c 100644
--- a/x-pack/plugins/uptime/tsconfig.json
+++ b/x-pack/plugins/uptime/tsconfig.json
@@ -72,6 +72,7 @@
     "@kbn/actions-plugin",
     "@kbn/core-saved-objects-server",
     "@kbn/observability-ai-assistant-plugin",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/ux/public/application/ux_app.tsx b/x-pack/plugins/ux/public/application/ux_app.tsx
index aa1ae124d02796..b7ca736c6b5afb 100644
--- a/x-pack/plugins/ux/public/application/ux_app.tsx
+++ b/x-pack/plugins/ux/public/application/ux_app.tsx
@@ -23,10 +23,11 @@ import {
 import {
   KibanaContextProvider,
   KibanaThemeProvider,
-  RedirectAppLinks,
   useUiSetting$,
 } from '@kbn/kibana-react-plugin/public';
 
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+
 import { DatePickerContextProvider } from '@kbn/observability-plugin/public';
 import {
   InspectorContextProvider,
@@ -131,62 +132,67 @@ export function UXAppRoot({
   createCallApmApi(core);
 
   return (
-    <RedirectAppLinks
-      className={APP_WRAPPER_CLASS}
-      application={core.application}
-    >
-      <KibanaContextProvider
-        services={{
-          ...core,
-          ...plugins,
-          inspector,
-          observability,
-          observabilityShared,
-          embeddable,
-          exploratoryView,
-          data,
-          dataViews,
-          lens,
+    <div className={APP_WRAPPER_CLASS}>
+      <RedirectAppLinks
+        coreStart={{
+          application: core.application,
         }}
       >
-        <ObservabilityAIAssistantProvider value={observabilityAIAssistant}>
-          <KibanaThemeProvider
-            theme$={appMountParameters.theme$}
-            modify={{
-              breakpoint: {
-                xxl: 1600,
-                xxxl: 2000,
-              },
-            }}
-          >
-            <PluginContext.Provider
-              value={{
-                appMountParameters,
-                exploratoryView,
-                observabilityShared,
+        <KibanaContextProvider
+          services={{
+            ...core,
+            ...plugins,
+            inspector,
+            observability,
+            observabilityShared,
+            embeddable,
+            exploratoryView,
+            data,
+            dataViews,
+            lens,
+          }}
+        >
+          <ObservabilityAIAssistantProvider value={observabilityAIAssistant}>
+            <KibanaThemeProvider
+              theme$={appMountParameters.theme$}
+              modify={{
+                breakpoint: {
+                  xxl: 1600,
+                  xxxl: 2000,
+                },
               }}
             >
-              <i18nCore.Context>
-                <RouterProvider history={history} router={uxRouter}>
-                  <DatePickerContextProvider>
-                    <InspectorContextProvider>
-                      <UrlParamsProvider>
-                        <EuiErrorBoundary>
-                          <CsmSharedContextProvider>
-                            <UxApp />
-                          </CsmSharedContextProvider>
-                        </EuiErrorBoundary>
-                        <UXActionMenu appMountParameters={appMountParameters} />
-                      </UrlParamsProvider>
-                    </InspectorContextProvider>
-                  </DatePickerContextProvider>
-                </RouterProvider>
-              </i18nCore.Context>
-            </PluginContext.Provider>
-          </KibanaThemeProvider>
-        </ObservabilityAIAssistantProvider>
-      </KibanaContextProvider>
-    </RedirectAppLinks>
+              <PluginContext.Provider
+                value={{
+                  appMountParameters,
+                  exploratoryView,
+                  observabilityShared,
+                }}
+              >
+                <i18nCore.Context>
+                  <RouterProvider history={history} router={uxRouter}>
+                    <DatePickerContextProvider>
+                      <InspectorContextProvider>
+                        <UrlParamsProvider>
+                          <EuiErrorBoundary>
+                            <CsmSharedContextProvider>
+                              <UxApp />
+                            </CsmSharedContextProvider>
+                          </EuiErrorBoundary>
+                          <UXActionMenu
+                            appMountParameters={appMountParameters}
+                          />
+                        </UrlParamsProvider>
+                      </InspectorContextProvider>
+                    </DatePickerContextProvider>
+                  </RouterProvider>
+                </i18nCore.Context>
+              </PluginContext.Provider>
+            </KibanaThemeProvider>
+          </ObservabilityAIAssistantProvider>
+        </KibanaContextProvider>
+      </RedirectAppLinks>
+    </div>
   );
 }
 
diff --git a/x-pack/plugins/ux/server/index.ts b/x-pack/plugins/ux/server/index.ts
index e1027a9235eb36..911d24e465ed6f 100644
--- a/x-pack/plugins/ux/server/index.ts
+++ b/x-pack/plugins/ux/server/index.ts
@@ -6,9 +6,10 @@
  */
 
 import { PluginInitializerContext } from '@kbn/core/server';
-import { Plugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
-  new Plugin();
+export const plugin = async (initializerContext: PluginInitializerContext) => {
+  const { Plugin } = await import('./plugin');
+  return new Plugin();
+};
 
 export { config } from '../common/config';
diff --git a/x-pack/plugins/ux/tsconfig.json b/x-pack/plugins/ux/tsconfig.json
index 7865c124929b95..62fdcb115a0a3e 100644
--- a/x-pack/plugins/ux/tsconfig.json
+++ b/x-pack/plugins/ux/tsconfig.json
@@ -42,6 +42,7 @@
     "@kbn/shared-ux-router",
     "@kbn/observability-ai-assistant-plugin",
     "@kbn/config-schema",
+    "@kbn/shared-ux-link-redirect-app"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/watcher/server/index.ts b/x-pack/plugins/watcher/server/index.ts
index 42a76820f0c209..383316ce9a2ecf 100644
--- a/x-pack/plugins/watcher/server/index.ts
+++ b/x-pack/plugins/watcher/server/index.ts
@@ -8,9 +8,10 @@
 import { PluginInitializerContext } from '@kbn/core/server';
 import { offeringBasedSchema, schema } from '@kbn/config-schema';
 
-import { WatcherServerPlugin } from './plugin';
-
-export const plugin = (ctx: PluginInitializerContext) => new WatcherServerPlugin(ctx);
+export const plugin = async (ctx: PluginInitializerContext) => {
+  const { WatcherServerPlugin } = await import('./plugin');
+  return new WatcherServerPlugin(ctx);
+};
 
 export const config = {
   schema: schema.object({
diff --git a/x-pack/test/alerting_api_integration/common/plugins/aad/server/index.ts b/x-pack/test/alerting_api_integration/common/plugins/aad/server/index.ts
index 700aee6bfd49d6..ed9e6682e0098e 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/aad/server/index.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/aad/server/index.ts
@@ -7,4 +7,4 @@
 
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/index.ts b/x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/index.ts
index 700aee6bfd49d6..ed9e6682e0098e 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/index.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/index.ts
@@ -7,4 +7,4 @@
 
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/index.ts b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/index.ts
index 5a260b165f7926..ed2682aacbf14a 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/index.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/index.ts
@@ -8,4 +8,5 @@
 import { PluginInitializerContext } from '@kbn/core/server';
 import { FixturePlugin } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) => new FixturePlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) =>
+  new FixturePlugin(initContext);
diff --git a/x-pack/test/alerting_api_integration/common/plugins/alerts_restricted/server/index.ts b/x-pack/test/alerting_api_integration/common/plugins/alerts_restricted/server/index.ts
index 700aee6bfd49d6..ed9e6682e0098e 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/alerts_restricted/server/index.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/alerts_restricted/server/index.ts
@@ -7,4 +7,4 @@
 
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/alerting_api_integration/common/plugins/task_manager_fixture/server/index.ts b/x-pack/test/alerting_api_integration/common/plugins/task_manager_fixture/server/index.ts
index bed262d69ea183..9ef27eac563357 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/task_manager_fixture/server/index.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/task_manager_fixture/server/index.ts
@@ -7,4 +7,4 @@
 
 import { SampleTaskManagerFixturePlugin } from './plugin';
 
-export const plugin = () => new SampleTaskManagerFixturePlugin();
+export const plugin = async () => new SampleTaskManagerFixturePlugin();
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts
index 2af99f85887b05..b38b4b0ee672c0 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import moment from 'moment';
 import { cleanup, generate } from '@kbn/infra-forge';
 import {
@@ -91,7 +92,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.5],
                 timeSize: 5,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_no_data.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_no_data.ts
index e2ea6264a1233b..f02eb9568f68bd 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_no_data.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_no_data.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import moment from 'moment';
 import {
   Aggregators,
@@ -84,7 +85,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.5],
                 timeSize: 5,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_us_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_us_fired.ts
index 18a8fb4b4708cf..9929491ea4e0e6 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_us_fired.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_us_fired.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import moment from 'moment';
 import { ApmSynthtraceEsClient } from '@kbn/apm-synthtrace';
 import { format } from 'url';
@@ -97,7 +98,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [7500000],
                 timeSize: 5,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
index 7446b4b8b6ea3d..71f0a1bed860b7 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
@@ -11,6 +11,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import moment from 'moment';
 import { cleanup, generate } from '@kbn/infra-forge';
 import {
@@ -96,7 +97,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.9],
                 timeSize: 1,
@@ -194,7 +195,7 @@ export default function ({ getService }: FtrProviderContext) {
           .eql({
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.9],
                 timeSize: 1,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts
index fbebf8f95fed28..c2ca213bae98a0 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import moment from 'moment';
 import { cleanup, generate } from '@kbn/infra-forge';
 import {
@@ -91,7 +92,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [2],
                 timeSize: 1,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/group_by_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/group_by_fired.ts
index 20d25ecb4db96c..74144e8e7c7217 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/group_by_fired.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/group_by_fired.ts
@@ -7,6 +7,7 @@
 
 import moment from 'moment';
 import { cleanup, generate } from '@kbn/infra-forge';
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -90,7 +91,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT_OR_EQ,
                 threshold: [0.2],
                 timeSize: 1,
diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule_data_view.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule_data_view.ts
index ada064c133ffcb..0cbb1044f887e4 100644
--- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule_data_view.ts
+++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule_data_view.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -73,7 +74,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [7500000],
                 timeSize: 5,
diff --git a/x-pack/test/alerting_api_integration/observability/helpers/alerting_api_helper.ts b/x-pack/test/alerting_api_integration/observability/helpers/alerting_api_helper.ts
index 4bde235e97dd27..d56b91dda55151 100644
--- a/x-pack/test/alerting_api_integration/observability/helpers/alerting_api_helper.ts
+++ b/x-pack/test/alerting_api_integration/observability/helpers/alerting_api_helper.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { MetricThresholdParams } from '@kbn/infra-plugin/common/alerting/metrics';
 import { ThresholdParams } from '@kbn/observability-plugin/common/custom_threshold_rule/types';
 import type { SuperTest, Test } from 'supertest';
 
@@ -32,7 +31,7 @@ export async function createIndexConnector({
   return body.id as string;
 }
 
-export async function createRule({
+export async function createRule<Params = ThresholdParams>({
   supertest,
   name,
   ruleTypeId,
@@ -45,7 +44,7 @@ export async function createRule({
   supertest: SuperTest<Test>;
   ruleTypeId: string;
   name: string;
-  params: MetricThresholdParams | ThresholdParams;
+  params: Params;
   actions?: any[];
   tags?: any[];
   schedule?: { interval: string };
diff --git a/x-pack/test/alerting_api_integration/observability/metric_threshold_rule.ts b/x-pack/test/alerting_api_integration/observability/metric_threshold_rule.ts
index 0de7e3d6006126..181b34c3956c11 100644
--- a/x-pack/test/alerting_api_integration/observability/metric_threshold_rule.ts
+++ b/x-pack/test/alerting_api_integration/observability/metric_threshold_rule.ts
@@ -8,7 +8,12 @@
 import moment from 'moment';
 import expect from '@kbn/expect';
 import { cleanup, generate } from '@kbn/infra-forge';
-import { Aggregators, Comparator, InfraRuleType } from '@kbn/infra-plugin/common/alerting/metrics';
+import {
+  Aggregators,
+  Comparator,
+  InfraRuleType,
+  MetricThresholdParams,
+} from '@kbn/infra-plugin/common/alerting/metrics';
 import {
   waitForDocumentInIndex,
   waitForAlertInIndex,
@@ -48,7 +53,7 @@ export default function ({ getService }: FtrProviderContext) {
           name: 'Index Connector: Metric threshold API test',
           indexName: ALERT_ACTION_INDEX,
         });
-        const createdRule = await createRule({
+        const createdRule = await createRule<MetricThresholdParams>({
           supertest,
           ruleTypeId: InfraRuleType.MetricThreshold,
           consumer: 'infrastructure',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts
index b7cf41d07e8236..375eeaaffc44a3 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/create.ts
@@ -102,6 +102,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                     group: 'default',
                     params: {},
                     uuid: response.body.actions[0].uuid,
+                    use_alert_data_for_template: false,
                   },
                 ],
                 enabled: true,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts
index c948791e5ea49d..ffd11e3fabd38b 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group3/tests/alerting/bulk_edit.ts
@@ -116,6 +116,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
                   params: {},
                   connector_type_id: 'test.noop',
                   uuid: response.body.rules[0].actions[0].uuid,
+                  use_alert_data_for_template: false,
                 },
               ]);
               expect(response.statusCode).to.eql(200);
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts
index eb9f90cb41f2a9..0577425103a8c3 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts
@@ -78,6 +78,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             group: 'default',
             params: {},
             uuid: response.body.actions[0].uuid,
+            use_alert_data_for_template: false,
           },
         ],
         enabled: true,
@@ -181,6 +182,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             group: 'default',
             params: {},
             uuid: response.body.actions[0].uuid,
+            use_alert_data_for_template: false,
           },
           {
             id: 'my-slack1',
@@ -190,6 +192,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
               message: 'something important happened!',
             },
             uuid: response.body.actions[1].uuid,
+            use_alert_data_for_template: false,
           },
           {
             id: 'system-connector-test.system-action',
@@ -197,6 +200,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             connector_type_id: 'test.system-action',
             params: {},
             uuid: response.body.actions[2].uuid,
+            use_alert_data_for_template: false,
           },
         ],
         enabled: true,
diff --git a/x-pack/test/api_integration/apis/aiops/log_rate_analysis_full_analysis.ts b/x-pack/test/api_integration/apis/aiops/log_rate_analysis_full_analysis.ts
index 4c3d7874028641..3168dfdfc5ecfa 100644
--- a/x-pack/test/api_integration/apis/aiops/log_rate_analysis_full_analysis.ts
+++ b/x-pack/test/api_integration/apis/aiops/log_rate_analysis_full_analysis.ts
@@ -70,8 +70,8 @@ export default ({ getService }: FtrProviderContext) => {
             );
 
             expect(significantItems).to.eql(
-              testData.expected.significantTerms,
-              'Significant terms do not match expected values.'
+              testData.expected.significantItems,
+              'Significant items do not match expected values.'
             );
 
             const histogramActions = getHistogramActions(data, apiVersion);
diff --git a/x-pack/test/api_integration/apis/aiops/log_rate_analysis_groups_only.ts b/x-pack/test/api_integration/apis/aiops/log_rate_analysis_groups_only.ts
index 3ffcf7b04fdd23..fcc4bafabdf3c6 100644
--- a/x-pack/test/api_integration/apis/aiops/log_rate_analysis_groups_only.ts
+++ b/x-pack/test/api_integration/apis/aiops/log_rate_analysis_groups_only.ts
@@ -41,7 +41,7 @@ export default ({ getService }: FtrProviderContext) => {
           overrides = {
             loaded: 0,
             remainingFieldCandidates: [],
-            significantTerms: testData.expected.significantTerms,
+            significantTerms: testData.expected.significantItems,
             regroupOnly: true,
           } as AiopsLogRateAnalysisSchema<typeof apiVersion>['overrides'];
         }
@@ -51,7 +51,7 @@ export default ({ getService }: FtrProviderContext) => {
             loaded: 0,
             remainingFieldCandidates: [],
             significantItems: testData.expected
-              .significantTerms as AiopsLogRateAnalysisSchemaSignificantItem[],
+              .significantItems as AiopsLogRateAnalysisSchemaSignificantItem[],
             regroupOnly: true,
           } as AiopsLogRateAnalysisSchema<typeof apiVersion>['overrides'];
         }
diff --git a/x-pack/test/api_integration/apis/aiops/test_data.ts b/x-pack/test/api_integration/apis/aiops/test_data.ts
index f323900e3437c7..291779ed6c7b24 100644
--- a/x-pack/test/api_integration/apis/aiops/test_data.ts
+++ b/x-pack/test/api_integration/apis/aiops/test_data.ts
@@ -10,8 +10,8 @@
 // that also the jest unit tests use mocks that are not outdated.
 import { significantTerms as artificialLogSignificantTerms } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/significant_terms';
 import { significantLogPatterns as artificialLogSignificantLogPatterns } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/significant_log_patterns';
-import { finalSignificantTermGroups as artificialLogsSignificantTermGroups } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/final_significant_term_groups';
-import { finalSignificantTermGroupsTextfield as artificialLogsSignificantTermGroupsTextfield } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/final_significant_term_groups_textfield';
+import { finalSignificantItemGroups as artificialLogsSignificantItemGroups } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/final_significant_item_groups';
+import { finalSignificantItemGroupsTextfield as artificialLogsSignificantItemGroupsTextfield } from '@kbn/aiops-plugin/common/__mocks__/artificial_logs/final_significant_item_groups_textfield';
 
 import type {
   AiopsLogRateAnalysisSchema,
@@ -45,7 +45,7 @@ export const getLogRateAnalysisTestData = <T extends ApiVersion>(): Array<TestDa
       actionsLengthGroupOnly: 4,
       noIndexChunksLength: 4,
       noIndexActionsLength: 3,
-      significantTerms: [
+      significantItems: [
         {
           key: 'day_of_week:Thursday',
           type: 'keyword',
@@ -99,8 +99,8 @@ export const getLogRateAnalysisTestData = <T extends ApiVersion>(): Array<TestDa
       actionsLengthGroupOnly: 10,
       noIndexChunksLength: 4,
       noIndexActionsLength: 3,
-      significantTerms: artificialLogSignificantTerms,
-      groups: artificialLogsSignificantTermGroups,
+      significantItems: artificialLogSignificantTerms,
+      groups: artificialLogsSignificantItemGroups,
       histogramLength: 20,
     },
   },
@@ -126,8 +126,8 @@ export const getLogRateAnalysisTestData = <T extends ApiVersion>(): Array<TestDa
       actionsLengthGroupOnly: 10,
       noIndexChunksLength: 4,
       noIndexActionsLength: 3,
-      significantTerms: [...artificialLogSignificantTerms, ...artificialLogSignificantLogPatterns],
-      groups: artificialLogsSignificantTermGroupsTextfield,
+      significantItems: [...artificialLogSignificantTerms, ...artificialLogSignificantLogPatterns],
+      groups: artificialLogsSignificantItemGroupsTextfield,
       histogramLength: 20,
     },
   },
@@ -153,8 +153,8 @@ export const getLogRateAnalysisTestData = <T extends ApiVersion>(): Array<TestDa
       actionsLengthGroupOnly: 10,
       noIndexChunksLength: 4,
       noIndexActionsLength: 3,
-      significantTerms: artificialLogSignificantTerms,
-      groups: artificialLogsSignificantTermGroups,
+      significantItems: artificialLogSignificantTerms,
+      groups: artificialLogsSignificantItemGroups,
       histogramLength: 20,
     },
   },
@@ -180,8 +180,8 @@ export const getLogRateAnalysisTestData = <T extends ApiVersion>(): Array<TestDa
       actionsLengthGroupOnly: 10,
       noIndexChunksLength: 4,
       noIndexActionsLength: 3,
-      significantTerms: [...artificialLogSignificantTerms, ...artificialLogSignificantLogPatterns],
-      groups: artificialLogsSignificantTermGroupsTextfield,
+      significantItems: [...artificialLogSignificantTerms, ...artificialLogSignificantLogPatterns],
+      groups: artificialLogsSignificantItemGroupsTextfield,
       histogramLength: 20,
     },
   },
diff --git a/x-pack/test/api_integration/apis/aiops/types.ts b/x-pack/test/api_integration/apis/aiops/types.ts
index a990b1a346c07a..df38825d9698d5 100644
--- a/x-pack/test/api_integration/apis/aiops/types.ts
+++ b/x-pack/test/api_integration/apis/aiops/types.ts
@@ -9,7 +9,7 @@ import type {
   AiopsLogRateAnalysisSchema,
   AiopsLogRateAnalysisApiVersion as ApiVersion,
 } from '@kbn/aiops-plugin/common/api/log_rate_analysis/schema';
-import type { SignificantTerm, SignificantTermGroup } from '@kbn/ml-agg-utils';
+import type { SignificantItem, SignificantItemGroup } from '@kbn/ml-agg-utils';
 
 import type { LogRateAnalysisDataGenerator } from '../../../functional/services/aiops/log_rate_analysis_data_generator';
 
@@ -25,8 +25,8 @@ export interface TestData<T extends ApiVersion> {
     actionsLengthGroupOnly: number;
     noIndexChunksLength: number;
     noIndexActionsLength: number;
-    significantTerms: SignificantTerm[];
-    groups: SignificantTermGroup[];
+    significantItems: SignificantItem[];
+    groups: SignificantItemGroup[];
     histogramLength: number;
   };
 }
diff --git a/x-pack/test/api_integration/apis/management/index_management/component_templates.ts b/x-pack/test/api_integration/apis/management/index_management/component_templates.ts
index 6e2b7ba71e86b1..01e7ae46ce8fe3 100644
--- a/x-pack/test/api_integration/apis/management/index_management/component_templates.ts
+++ b/x-pack/test/api_integration/apis/management/index_management/component_templates.ts
@@ -147,6 +147,10 @@ export default function ({ getService }: FtrProviderContext) {
                   },
                 },
               },
+              lifecycle: {
+                enabled: true,
+                data_retention: '2d',
+              },
             },
             _meta: {
               description: 'set number of shards to one',
diff --git a/x-pack/test/api_integration/apis/management/index_management/templates.js b/x-pack/test/api_integration/apis/management/index_management/templates.js
index 2c7ba54bb9c98b..bb4007852b0379 100644
--- a/x-pack/test/api_integration/apis/management/index_management/templates.js
+++ b/x-pack/test/api_integration/apis/management/index_management/templates.js
@@ -30,9 +30,26 @@ export default function ({ getService }) {
     after(() => Promise.all([cleanUpEsResources(), cleanUpTemplates()]));
 
     describe('get all', () => {
-      const templateName = `template-${getRandomString()}`;
-      const indexTemplate = getTemplatePayload(templateName, [getRandomString()]);
-      const legacyTemplate = getTemplatePayload(templateName, [getRandomString()], true);
+      const indexTemplate = getTemplatePayload(`template-${getRandomString()}`, [
+        getRandomString(),
+      ]);
+      const legacyTemplate = getTemplatePayload(
+        `template-${getRandomString()}`,
+        [getRandomString()],
+        true
+      );
+      const tmpTemplate = getTemplatePayload(`template-${getRandomString()}`, [getRandomString()]);
+      const indexTemplateWithLifecycle = {
+        ...tmpTemplate,
+        dataStream: {},
+        template: {
+          ...tmpTemplate.template,
+          lifecycle: {
+            enabled: true,
+            data_retention: '10d',
+          },
+        },
+      };
 
       beforeEach(async () => {
         const res1 = await createTemplate(indexTemplate);
@@ -44,6 +61,11 @@ export default function ({ getService }) {
         if (res2.status !== 200) {
           throw new Error(res2.body.message);
         }
+
+        const res3 = await createTemplate(indexTemplateWithLifecycle);
+        if (res3.status !== 200) {
+          throw new Error(res3.body.message);
+        }
       });
 
       it('should list all the index templates with the expected parameters', async () => {
@@ -107,6 +129,36 @@ export default function ({ getService }) {
         ].sort();
 
         expect(Object.keys(legacyTemplateFound).sort()).to.eql(expectedLegacyKeys);
+
+        // Index template with lifecycle
+        const templateWithLifecycle = allTemplates.templates.find(
+          (template) => template.name === indexTemplateWithLifecycle.name
+        );
+
+        if (!templateWithLifecycle) {
+          throw new Error(
+            `Index template with lifecycle "${
+              indexTemplateWithLifecycle.name
+            }" not found in ${JSON.stringify(allTemplates.templates, null, 2)}`
+          );
+        }
+
+        const expectedWithLifecycleKeys = [
+          'name',
+          'indexPatterns',
+          'lifecycle',
+          'hasSettings',
+          'hasAliases',
+          'hasMappings',
+          'ilmPolicy',
+          'priority',
+          'composedOf',
+          'dataStream',
+          'version',
+          '_kbnMeta',
+        ].sort();
+
+        expect(Object.keys(templateWithLifecycle).sort()).to.eql(expectedWithLifecycleKeys);
       });
     });
 
diff --git a/x-pack/test/api_integration/apis/metrics_ui/log_entry_highlights.ts b/x-pack/test/api_integration/apis/metrics_ui/log_entry_highlights.ts
index 1e565f63b0733d..9910f4724045a7 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/log_entry_highlights.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/log_entry_highlights.ts
@@ -19,6 +19,7 @@ import {
   logEntriesHighlightsResponseRT,
 } from '@kbn/logs-shared-plugin/common';
 
+import moment from 'moment';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 const KEY_BEFORE_START = {
@@ -112,8 +113,8 @@ export default function ({ getService }: FtrProviderContext) {
 
           // Entries fall within range
           // @kbn/expect doesn't have a `lessOrEqualThan` or `moreOrEqualThan` comparators
-          expect(firstEntry.cursor.time >= KEY_BEFORE_START.time).to.be(true);
-          expect(lastEntry.cursor.time <= KEY_AFTER_END.time).to.be(true);
+          expect(firstEntry.cursor.time >= moment(KEY_BEFORE_START.time).toISOString()).to.be(true);
+          expect(lastEntry.cursor.time <= moment(KEY_AFTER_END.time).toISOString()).to.be(true);
 
           // All entries contain the highlights
           entries.forEach((entry) => {
diff --git a/x-pack/test/api_integration/apis/search/search.ts b/x-pack/test/api_integration/apis/search/search.ts
index 391923601d7c59..15c774eef34ef9 100644
--- a/x-pack/test/api_integration/apis/search/search.ts
+++ b/x-pack/test/api_integration/apis/search/search.ts
@@ -186,6 +186,71 @@ export default function ({ getService }: FtrProviderContext) {
         expect(resp2.body.isRunning).to.be(true);
       });
 
+      it('should cancel an async search without server crash', async function () {
+        await markRequiresShardDelayAgg(this);
+
+        const resp = await supertest
+          .post(`/internal/search/ese`)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-xsrf', 'foo')
+          .send({
+            params: {
+              body: {
+                query: {
+                  match_all: {},
+                },
+                ...shardDelayAgg('10s'),
+              },
+              wait_for_completion_timeout: '1ms',
+            },
+          })
+          .expect(200);
+
+        const { id } = resp.body;
+        expect(id).not.to.be(undefined);
+        expect(resp.body.isPartial).to.be(true);
+        expect(resp.body.isRunning).to.be(true);
+
+        // Send a follow-up request that waits up to 10s for completion
+        const req = supertest
+          .post(`/internal/search/ese/${id}`)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-xsrf', 'foo')
+          .send({ params: { wait_for_completion_timeout: '10s' } })
+          .expect(200);
+
+        // After 2s, abort and send the cancellation (to result in a race towards cancellation)
+        // This should be swallowed and not kill the Kibana server
+        await new Promise((resolve) =>
+          setTimeout(() => {
+            req.abort();
+            resolve(null);
+          }, 2000)
+        );
+        await supertest
+          .delete(`/internal/search/ese/${id}`)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-xsrf', 'foo')
+          .expect(200);
+
+        let err: Error | undefined;
+        try {
+          await req;
+        } catch (e) {
+          err = e;
+        }
+
+        expect(err).not.to.be(undefined);
+
+        // Ensure the search was succesfully cancelled
+        await supertest
+          .post(`/internal/search/ese/${id}`)
+          .set(ELASTIC_HTTP_VERSION_HEADER, '1')
+          .set('kbn-xsrf', 'foo')
+          .send({})
+          .expect(404);
+      });
+
       it('should fail without kbn-xref header', async () => {
         const resp = await supertest
           .post(`/internal/search/ese`)
diff --git a/x-pack/test/api_integration/apis/transform/transforms_stats.ts b/x-pack/test/api_integration/apis/transform/transforms_stats.ts
index aea5c049343e91..2eec1f4e17b9af 100644
--- a/x-pack/test/api_integration/apis/transform/transforms_stats.ts
+++ b/x-pack/test/api_integration/apis/transform/transforms_stats.ts
@@ -8,7 +8,7 @@
 import expect from '@kbn/expect';
 
 import type { GetTransformsStatsResponseSchema } from '@kbn/transform-plugin/common/api_schemas/transforms_stats';
-import { TRANSFORM_STATE } from '@kbn/transform-plugin/common/constants';
+import { TRANSFORM_STATE, type TransformState } from '@kbn/transform-plugin/common/constants';
 
 import { getCommonRequestHeader } from '../../../functional/services/ml/common_api';
 import { USER } from '../../../functional/services/transform/security_common';
@@ -17,45 +17,63 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 import { generateTransformConfig } from './common';
 
+interface ExpectedTransformsStats {
+  id: string;
+  state: TransformState;
+}
+
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertestWithoutAuth');
   const transform = getService('transform');
 
-  const expected = {
-    apiTransformTransforms: {
-      count: 2,
-      transform1: { id: 'transform-test-stats-1', state: TRANSFORM_STATE.STOPPED },
-      transform2: { id: 'transform-test-stats-2', state: TRANSFORM_STATE.STOPPED },
-      typeOfStats: 'object',
-      typeOfCheckpointing: 'object',
-    },
-  };
+  async function superTestRequest(endpoint: string, user: USER) {
+    return await supertest
+      .get(endpoint)
+      .auth(user, transform.securityCommon.getPasswordForUser(user))
+      .set(getCommonRequestHeader('1'))
+      .send();
+  }
 
   async function createTransform(transformId: string) {
     const config = generateTransformConfig(transformId);
     await transform.api.createTransform(transformId, config);
   }
 
-  function assertTransformsStatsResponseBody(body: GetTransformsStatsResponseSchema) {
-    expect(body.count).to.eql(expected.apiTransformTransforms.count);
-    expect(body.transforms).to.have.length(expected.apiTransformTransforms.count);
+  function assertTransformsStatsResponseBody(
+    body: GetTransformsStatsResponseSchema,
+    expectedTransformsStats: ExpectedTransformsStats[]
+  ) {
+    const expectedTransformsCount = expectedTransformsStats.length;
 
-    const transform1 = body.transforms[0];
-    expect(transform1.id).to.eql(expected.apiTransformTransforms.transform1.id);
-    expect(transform1.state).to.eql(expected.apiTransformTransforms.transform1.state);
-    expect(typeof transform1.stats).to.eql(expected.apiTransformTransforms.typeOfStats);
-    expect(typeof transform1.checkpointing).to.eql(
-      expected.apiTransformTransforms.typeOfCheckpointing
+    expect(body.count).to.eql(
+      expectedTransformsCount,
+      `Expected response body count attribute to be ${expectedTransformsCount} (got ${body.count})`
     );
-
-    const transform2 = body.transforms[1];
-    expect(transform2.id).to.eql(expected.apiTransformTransforms.transform2.id);
-    expect(transform2.state).to.eql(expected.apiTransformTransforms.transform2.state);
-    expect(typeof transform2.stats).to.eql(expected.apiTransformTransforms.typeOfStats);
-    expect(typeof transform2.checkpointing).to.eql(
-      expected.apiTransformTransforms.typeOfCheckpointing
+    expect(body.transforms).to.have.length(
+      expectedTransformsCount,
+      `Expected response body transforms count to be ${expectedTransformsCount} (got ${body.transforms.length})`
     );
+
+    expectedTransformsStats.forEach((expected, index) => {
+      const transformStats = body.transforms[index];
+      expect(transformStats.id).to.eql(
+        expected.id,
+        `Expected transforms id to be ${expected.id} (got ${transformStats.id})`
+      );
+      expect(transformStats.state).to.eql(
+        expected.state,
+        `Expected transforms state to be ${expected.state} (got ${transformStats.state})`
+      );
+      expect(typeof transformStats.stats).to.eql(
+        'object',
+        `Expected transforms stats type to be 'object' (got ${typeof transformStats.stats})`
+      );
+      expect(typeof transformStats.checkpointing).to.eql(
+        'object',
+        `Expected transforms checkpointing type to be 'object' (got ${typeof transformStats.checkpointing})`
+      );
+    });
   }
 
   describe('/internal/transform/transforms/_stats', function () {
@@ -71,31 +89,57 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     it('should return a list of transforms statistics for super-user', async () => {
-      const { body, status } = await supertest
-        .get('/internal/transform/transforms/_stats')
-        .auth(
-          USER.TRANSFORM_POWERUSER,
-          transform.securityCommon.getPasswordForUser(USER.TRANSFORM_POWERUSER)
-        )
-        .set(getCommonRequestHeader('1'))
-        .send();
+      const { body, status } = await superTestRequest(
+        '/internal/transform/transforms/_stats',
+        USER.TRANSFORM_POWERUSER
+      );
+
       transform.api.assertResponseStatusCode(200, status, body);
 
-      assertTransformsStatsResponseBody(body);
+      assertTransformsStatsResponseBody(body, [
+        { id: 'transform-test-stats-1', state: TRANSFORM_STATE.STOPPED },
+        { id: 'transform-test-stats-2', state: TRANSFORM_STATE.STOPPED },
+      ]);
+    });
+
+    it('should return statistics for a single transform for super-user', async () => {
+      const { body, status } = await superTestRequest(
+        '/internal/transform/transforms/transform-test-stats-1/_stats',
+        USER.TRANSFORM_POWERUSER
+      );
+
+      transform.api.assertResponseStatusCode(200, status, body);
+
+      assertTransformsStatsResponseBody(body, [
+        { id: 'transform-test-stats-1', state: TRANSFORM_STATE.STOPPED },
+      ]);
     });
 
     it('should return a list of transforms statistics view-only user', async () => {
-      const { body, status } = await supertest
-        .get(`/internal/transform/transforms/_stats`)
-        .auth(
-          USER.TRANSFORM_VIEWER,
-          transform.securityCommon.getPasswordForUser(USER.TRANSFORM_VIEWER)
-        )
-        .set(getCommonRequestHeader('1'))
-        .send();
+      const { body, status } = await superTestRequest(
+        '/internal/transform/transforms/_stats',
+        USER.TRANSFORM_VIEWER
+      );
+
+      transform.api.assertResponseStatusCode(200, status, body);
+
+      assertTransformsStatsResponseBody(body, [
+        { id: 'transform-test-stats-1', state: TRANSFORM_STATE.STOPPED },
+        { id: 'transform-test-stats-2', state: TRANSFORM_STATE.STOPPED },
+      ]);
+    });
+
+    it('should return statistics for a single transform for view-only user', async () => {
+      const { body, status } = await superTestRequest(
+        '/internal/transform/transforms/transform-test-stats-2/_stats',
+        USER.TRANSFORM_VIEWER
+      );
+
       transform.api.assertResponseStatusCode(200, status, body);
 
-      assertTransformsStatsResponseBody(body);
+      assertTransformsStatsResponseBody(body, [
+        { id: 'transform-test-stats-2', state: TRANSFORM_STATE.STOPPED },
+      ]);
     });
   });
 };
diff --git a/x-pack/test/cases_api_integration/common/lib/api/index.ts b/x-pack/test/cases_api_integration/common/lib/api/index.ts
index 361a00eadb5184..4d7d64bbc44878 100644
--- a/x-pack/test/cases_api_integration/common/lib/api/index.ts
+++ b/x-pack/test/cases_api_integration/common/lib/api/index.ts
@@ -787,3 +787,24 @@ export const bulkGetCases = async ({
 
   return res;
 };
+
+export const searchCases = async ({
+  supertest,
+  body = {},
+  expectedHttpCode = 200,
+  auth = { user: superUser, space: null },
+}: {
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+  body?: Record<string, unknown>;
+  expectedHttpCode?: number;
+  auth?: { user: User; space: string | null };
+}): Promise<CasesFindResponse> => {
+  const { body: res } = await supertest
+    .post(`${getSpaceUrlPrefix(auth.space)}${CASES_INTERNAL_URL}/_search`)
+    .auth(auth.user.username, auth.user.password)
+    .set('kbn-xsrf', 'true')
+    .send({ ...body })
+    .expect(expectedHttpCode);
+
+  return res;
+};
diff --git a/x-pack/test/cases_api_integration/common/plugins/cases/server/index.ts b/x-pack/test/cases_api_integration/common/plugins/cases/server/index.ts
index 50d0aa6df9b822..b84439c6851b07 100644
--- a/x-pack/test/cases_api_integration/common/plugins/cases/server/index.ts
+++ b/x-pack/test/cases_api_integration/common/plugins/cases/server/index.ts
@@ -8,5 +8,5 @@
 import { PluginInitializerContext } from '@kbn/core/server';
 import { FixturePlugin } from './plugin';
 
-export const plugin = (initializerContext: PluginInitializerContext) =>
+export const plugin = async (initializerContext: PluginInitializerContext) =>
   new FixturePlugin(initializerContext);
diff --git a/x-pack/test/cases_api_integration/common/plugins/observability/server/index.ts b/x-pack/test/cases_api_integration/common/plugins/observability/server/index.ts
index 700aee6bfd49d6..ed9e6682e0098e 100644
--- a/x-pack/test/cases_api_integration/common/plugins/observability/server/index.ts
+++ b/x-pack/test/cases_api_integration/common/plugins/observability/server/index.ts
@@ -7,4 +7,4 @@
 
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/cases_api_integration/common/plugins/security_solution/server/index.ts b/x-pack/test/cases_api_integration/common/plugins/security_solution/server/index.ts
index 700aee6bfd49d6..ed9e6682e0098e 100644
--- a/x-pack/test/cases_api_integration/common/plugins/security_solution/server/index.ts
+++ b/x-pack/test/cases_api_integration/common/plugins/security_solution/server/index.ts
@@ -7,4 +7,4 @@
 
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
index a0aee09f47ed94..636c1661698083 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
@@ -55,6 +55,7 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./internal/get_connectors'));
     loadTestFile(require.resolve('./internal/user_actions_get_users'));
     loadTestFile(require.resolve('./internal/bulk_delete_file_attachments'));
+    loadTestFile(require.resolve('./internal/search_cases'));
 
     /**
      * Attachments framework
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/search_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/search_cases.ts
new file mode 100644
index 00000000000000..563a1d2ec83dca
--- /dev/null
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/search_cases.ts
@@ -0,0 +1,940 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { CustomFieldTypes } from '@kbn/cases-plugin/common/types/domain';
+import { CASES_INTERNAL_URL } from '@kbn/cases-plugin/common/constants';
+import { CaseSeverity } from '@kbn/cases-plugin/common/types/domain';
+
+import { FtrProviderContext } from '../../../../common/ftr_provider_context';
+import { postCaseReq, findCasesResp, getPostCaseRequest } from '../../../../common/lib/mock';
+import {
+  ensureSavedObjectIsAuthorized,
+  deleteAllCaseItems,
+  searchCases,
+  createCase,
+  createConfiguration,
+  getConfigurationRequest,
+} from '../../../../common/lib/api';
+import {
+  obsOnly,
+  secOnly,
+  obsOnlyRead,
+  secOnlyRead,
+  noKibanaPrivileges,
+  superUser,
+  globalRead,
+  obsSecRead,
+  obsSec,
+} from '../../../../common/lib/authentication/users';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const es = getService('es');
+  const kibanaServer = getService('kibanaServer');
+
+  describe('search_cases', () => {
+    afterEach(async () => {
+      await deleteAllCaseItems(es);
+    });
+
+    describe('basic tests', () => {
+      it('filters by single customField', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+            },
+          })
+        );
+
+        await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: null,
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+          ],
+        });
+
+        const postedCase = await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: 'this is a text field value',
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+          ],
+        });
+
+        const cases = await searchCases({
+          supertest,
+          body: { customFields: { valid_key_2: [true] }, owner: 'securitySolutionFixture' },
+        });
+
+        expect(cases).to.eql({
+          ...findCasesResp,
+          total: 1,
+          cases: [postedCase],
+          count_open_cases: 1,
+        });
+      });
+
+      it('filters by multiple customField', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+                {
+                  key: 'valid_key_3',
+                  label: 'another_toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: false,
+                },
+              ],
+            },
+          })
+        );
+
+        await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: null,
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+            {
+              key: 'valid_key_3',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+          ],
+        });
+
+        const postedCase2 = await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: 'this is a text field value',
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+            {
+              key: 'valid_key_3',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+          ],
+        });
+
+        const cases = await searchCases({
+          supertest,
+          body: {
+            customFields: { valid_key_2: [true], valid_key_3: [false] },
+            owner: 'securitySolutionFixture',
+          },
+        });
+
+        expect(cases).to.eql({
+          ...findCasesResp,
+          total: 1,
+          cases: [postedCase2],
+          count_open_cases: 1,
+        });
+      });
+
+      it('filters by customField with correct owner', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+                {
+                  key: 'valid_key_3',
+                  label: 'another_toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: false,
+                },
+              ],
+            },
+          })
+        );
+
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_obs_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_obs_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+                {
+                  key: 'valid_obs_key_3',
+                  label: 'another_toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: false,
+                },
+              ],
+              owner: 'observabilityFixture',
+            },
+          })
+        );
+
+        const secCase = await createCase(supertest, {
+          ...postCaseReq,
+          owner: 'securitySolutionFixture',
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: null,
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+            {
+              key: 'valid_key_3',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+          ],
+        });
+
+        const obsCase = await createCase(supertest, {
+          ...postCaseReq,
+          owner: 'observabilityFixture',
+          customFields: [
+            {
+              key: 'valid_obs_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: null,
+            },
+            {
+              key: 'valid_obs_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+            {
+              key: 'valid_obs_key_3',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+          ],
+        });
+
+        expect(
+          await searchCases({
+            supertest,
+            body: { customFields: { valid_key_2: [false] }, owner: 'securitySolutionFixture' },
+          })
+        ).to.eql({
+          ...findCasesResp,
+          total: 1,
+          cases: [secCase],
+          count_open_cases: 1,
+        });
+
+        expect(
+          await searchCases({
+            supertest,
+            body: { customFields: { valid_obs_key_2: [false] }, owner: 'observabilityFixture' },
+          })
+        ).to.eql({
+          ...findCasesResp,
+          total: 1,
+          cases: [obsCase],
+          count_open_cases: 1,
+        });
+      });
+
+      it('filters by customField and tags', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+            },
+          })
+        );
+
+        await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: null,
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: false,
+            },
+          ],
+        });
+
+        const postedCase = await createCase(supertest, {
+          ...postCaseReq,
+          customFields: [
+            {
+              key: 'valid_key_1',
+              type: CustomFieldTypes.TEXT,
+              value: 'this is a text field value',
+            },
+            {
+              key: 'valid_key_2',
+              type: CustomFieldTypes.TOGGLE,
+              value: true,
+            },
+          ],
+          tags: ['unique'],
+        });
+
+        const cases = await searchCases({
+          supertest,
+          body: {
+            customFields: { valid_key_2: [true] },
+            tags: ['unique'],
+            owner: 'securitySolutionFixture',
+          },
+        });
+
+        expect(cases).to.eql({
+          ...findCasesResp,
+          total: 1,
+          cases: [postedCase],
+          count_open_cases: 1,
+        });
+      });
+    });
+
+    describe('errors', () => {
+      it('unhappy path - 400s when no owner', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+              owner: 'securitySolutionFixture',
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: { customFields: { valid_key_2: [false] } },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when multiple owners', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+              owner: 'securitySolutionFixture',
+            },
+          })
+        );
+
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_obs_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_obs_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+                {
+                  key: 'valid_obs_key_3',
+                  label: 'another_toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: false,
+                },
+              ],
+              owner: 'observabilityFixture',
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: {
+            customFields: { valid_key_2: [false], valid_obs_key_2: [false] },
+            owner: ['observabilityFixture', 'securitySolutionFixture'],
+          },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when customFieldConfiguration owner and search customFields owner are different ', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+              owner: 'securitySolutionFixture',
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: { customFields: { valid_key_2: [false] }, owner: 'observabilityFixture' },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when configuration is empty', async () => {
+        await createConfiguration(supertest, getConfigurationRequest({}));
+        await searchCases({
+          supertest,
+          body: { customFields: { random_key: [false] }, owner: 'securitySolutionFixture' },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when invalid custom field key passed', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: { customFields: { random_key: [false] }, owner: 'securitySolutionFixture' },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when invalid value of custom field', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: { customFields: { valid_key_2: [1234] }, owner: 'securitySolutionFixture' },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('unhappy path - 400s when custom field type is non filterable', async () => {
+        await createConfiguration(
+          supertest,
+          getConfigurationRequest({
+            overrides: {
+              customFields: [
+                {
+                  key: 'valid_key_1',
+                  label: 'text',
+                  type: CustomFieldTypes.TEXT,
+                  required: false,
+                },
+                {
+                  key: 'valid_key_2',
+                  label: 'toggle',
+                  type: CustomFieldTypes.TOGGLE,
+                  required: true,
+                },
+              ],
+            },
+          })
+        );
+
+        await searchCases({
+          supertest,
+          body: { customFields: { valid_key_1: ['hello!'] }, owner: 'securitySolutionFixture' },
+          expectedHttpCode: 400,
+        });
+      });
+    });
+
+    describe('rbac', () => {
+      afterEach(async () => {
+        await deleteAllCaseItems(es);
+      });
+
+      it('should return the correct cases', async () => {
+        await Promise.all([
+          // Create case owned by the security solution user
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+            200,
+            {
+              user: secOnly,
+              space: 'space1',
+            }
+          ),
+          // Create case owned by the observability user
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'observabilityFixture' }),
+            200,
+            {
+              user: obsOnly,
+              space: 'space1',
+            }
+          ),
+        ]);
+
+        for (const scenario of [
+          {
+            user: globalRead,
+            numberOfExpectedCases: 2,
+            owners: ['securitySolutionFixture', 'observabilityFixture'],
+          },
+          {
+            user: superUser,
+            numberOfExpectedCases: 2,
+            owners: ['securitySolutionFixture', 'observabilityFixture'],
+          },
+          { user: secOnlyRead, numberOfExpectedCases: 1, owners: ['securitySolutionFixture'] },
+          { user: obsOnlyRead, numberOfExpectedCases: 1, owners: ['observabilityFixture'] },
+          {
+            user: obsSecRead,
+            numberOfExpectedCases: 2,
+            owners: ['securitySolutionFixture', 'observabilityFixture'],
+          },
+        ]) {
+          const res = await searchCases({
+            supertest: supertestWithoutAuth,
+            auth: {
+              user: scenario.user,
+              space: 'space1',
+            },
+            body: { owner: ['securitySolutionFixture', 'observabilityFixture'] },
+          });
+
+          ensureSavedObjectIsAuthorized(res.cases, scenario.numberOfExpectedCases, scenario.owners);
+        }
+      });
+
+      for (const scenario of [
+        { user: noKibanaPrivileges, space: 'space1' },
+        { user: secOnly, space: 'space2' },
+      ]) {
+        it(`User ${scenario.user.username} with role(s) ${scenario.user.roles.join()} and space ${
+          scenario.space
+        } - should NOT read a case`, async () => {
+          // super user creates a case at the appropriate space
+          await createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+            200,
+            {
+              user: superUser,
+              space: scenario.space,
+            }
+          );
+
+          // user should not be able to read cases at the appropriate space
+          await searchCases({
+            supertest: supertestWithoutAuth,
+            auth: {
+              user: scenario.user,
+              space: scenario.space,
+            },
+            body: { owner: 'securitySolutionFixture' },
+            expectedHttpCode: 403,
+          });
+        });
+      }
+
+      // This test is to prevent a future developer to add the filter attribute without taking into consideration
+      // the authorizationFilter produced by the cases authorization class
+      it('should NOT allow to pass a filter', async () => {
+        await supertest
+          .post(`${CASES_INTERNAL_URL}/_search`)
+          .set('kbn-xsrf', 'true')
+          .send({
+            sortOrder: 'asc',
+            filter: `{cases.attributes.owner:"observabilityFixture"}`,
+            owner: 'observabilityFixture',
+          })
+          .expect(400);
+      });
+
+      it('should NOT allow to pass non-valid fields', async () => {
+        await searchCases({
+          supertest,
+          body: {
+            searchFields: ['foobar'],
+            search: 'some search string*',
+            owner: 'observabilityFixture',
+          },
+          expectedHttpCode: 400,
+        });
+      });
+
+      // This test ensures that the user is not allowed to define the namespaces query param
+      // so she cannot search across spaces
+      it('should NOT allow to pass a namespaces', async () => {
+        await supertest
+          .post(`${CASES_INTERNAL_URL}/_search`)
+          .set('kbn-xsrf', 'true')
+          .send({
+            sortOrder: 'asc',
+            filter: `{namespaces[0]=*}`,
+            owner: 'observabilityFixture',
+          })
+          .expect(400);
+
+        await supertest
+          .post(`${CASES_INTERNAL_URL}/_search`)
+          .set('kbn-xsrf', 'true')
+          .send({
+            sortOrder: 'asc',
+            namespaces: '*',
+            owner: 'observabilityFixture',
+          })
+          .expect(400);
+      });
+
+      it('should NOT allow to pass a non supported query parameter', async () => {
+        await supertest
+          .post(`${CASES_INTERNAL_URL}/_search`)
+          .set('kbn-xsrf', 'true')
+          .send({ notExists: 'papa', owner: 'observabilityFixture' })
+          .expect(400);
+      });
+
+      it('should respect the owner filter when having permissions', async () => {
+        await Promise.all([
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+            200,
+            {
+              user: obsSec,
+              space: 'space1',
+            }
+          ),
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'observabilityFixture' }),
+            200,
+            {
+              user: obsSec,
+              space: 'space1',
+            }
+          ),
+        ]);
+
+        const res = await searchCases({
+          supertest: supertestWithoutAuth,
+          body: {
+            owner: 'securitySolutionFixture',
+          },
+          auth: {
+            user: obsSec,
+            space: 'space1',
+          },
+        });
+
+        ensureSavedObjectIsAuthorized(res.cases, 1, ['securitySolutionFixture']);
+      });
+
+      it('should return the correct cases when trying to exploit RBAC through the owner query parameter', async () => {
+        await Promise.all([
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+            200,
+            {
+              user: obsSec,
+              space: 'space1',
+            }
+          ),
+          createCase(
+            supertestWithoutAuth,
+            getPostCaseRequest({ owner: 'observabilityFixture' }),
+            200,
+            {
+              user: obsSec,
+              space: 'space1',
+            }
+          ),
+        ]);
+
+        // User with permissions only to security solution request cases from observability
+        const res = await searchCases({
+          supertest: supertestWithoutAuth,
+          body: {
+            owner: ['securitySolutionFixture', 'observabilityFixture'],
+          },
+          auth: {
+            user: secOnly,
+            space: 'space1',
+          },
+        });
+
+        // Only security solution cases are being returned
+        ensureSavedObjectIsAuthorized(res.cases, 1, ['securitySolutionFixture']);
+      });
+
+      describe('range queries', () => {
+        before(async () => {
+          await kibanaServer.importExport.load(
+            'x-pack/test/functional/fixtures/kbn_archiver/cases/8.2.0/cases_various_dates.json',
+            { space: 'space1' }
+          );
+        });
+
+        after(async () => {
+          await kibanaServer.importExport.unload(
+            'x-pack/test/functional/fixtures/kbn_archiver/cases/8.2.0/cases_various_dates.json',
+            { space: 'space1' }
+          );
+          await deleteAllCaseItems(es);
+        });
+
+        it('should respect the owner filter when using range queries', async () => {
+          const res = await searchCases({
+            supertest: supertestWithoutAuth,
+            body: {
+              from: '2022-03-15',
+              to: '2022-03-21',
+              owner: 'securitySolutionFixture',
+            },
+            auth: {
+              user: secOnly,
+              space: 'space1',
+            },
+          });
+
+          // Only security solution cases are being returned
+          ensureSavedObjectIsAuthorized(res.cases, 1, ['securitySolutionFixture']);
+        });
+      });
+
+      describe('RBAC query filter', () => {
+        it('should return the correct cases when trying to query filter by severity', async () => {
+          await Promise.all([
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'securitySolutionFixture', severity: CaseSeverity.HIGH }),
+              200,
+              {
+                user: obsSec,
+                space: 'space1',
+              }
+            ),
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'securitySolutionFixture', severity: CaseSeverity.HIGH }),
+              200,
+              {
+                user: obsSec,
+                space: 'space1',
+              }
+            ),
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'observabilityFixture', severity: CaseSeverity.HIGH }),
+              200,
+              {
+                user: obsOnly,
+                space: 'space1',
+              }
+            ),
+          ]);
+
+          // User with permissions only to security solution should get only the security solution cases
+          const res = await searchCases({
+            supertest: supertestWithoutAuth,
+            body: {
+              severity: CaseSeverity.HIGH,
+              owner: 'securitySolutionFixture',
+            },
+            auth: {
+              user: secOnly,
+              space: 'space1',
+            },
+          });
+
+          // Only security solution cases are being returned
+          ensureSavedObjectIsAuthorized(res.cases, 2, ['securitySolutionFixture']);
+        });
+      });
+    });
+  });
+};
diff --git a/x-pack/test/cloud_integration/plugins/saml_provider/server/index.ts b/x-pack/test/cloud_integration/plugins/saml_provider/server/index.ts
index ff490693e86a2f..c0c10de01fb499 100644
--- a/x-pack/test/cloud_integration/plugins/saml_provider/server/index.ts
+++ b/x-pack/test/cloud_integration/plugins/saml_provider/server/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializer, Plugin } from '@kbn/core/server';
 import { initRoutes } from './init_routes';
 
-export const plugin: PluginInitializer<void, void> = (): Plugin => ({
+export const plugin: PluginInitializer<void, void> = async (): Promise<Plugin> => ({
   setup: (core) => initRoutes(core),
   start: () => {},
   stop: () => {},
diff --git a/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts b/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
index 0500a68e8654d0..b4cfc2eaa8dd35 100644
--- a/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
+++ b/x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
@@ -144,7 +144,11 @@ export function AddCisIntegrationFormPageProvider({
   const navigateToIntegrationCspList = async () => {
     await PageObjects.common.navigateToActualUrl(
       'integrations', // Defined in Security Solution plugin
-      '/detail/cloud_security_posture/policies'
+      '/detail/cloud_security_posture/policies',
+      {
+        ensureCurrentUrl: false,
+        shouldLoginIfPrompted: false,
+      }
     );
   };
 
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
index b79bbf13c1cc61..bf22875e237120 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
@@ -119,7 +119,7 @@ export default ({ getService }: FtrProviderContext): void => {
           .attach('file', fileNdJson, 'rules.ndjson')
           .expect(200);
 
-        expect(body.errors[0].error.message).to.eql('Failed to parse "from" on rule param');
+        expect(body.errors[0].error.message).to.eql('from: Failed to parse date-math expression');
       });
 
       it('should fail validation when importing two rules and one has a malformed "from" params', async () => {
@@ -141,7 +141,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
         // should result in one success and a failure message
         expect(body.success_count).to.eql(1);
-        expect(body.errors[0].error.message).to.eql('Failed to parse "from" on rule param');
+        expect(body.errors[0].error.message).to.eql('from: Failed to parse date-math expression');
       });
 
       it('should be able to import two rules', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
index dae7835c160206..c92591e8f3f74e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_rules.ts
@@ -24,9 +24,7 @@ import {
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
-  createSignalsIndex,
   deleteAllRules,
-  deleteAllAlerts,
   getSimpleRule,
   getSimpleRuleAsNdjson,
   getRulesAsNdjson,
@@ -204,6 +202,9 @@ export default ({ getService }: FtrProviderContext): void => {
   const es = getService('es');
 
   describe('import_rules', () => {
+    beforeEach(async () => {
+      await deleteAllRules(supertest, log);
+    });
     describe('importing rules with different roles', () => {
       before(async () => {
         await createUserAndRole(getService, ROLES.hunter_no_actions);
@@ -213,14 +214,6 @@ export default ({ getService }: FtrProviderContext): void => {
         await deleteUserAndRole(getService, ROLES.hunter_no_actions);
         await deleteUserAndRole(getService, ROLES.hunter);
       });
-      beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
-      });
-
-      afterEach(async () => {
-        await deleteAllAlerts(supertest, log, es);
-        await deleteAllRules(supertest, log);
-      });
       it('should successfully import rules without actions when user has no actions privileges', async () => {
         const { body } = await supertestWithoutAuth
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
@@ -419,7 +412,8 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(body.errors[0]).to.eql({
           rule_id: '(unknown id)',
           error: {
-            message: 'Invalid value "undefined" supplied to "threshold"',
+            message:
+              'type: Invalid literal value, expected "eql", language: Invalid literal value, expected "eql", type: Invalid literal value, expected "query", type: Invalid literal value, expected "saved_query", saved_id: Required, and 14 more',
             status_code: 400,
           },
         });
@@ -469,7 +463,7 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(body.errors[0]).to.eql({
           rule_id: '(unknown id)',
           error: {
-            message: 'Invalid value "0" supplied to "threshold,value"',
+            message: 'threshold.value: Number must be greater than or equal to 1',
             status_code: 400,
           },
         });
@@ -506,16 +500,75 @@ export default ({ getService }: FtrProviderContext): void => {
       });
     });
 
-    describe('importing rules with an index', () => {
-      beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
-      });
+    describe('forward compatibility', () => {
+      it('should remove any extra rule fields when importing', async () => {
+        const rule: QueryRuleCreateProps = {
+          ...getSimpleRule('rule-1'),
+          extraField: true,
+          risk_score_mapping: [
+            {
+              field: 'host.name',
+              value: 'host.name',
+              operator: 'equals',
+              risk_score: 50,
+              // @ts-expect-error
+              extraField: true,
+            },
+          ],
+          severity_mapping: [
+            {
+              field: 'host.name',
+              value: 'host.name',
+              operator: 'equals',
+              severity: 'low',
+              // @ts-expect-error
+              extraField: true,
+            },
+          ],
+          threat: [
+            {
+              framework: 'MITRE ATT&CK',
+              extraField: true,
+              tactic: {
+                id: 'TA0001',
+                name: 'Initial Access',
+                reference: 'https://attack.mitre.org/tactics/TA0001',
+                // @ts-expect-error
+                extraField: true,
+              },
+              technique: [],
+            },
+          ],
+          investigation_fields: {
+            field_names: ['host.name'],
+            // @ts-expect-error
+            extraField: true,
+          },
+        };
+        const payload = Buffer.from(JSON.stringify(rule));
+        await supertest
+          .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .attach('file', payload, 'rules.ndjson')
+          .expect(200);
+
+        const { body } = await supertest
+          .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=rule-1`)
+          .set('elastic-api-version', '2023-10-31')
+          .send()
+          .expect(200);
 
-      afterEach(async () => {
-        await deleteAllAlerts(supertest, log, es);
-        await deleteAllRules(supertest, log);
+        expect(Object.hasOwn(body, 'extraField')).to.eql(false);
+        expect(Object.hasOwn(body.risk_score_mapping[0], 'extraField')).to.eql(false);
+        expect(Object.hasOwn(body.severity_mapping[0], 'extraField')).to.eql(false);
+        expect(Object.hasOwn(body.threat[0], 'extraField')).to.eql(false);
+        expect(Object.hasOwn(body.threat[0].tactic, 'extraField')).to.eql(false);
+        expect(Object.hasOwn(body.investigation_fields, 'extraField')).to.eql(false);
       });
+    });
 
+    describe('importing rules with an index', () => {
       it('should set the response content types to be expected', async () => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
@@ -1905,17 +1958,6 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     describe('legacy investigation fields', () => {
-      beforeEach(async () => {
-        await deleteAllAlerts(supertest, log, es);
-        await deleteAllRules(supertest, log);
-        await createSignalsIndex(supertest, log);
-      });
-
-      afterEach(async () => {
-        await deleteAllAlerts(supertest, log, es);
-        await deleteAllRules(supertest, log);
-      });
-
       it('imports rule with investigation fields as array', async () => {
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_import`)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
index ae0bfaa8940e8b..c894596977061e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
@@ -26,9 +26,6 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./perform_bulk_action_dry_run'));
     loadTestFile(require.resolve('./patch_rules'));
     loadTestFile(require.resolve('./read_privileges'));
-    loadTestFile(require.resolve('./timestamps'));
-    loadTestFile(require.resolve('./runtime'));
     loadTestFile(require.resolve('./throttle'));
-    loadTestFile(require.resolve('./ignore_fields'));
   });
 };
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/mocks/new_terms.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/mocks/new_terms.ts
deleted file mode 100644
index 15c63546a4be75..00000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/mocks/new_terms.ts
+++ /dev/null
@@ -1,1409 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export const largeArraysBuckets = [
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-0',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-1',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-2',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-3',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-4',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-5',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-6',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-7',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-8',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-0',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-1',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-2',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-3',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-4',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-5',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-6',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-7',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-8',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-9',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-10',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-11',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-12',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-13',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-14',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-15',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-16',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-17',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-18',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-  {
-    key: {
-      large_array_20: 'value-of-20-19',
-      large_array_10: 'value-of-10-9',
-    },
-    doc_count: 1,
-  },
-];
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin/server/index.ts b/x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin/server/index.ts
index fec7965b88df4f..c7d14986b6a14b 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin/server/index.ts
+++ b/x-pack/test/encrypted_saved_objects_api_integration/plugins/api_consumer_plugin/server/index.ts
@@ -48,7 +48,7 @@ export interface PluginsStart {
   spaces: never;
 }
 
-export const plugin: PluginInitializer<void, void, PluginsSetup, PluginsStart> = () => ({
+export const plugin: PluginInitializer<void, void, PluginsSetup, PluginsStart> = async () => ({
   setup(core: CoreSetup<PluginsStart>, deps: PluginsSetup) {
     for (const [name, namespaceType, hidden] of [
       [SAVED_OBJECT_WITH_SECRET_TYPE, 'single', false],
diff --git a/x-pack/test/fleet_api_integration/apis/agents/upgrade.ts b/x-pack/test/fleet_api_integration/apis/agents/upgrade.ts
index 0a3dc09692b68c..3d48d66957191f 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/upgrade.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/upgrade.ts
@@ -443,6 +443,167 @@ export default function (providerContext: FtrProviderContext) {
           })
           .expect(200);
       });
+
+      it('should respond 400 if trying to upgrade an already upgrading agent with no upgrade details', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              upgrade_started_at: new Date(Date.now() - 9 * 6e4).toISOString(),
+              local_metadata: {
+                elastic: {
+                  agent: {
+                    upgradeable: true,
+                    version: '0.0.0',
+                  },
+                },
+              },
+            },
+          },
+        });
+        const response = await supertest
+          .post(`/api/fleet/agents/agent1/upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+          })
+          .expect(400);
+
+        expect(response.body.message).to.contain('is already upgrading');
+      });
+
+      it('should respond 200 if trying to upgrade an already upgrading agent with no upgrade details with force flag', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              upgrade_started_at: new Date(Date.now() - 9 * 6e4).toISOString(),
+              local_metadata: {
+                elastic: {
+                  agent: {
+                    upgradeable: true,
+                    version: '0.0.0',
+                  },
+                },
+              },
+            },
+          },
+        });
+        await supertest
+          .post(`/api/fleet/agents/agent1/upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+            force: true,
+          })
+          .expect(200);
+      });
+
+      it('should respond 400 if trying to upgrade an already upgrading agent with upgrade details', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              local_metadata: {
+                elastic: {
+                  agent: {
+                    upgradeable: true,
+                    version: '0.0.0',
+                  },
+                },
+              },
+              upgrade_details: {
+                target_version: fleetServerVersion,
+                action_id: 'XXX',
+                state: 'UPG_REQUESTED',
+              },
+            },
+          },
+        });
+        const response = await supertest
+          .post(`/api/fleet/agents/agent1/upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+          })
+          .expect(400);
+
+        expect(response.body.message).to.contain('is already upgrading');
+      });
+
+      it('should respond 200 if trying to upgrade an already upgrading agent with upgrade details with force flag', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              local_metadata: {
+                elastic: {
+                  agent: {
+                    upgradeable: true,
+                    version: '0.0.0',
+                  },
+                },
+              },
+              upgrade_details: {
+                target_version: fleetServerVersion,
+                action_id: 'XXX',
+                state: 'UPG_REQUESTED',
+              },
+            },
+          },
+        });
+        await supertest
+          .post(`/api/fleet/agents/agent1/upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+            force: true,
+          })
+          .expect(200);
+      });
+
+      it('should respond 200 if trying to upgrade an agent with a failed upgrade status', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              local_metadata: {
+                elastic: {
+                  agent: {
+                    upgradeable: true,
+                    version: '0.0.0',
+                  },
+                },
+              },
+              upgrade_details: {
+                target_version: fleetServerVersion,
+                action_id: 'XXX',
+                state: 'UPG_FAILED',
+                metadata: {
+                  error_msg: 'Upgrade timed out',
+                },
+              },
+            },
+          },
+        });
+        await supertest
+          .post(`/api/fleet/agents/agent1/upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+          })
+          .expect(200);
+      });
     });
 
     describe('multiple agents', () => {
@@ -1291,6 +1452,61 @@ export default function (providerContext: FtrProviderContext) {
         expect(typeof agent1data.body.item.upgrade_started_at).to.be('string');
         expect(typeof agent2data.body.item.upgrade_started_at).to.be('string');
       });
+
+      it('should set a long expiration time when the start_time is set to now (immediate rollout period)', async () => {
+        await es.update({
+          id: 'agent1',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              local_metadata: { elastic: { agent: { upgradeable: true, version: '0.0.0' } } },
+            },
+          },
+        });
+        await es.update({
+          id: 'agent2',
+          refresh: 'wait_for',
+          index: AGENTS_INDEX,
+          body: {
+            doc: {
+              local_metadata: { elastic: { agent: { upgradeable: true, version: '0.0.0' } } },
+            },
+          },
+        });
+        await supertest
+          .post(`/api/fleet/agents/bulk_upgrade`)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            version: fleetServerVersion,
+            agents: ['agent1', 'agent2'],
+            start_time: new Date(Date.now()).toISOString(),
+          })
+          .expect(200);
+
+        const actionsRes = await es.search({
+          index: '.fleet-actions',
+          body: {
+            sort: [{ '@timestamp': { order: 'desc' } }],
+          },
+        });
+
+        const action: any = actionsRes.hits.hits[0]._source;
+        expect(action).to.have.keys(
+          'agents',
+          'start_time',
+          'minimum_execution_duration',
+          'expiration'
+        );
+        // calculate 1 month from now
+        const today = new Date();
+        const nextMonthUnixTime = today.setMonth(today.getMonth() + 1);
+        const nextMonth = new Date(nextMonthUnixTime).toISOString().slice(0, 10);
+
+        expect(action.expiration).contain(`${nextMonth}`);
+        expect(action.agents).contain('agent1');
+        expect(action.agents).contain('agent2');
+      });
     });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/get.ts b/x-pack/test/fleet_api_integration/apis/epm/get.ts
index 2ca984ceb67dd3..045a6d034a0a08 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/get.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/get.ts
@@ -38,7 +38,8 @@ export default function (providerContext: FtrProviderContext) {
     '../fixtures/direct_upload_packages/apache_0.1.4.zip'
   );
 
-  describe('EPM - get', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/163203
+  describe.skip('EPM - get', () => {
     skipIfNoDockerRegistry(providerContext);
     setupFleetAndAgents(providerContext);
 
diff --git a/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_security.ts b/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_security.ts
index 584822a31161bd..dc1cf432f8ca61 100644
--- a/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_security.ts
+++ b/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_security.ts
@@ -96,7 +96,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       it('only shows the dashboard navlink', async () => {
         const navLinks = await appsMenu.readLinks();
-        expect(navLinks.map((link) => link.text)).to.eql(['Dashboard', 'Stack Management']);
+        expect(navLinks.map((link) => link.text)).to.eql(['Dashboards', 'Stack Management']);
       });
 
       it(`landing page shows "Create new Dashboard" button`, async () => {
@@ -286,7 +286,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       it('shows dashboard navlink', async () => {
         const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
-        expect(navLinks).to.eql(['Dashboard']);
+        expect(navLinks).to.eql(['Dashboards']);
       });
 
       it(`landing page doesn't show "Create new Dashboard" button`, async () => {
@@ -398,7 +398,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       it('shows dashboard navlink', async () => {
         const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
-        expect(navLinks).to.eql(['Dashboard']);
+        expect(navLinks).to.eql(['Dashboards']);
       });
 
       it(`landing page doesn't show "Create new Dashboard" button`, async () => {
diff --git a/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_spaces.ts b/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_spaces.ts
index ef8c83ec667ba2..2f04d12bdac6d3 100644
--- a/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_spaces.ts
+++ b/x-pack/test/functional/apps/dashboard/group1/feature_controls/dashboard_spaces.ts
@@ -45,7 +45,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
           basePath: '/s/custom_space',
         });
         const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
-        expect(navLinks).to.contain('Dashboard');
+        expect(navLinks).to.contain('Dashboards');
       });
 
       it(`landing page shows "Create new Dashboard" button`, async () => {
diff --git a/x-pack/test/functional/apps/index_management/create_enrich_policy/create_enrich_policy.ts b/x-pack/test/functional/apps/index_management/create_enrich_policy/create_enrich_policy.ts
index 3d0a1e562e45bd..6017c202d161e8 100644
--- a/x-pack/test/functional/apps/index_management/create_enrich_policy/create_enrich_policy.ts
+++ b/x-pack/test/functional/apps/index_management/create_enrich_policy/create_enrich_policy.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { SLO_SUMMARY_ENRICH_POLICY_NAME } from '@kbn/observability-plugin/server/assets/constants';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
@@ -23,6 +24,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     before(async () => {
       await log.debug('Creating test index');
       try {
+        await es.ingest.deletePipeline({ id: '.slo-*' }, { ignore: [404] });
+        await es.enrich.deletePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME }, { ignore: [404] });
         await es.indices.create({
           index: INDEX_NAME,
           body: {
diff --git a/x-pack/test/functional/apps/index_management/home_page.ts b/x-pack/test/functional/apps/index_management/home_page.ts
index 265707ec6da8c2..485a09ef763810 100644
--- a/x-pack/test/functional/apps/index_management/home_page.ts
+++ b/x-pack/test/functional/apps/index_management/home_page.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { SLO_SUMMARY_ENRICH_POLICY_NAME } from '@kbn/observability-plugin/server/assets/constants';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
@@ -15,6 +16,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const browser = getService('browser');
   const retry = getService('retry');
   const security = getService('security');
+  const es = getService('es');
 
   describe('Home page', function () {
     before(async () => {
@@ -94,6 +96,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     });
 
     describe('Enrich policies', () => {
+      before(async () => {
+        await es.ingest.deletePipeline({ id: '.slo-*' }, { ignore: [404] });
+        await es.enrich.deletePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME }, { ignore: [404] });
+      });
       it('renders the enrich policies tab', async () => {
         // Navigate to the component templates tab
         await pageObjects.indexManagement.changeTabs('enrich_policiesTab');
diff --git a/x-pack/test/functional/apps/index_management/index_templates_tab/create_index_template.ts b/x-pack/test/functional/apps/index_management/index_templates_tab/create_index_template.ts
new file mode 100644
index 00000000000000..9b9d869fb99803
--- /dev/null
+++ b/x-pack/test/functional/apps/index_management/index_templates_tab/create_index_template.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default ({ getPageObjects, getService }: FtrProviderContext) => {
+  const pageObjects = getPageObjects(['common', 'indexManagement', 'header']);
+  const log = getService('log');
+  const security = getService('security');
+  const testSubjects = getService('testSubjects');
+
+  const INDEX_TEMPLATE_NAME = `test-index-template`;
+
+  describe('Create index template', function () {
+    before(async () => {
+      await log.debug('Navigating to the index templates tab');
+      await security.testUser.setRoles(['index_management_user']);
+      await pageObjects.common.navigateToApp('indexManagement');
+      // Navigate to the data streams tab
+      await pageObjects.indexManagement.changeTabs('templatesTab');
+      await pageObjects.header.waitUntilLoadingHasFinished();
+      // Click create template button
+      await testSubjects.click('createTemplateButton');
+    });
+
+    it('can create an index template with data retention', async () => {
+      // Complete required fields from step 1
+      await testSubjects.setValue('nameField', INDEX_TEMPLATE_NAME);
+      await testSubjects.setValue('indexPatternsField', 'test-1');
+      // Enable data stream
+      await testSubjects.click('dataStreamField > input');
+      // Enable data retention
+      await testSubjects.click('dataRetentionToggle > input');
+      // Set the retention to 7 hours
+      await testSubjects.setValue('valueDataRetentionField', '7');
+      await testSubjects.click('show-filters-button');
+      await testSubjects.click('filter-option-h');
+      // Navigate to the last step of the wizard
+      await testSubjects.click('nextButton');
+      await testSubjects.click('nextButton');
+      await testSubjects.click('nextButton');
+      await testSubjects.click('nextButton');
+      await testSubjects.click('nextButton');
+
+      expect(await testSubjects.getVisibleText('lifecycleValue')).to.be('7 hours');
+    });
+  });
+};
diff --git a/x-pack/test/functional/apps/index_management/index_templates_tab/index.ts b/x-pack/test/functional/apps/index_management/index_templates_tab/index.ts
new file mode 100644
index 00000000000000..992c2094c037ef
--- /dev/null
+++ b/x-pack/test/functional/apps/index_management/index_templates_tab/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default ({ loadTestFile }: FtrProviderContext) => {
+  describe('Index Management: index templates tab', function () {
+    loadTestFile(require.resolve('./create_index_template'));
+  });
+};
diff --git a/x-pack/test/functional/apps/infra/index.ts b/x-pack/test/functional/apps/infra/index.ts
index b389d56b9032c2..e34b074f8829ec 100644
--- a/x-pack/test/functional/apps/infra/index.ts
+++ b/x-pack/test/functional/apps/infra/index.ts
@@ -23,11 +23,12 @@ export default ({ loadTestFile }: FtrProviderContext) => {
     });
 
     describe('Logs UI', function () {
-      loadTestFile(require.resolve('./log_entry_categories_tab'));
-      loadTestFile(require.resolve('./log_entry_rate_tab'));
-      loadTestFile(require.resolve('./logs_source_configuration'));
-      loadTestFile(require.resolve('./link_to'));
-      loadTestFile(require.resolve('./log_stream'));
+      loadTestFile(require.resolve('./logs/log_entry_categories_tab'));
+      loadTestFile(require.resolve('./logs/log_entry_rate_tab'));
+      loadTestFile(require.resolve('./logs/logs_source_configuration'));
+      loadTestFile(require.resolve('./logs/log_stream_date_nano'));
+      loadTestFile(require.resolve('./logs/link_to'));
+      loadTestFile(require.resolve('./logs/log_stream'));
     });
   });
 };
diff --git a/x-pack/test/functional/apps/infra/link_to.ts b/x-pack/test/functional/apps/infra/logs/link_to.ts
similarity index 93%
rename from x-pack/test/functional/apps/infra/link_to.ts
rename to x-pack/test/functional/apps/infra/logs/link_to.ts
index 7ad37696f5a46a..3d11fcd75f8ac5 100644
--- a/x-pack/test/functional/apps/infra/link_to.ts
+++ b/x-pack/test/functional/apps/infra/logs/link_to.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { URL } from 'url';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const ONE_HOUR = 60 * 60 * 1000;
 const LOG_VIEW_ID = 'testView';
@@ -18,7 +18,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const retry = getService('retry');
   const browser = getService('browser');
 
-  const timestamp = Date.now();
+  const date = new Date();
+  const timestamp = date.getTime();
   const startDate = new Date(timestamp - ONE_HOUR).toISOString();
   const endDate = new Date(timestamp + ONE_HOUR).toISOString();
 
@@ -52,7 +53,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
             `(query:(language:kuery,query:\'trace.id:${traceId}'),refreshInterval:(pause:!t,value:5000),timeRange:(from:'${startDate}',to:'${endDate}'))`
           );
           expect(parsedUrl.searchParams.get('logPosition')).to.be(
-            `(position:(tiebreaker:0,time:${timestamp}))`
+            `(position:(tiebreaker:0,time:'${date.toISOString()}'))`
           );
           expect(parsedUrl.searchParams.get('logView')).to.be(LOG_VIEW_REFERENCE);
           expect(documentTitle).to.contain('Stream - Logs - Observability - Elastic');
@@ -87,7 +88,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
             `(query:(language:kuery,query:\'(kubernetes.pod.uid: 1234) and (trace.id:${traceId})\'),refreshInterval:(pause:!t,value:5000),timeRange:(from:'${startDate}',to:'${endDate}'))`
           );
           expect(parsedUrl.searchParams.get('logPosition')).to.be(
-            `(position:(tiebreaker:0,time:${timestamp}))`
+            `(position:(tiebreaker:0,time:'${date.toISOString()}'))`
           );
           expect(parsedUrl.searchParams.get('logView')).to.be(LOG_VIEW_REFERENCE);
           expect(documentTitle).to.contain('Stream - Logs - Observability - Elastic');
diff --git a/x-pack/test/functional/apps/infra/log_entry_categories_tab.ts b/x-pack/test/functional/apps/infra/logs/log_entry_categories_tab.ts
similarity index 95%
rename from x-pack/test/functional/apps/infra/log_entry_categories_tab.ts
rename to x-pack/test/functional/apps/infra/logs/log_entry_categories_tab.ts
index 11587845aae9c1..33396497fc83c8 100644
--- a/x-pack/test/functional/apps/infra/log_entry_categories_tab.ts
+++ b/x-pack/test/functional/apps/infra/logs/log_entry_categories_tab.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
diff --git a/x-pack/test/functional/apps/infra/log_entry_rate_tab.ts b/x-pack/test/functional/apps/infra/logs/log_entry_rate_tab.ts
similarity index 95%
rename from x-pack/test/functional/apps/infra/log_entry_rate_tab.ts
rename to x-pack/test/functional/apps/infra/logs/log_entry_rate_tab.ts
index 632b1e6917ca09..b2b4b5bcfc0beb 100644
--- a/x-pack/test/functional/apps/infra/log_entry_rate_tab.ts
+++ b/x-pack/test/functional/apps/infra/logs/log_entry_rate_tab.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getService }: FtrProviderContext) => {
   const logsUi = getService('logsUi');
diff --git a/x-pack/test/functional/apps/infra/log_stream.ts b/x-pack/test/functional/apps/infra/logs/log_stream.ts
similarity index 97%
rename from x-pack/test/functional/apps/infra/log_stream.ts
rename to x-pack/test/functional/apps/infra/logs/log_stream.ts
index 1918c39527d6b1..e4538a8a9275c2 100644
--- a/x-pack/test/functional/apps/infra/log_stream.ts
+++ b/x-pack/test/functional/apps/infra/logs/log_stream.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { URL } from 'url';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const SERVICE_ID = '49a18510598271e924253ed2581d7ada';
 
diff --git a/x-pack/test/functional/apps/infra/logs/log_stream_date_nano.ts b/x-pack/test/functional/apps/infra/logs/log_stream_date_nano.ts
new file mode 100644
index 00000000000000..f01e5fd0a06f50
--- /dev/null
+++ b/x-pack/test/functional/apps/infra/logs/log_stream_date_nano.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { URL } from 'url';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { DATES } from '../constants';
+
+export default ({ getPageObjects, getService }: FtrProviderContext) => {
+  const retry = getService('retry');
+  const browser = getService('browser');
+  const esArchiver = getService('esArchiver');
+  const logsUi = getService('logsUi');
+  const find = getService('find');
+  const logFilter = {
+    timeRange: {
+      from: DATES.metricsAndLogs.stream.startWithData,
+      to: DATES.metricsAndLogs.stream.endWithData,
+    },
+  };
+
+  describe('Log stream supports nano precision', function () {
+    before(async () => {
+      await esArchiver.load('x-pack/test/functional/es_archives/infra/logs_with_nano_date');
+    });
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/infra/logs_with_nano_date');
+    });
+
+    it('should display logs entries containing date_nano timestamps properly ', async () => {
+      await logsUi.logStreamPage.navigateTo({ logFilter });
+
+      const logStreamEntries = await logsUi.logStreamPage.getStreamEntries();
+
+      expect(logStreamEntries.length).to.be(4);
+    });
+
+    it('should render timestamp column properly', async () => {
+      await logsUi.logStreamPage.navigateTo({ logFilter });
+
+      await retry.try(async () => {
+        const columnHeaderLabels = await logsUi.logStreamPage.getColumnHeaderLabels();
+        expect(columnHeaderLabels[0]).to.eql('Oct 17, 2018');
+      });
+    });
+
+    it('should render timestamp column values properly', async () => {
+      await logsUi.logStreamPage.navigateTo({ logFilter });
+
+      const logStreamEntries = await logsUi.logStreamPage.getStreamEntries();
+
+      const firstLogStreamEntry = logStreamEntries[0];
+
+      const entryTimestamp = await logsUi.logStreamPage.getLogEntryColumnValueByName(
+        firstLogStreamEntry,
+        'timestampLogColumn'
+      );
+
+      expect(entryTimestamp).to.be('19:43:22.111');
+    });
+
+    it('should properly sync logPosition in url', async () => {
+      const currentUrl = await browser.getCurrentUrl();
+      const parsedUrl = new URL(currentUrl);
+
+      expect(parsedUrl.searchParams.get('logPosition')).to.contain(
+        `time:\'2018-10-17T19:46:22.333333333Z\'`
+      );
+    });
+
+    it('should properly render timestamp in flyout with nano precision', async () => {
+      await logsUi.logStreamPage.navigateTo({ logFilter });
+
+      const logStreamEntries = await logsUi.logStreamPage.getStreamEntries();
+      const firstLogStreamEntry = logStreamEntries[0];
+
+      await logsUi.logStreamPage.openLogEntryDetailsFlyout(firstLogStreamEntry);
+
+      const cells = await find.allByCssSelector('.euiTableCellContent');
+
+      let isFound = false;
+
+      for (const cell of cells) {
+        const cellText = await cell.getVisibleText();
+        if (cellText === '2018-10-17T19:43:22.111111111Z') {
+          isFound = true;
+          return;
+        }
+      }
+
+      expect(isFound).to.be(true);
+    });
+  });
+};
diff --git a/x-pack/test/functional/apps/infra/logs_source_configuration.ts b/x-pack/test/functional/apps/infra/logs/logs_source_configuration.ts
similarity index 98%
rename from x-pack/test/functional/apps/infra/logs_source_configuration.ts
rename to x-pack/test/functional/apps/infra/logs/logs_source_configuration.ts
index daf6296ed2c2c1..358095e4350b8e 100644
--- a/x-pack/test/functional/apps/infra/logs_source_configuration.ts
+++ b/x-pack/test/functional/apps/infra/logs/logs_source_configuration.ts
@@ -10,9 +10,9 @@ import {
   ELASTIC_HTTP_VERSION_HEADER,
   X_ELASTIC_INTERNAL_ORIGIN_REQUEST,
 } from '@kbn/core-http-common';
-import { DATES } from './constants';
+import { DATES } from '../constants';
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const COMMON_REQUEST_HEADERS = {
   'kbn-xsrf': 'some-xsrf-token',
diff --git a/x-pack/test/functional/apps/management/feature_controls/management_security.ts b/x-pack/test/functional/apps/management/feature_controls/management_security.ts
index d88e2fd8ebe7a4..37066494183460 100644
--- a/x-pack/test/functional/apps/management/feature_controls/management_security.ts
+++ b/x-pack/test/functional/apps/management/feature_controls/management_security.ts
@@ -36,7 +36,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       it('should not show the Stack Management nav link', async () => {
         const links = await appsMenu.readLinks();
-        expect(links.map((link) => link.text)).to.eql(['Dashboard']);
+        expect(links.map((link) => link.text)).to.eql(['Dashboards']);
       });
 
       it('should render the "application not found" view when navigating to management directly', async () => {
diff --git a/x-pack/test/functional/apps/maps/group1/full_screen_mode.js b/x-pack/test/functional/apps/maps/group1/full_screen_mode.js
index 2c87bb4df7c3c0..b0ed1311d439ae 100644
--- a/x-pack/test/functional/apps/maps/group1/full_screen_mode.js
+++ b/x-pack/test/functional/apps/maps/group1/full_screen_mode.js
@@ -11,6 +11,7 @@ export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['maps', 'common']);
   const retry = getService('retry');
   const security = getService('security');
+  const testSubjects = getService('testSubjects');
 
   describe('maps full screen mode', () => {
     before(async () => {
@@ -38,6 +39,10 @@ export default function ({ getService, getPageObjects }) {
       });
     });
 
+    it('layer control is visible', async () => {
+      expect(await testSubjects.isDisplayed('addLayerButton')).to.be(true);
+    });
+
     it('displays exit full screen logo button', async () => {
       const exists = await PageObjects.maps.exitFullScreenLogoButtonExists();
       expect(exists).to.be(true);
diff --git a/x-pack/test/functional/apps/observability_log_explorer/app.ts b/x-pack/test/functional/apps/observability_log_explorer/app.ts
index 26fb9b4e8d19e0..c60bf38205e3a7 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/app.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/app.ts
@@ -5,11 +5,14 @@
  * 2.0.
  */
 import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { log, timerange } from '@kbn/apm-synthtrace-client';
+import { FtrProviderContext } from './config';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'navigationalSearch', 'observabilityLogExplorer']);
   const testSubjects = getService('testSubjects');
+  const synthtrace = getService('logSynthtraceEsClient');
+  const dataGrid = getService('dataGrid');
 
   describe('Application', () => {
     it('is shown in the global search', async () => {
@@ -24,5 +27,32 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.observabilityLogExplorer.navigateTo();
       await testSubjects.existOrFail('observability-nav-observability-log-explorer-explorer');
     });
+
+    it('should load logs', async () => {
+      const from = '2023-08-03T10:24:14.035Z';
+      const to = '2023-08-03T10:24:14.091Z';
+      const COUNT = 5;
+      await synthtrace.index(generateLogsData({ from, to, count: COUNT }));
+      await PageObjects.observabilityLogExplorer.navigateTo();
+      const docCount = await dataGrid.getDocCount();
+
+      expect(docCount).to.be(COUNT);
+      await synthtrace.clean();
+    });
   });
 }
+
+function generateLogsData({ from, to, count = 1 }: { from: string; to: string; count: number }) {
+  const range = timerange(from, to);
+
+  return range
+    .interval('1m')
+    .rate(1)
+    .generator((timestamp) =>
+      Array(count)
+        .fill(0)
+        .map(() => {
+          return log.create().message('A sample log').timestamp(timestamp);
+        })
+    );
+}
diff --git a/x-pack/test/functional/apps/observability_log_explorer/columns_selection.ts b/x-pack/test/functional/apps/observability_log_explorer/columns_selection.ts
index 7738d3b97b2bc0..b23fd6813c0f6a 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/columns_selection.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/columns_selection.ts
@@ -6,7 +6,7 @@
  */
 import expect from '@kbn/expect';
 import rison from '@kbn/rison';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
 
 const defaultLogColumns = ['@timestamp', 'service.name', 'host.name', 'message'];
 
diff --git a/x-pack/test/functional/apps/observability_log_explorer/config.ts b/x-pack/test/functional/apps/observability_log_explorer/config.ts
index d0d07ff2002816..c94616d50e14bc 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/config.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/config.ts
@@ -5,13 +5,38 @@
  * 2.0.
  */
 
-import { FtrConfigProviderContext } from '@kbn/test';
+import { FtrConfigProviderContext, GenericFtrProviderContext } from '@kbn/test';
+import { createLogger, LogLevel, LogsSynthtraceEsClient } from '@kbn/apm-synthtrace';
+import { FtrProviderContext as InheritedFtrProviderContext } from '../../ftr_provider_context';
 
-export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+export default async function createTestConfig({ readConfigFile }: FtrConfigProviderContext) {
   const functionalConfig = await readConfigFile(require.resolve('../../config.base.js'));
+  const services = functionalConfig.get('services');
+  const pageObjects = functionalConfig.get('pageObjects');
 
   return {
     ...functionalConfig.getAll(),
     testFiles: [require.resolve('.')],
+    services: {
+      ...services,
+      logSynthtraceEsClient: (context: InheritedFtrProviderContext) => {
+        return new LogsSynthtraceEsClient({
+          client: context.getService('es'),
+          logger: createLogger(LogLevel.info),
+          refreshAfterIndex: true,
+        });
+      },
+    },
+    pageObjects,
   };
 }
+
+export type CreateTestConfig = Awaited<ReturnType<typeof createTestConfig>>;
+
+export type ObsLogExplorerServices = CreateTestConfig['services'];
+export type ObsLogExplorerPageObject = CreateTestConfig['pageObjects'];
+
+export type FtrProviderContext = GenericFtrProviderContext<
+  ObsLogExplorerServices,
+  ObsLogExplorerPageObject
+>;
diff --git a/x-pack/test/functional/apps/observability_log_explorer/dataset_selection_state.ts b/x-pack/test/functional/apps/observability_log_explorer/dataset_selection_state.ts
index e232b9df5f1c43..9fc2cca3125516 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/dataset_selection_state.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/dataset_selection_state.ts
@@ -6,7 +6,7 @@
  */
 import expect from '@kbn/expect';
 import rison from '@kbn/rison';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
diff --git a/x-pack/test/functional/apps/observability_log_explorer/dataset_selector.ts b/x-pack/test/functional/apps/observability_log_explorer/dataset_selector.ts
index 73426c990ec48a..d656301a138919 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/dataset_selector.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/dataset_selector.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
+import { WebElementWrapper } from '../../../../../test/functional/services/lib/web_element_wrapper';
 
 const initialPackageMap = {
   apache: 'Apache HTTP Server',
@@ -101,7 +102,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('should display an empty prompt for no integrations', async () => {
           const menuEntries = await PageObjects.observabilityLogExplorer
             .getIntegrationsContextMenu()
-            .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+            .then((menu: WebElementWrapper) =>
+              PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+            );
 
           expect(menuEntries.length).to.be(0);
           await PageObjects.observabilityLogExplorer.assertListStatusEmptyPromptExistsWithTitle(
@@ -161,7 +164,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
           const uncategorizedEntries = await PageObjects.observabilityLogExplorer
             .getUncategorizedContextMenu()
-            .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+            .then((menu: WebElementWrapper) =>
+              PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+            );
 
           expect(uncategorizedEntries.length).to.be(0);
 
@@ -313,7 +318,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
               const [panelTitleNode, integrationDatasetEntries] =
                 await PageObjects.observabilityLogExplorer
                   .getIntegrationsContextMenu()
-                  .then((menu) =>
+                  .then((menu: WebElementWrapper) =>
                     Promise.all([
                       PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                       PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -335,7 +340,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const panelTitleNode = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+                );
 
               expect(await panelTitleNode.getVisibleText()).to.be('Apache HTTP Server');
             });
@@ -345,7 +352,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(await menuEntries[0].getVisibleText()).to.be('access');
               expect(await menuEntries[1].getVisibleText()).to.be('error');
@@ -356,7 +365,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(await menuEntries[0].getVisibleText()).to.be('error');
               expect(await menuEntries[1].getVisibleText()).to.be('access');
@@ -367,7 +378,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(await menuEntries[0].getVisibleText()).to.be('access');
               expect(await menuEntries[1].getVisibleText()).to.be('error');
@@ -383,7 +396,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const panelTitleNode = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+                );
 
               expect(await panelTitleNode.getVisibleText()).to.be('Apache HTTP Server');
             });
@@ -391,7 +406,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(await menuEntries[0].getVisibleText()).to.be('access');
               expect(await menuEntries[1].getVisibleText()).to.be('error');
@@ -402,7 +419,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(menuEntries.length).to.be(1);
               expect(await menuEntries[0].getVisibleText()).to.be('error');
@@ -418,7 +437,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const panelTitleNode = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+                );
 
               expect(await panelTitleNode.getVisibleText()).to.be('Apache HTTP Server');
             });
@@ -426,7 +447,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
             await retry.try(async () => {
               const menuEntries = await PageObjects.observabilityLogExplorer
                 .getIntegrationsContextMenu()
-                .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+                .then((menu: WebElementWrapper) =>
+                  PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+                );
 
               expect(await menuEntries[0].getVisibleText()).to.be('access');
               menuEntries[0].click();
@@ -452,14 +475,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await PageObjects.observabilityLogExplorer.openDatasetSelector();
           await PageObjects.observabilityLogExplorer
             .getUncategorizedTab()
-            .then((tab) => tab.click());
+            .then((tab: WebElementWrapper) => tab.click());
         });
 
         it('should display a list of available datasets', async () => {
           await retry.try(async () => {
             const [panelTitleNode, menuEntries] = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) =>
+              .then((menu: WebElementWrapper) =>
                 Promise.all([
                   PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                   PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -477,7 +500,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(await panelTitleNode.getVisibleText()).to.be('Uncategorized');
           });
@@ -487,7 +512,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedUncategorized[0]);
             expect(await menuEntries[1].getVisibleText()).to.be(expectedUncategorized[1]);
@@ -499,7 +526,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedUncategorized[2]);
             expect(await menuEntries[1].getVisibleText()).to.be(expectedUncategorized[1]);
@@ -511,7 +540,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedUncategorized[0]);
             expect(await menuEntries[1].getVisibleText()).to.be(expectedUncategorized[1]);
@@ -523,7 +554,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(await panelTitleNode.getVisibleText()).to.be('Uncategorized');
           });
@@ -531,7 +564,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedUncategorized[0]);
             expect(await menuEntries[1].getVisibleText()).to.be(expectedUncategorized[1]);
@@ -543,7 +578,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(menuEntries.length).to.be(1);
             expect(await menuEntries[0].getVisibleText()).to.be('retail');
@@ -554,7 +591,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(await panelTitleNode.getVisibleText()).to.be('Uncategorized');
           });
@@ -562,7 +601,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getUncategorizedContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedUncategorized[0]);
             menuEntries[0].click();
@@ -585,14 +626,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         beforeEach(async () => {
           await browser.refresh();
           await PageObjects.observabilityLogExplorer.openDatasetSelector();
-          await PageObjects.observabilityLogExplorer.getDataViewsTab().then((tab) => tab.click());
+          await PageObjects.observabilityLogExplorer
+            .getDataViewsTab()
+            .then((tab: WebElementWrapper) => tab.click());
         });
 
         it('should display a list of available data views', async () => {
           await retry.try(async () => {
             const [panelTitleNode, menuEntries] = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) =>
+              .then((menu: WebElementWrapper) =>
                 Promise.all([
                   PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                   PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -614,7 +657,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(
               await PageObjects.observabilityLogExplorer.getDataViewsContextMenuTitle(
@@ -628,7 +673,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(sortedExpectedDataViews[2]);
             expect(await menuEntries[1].getVisibleText()).to.be(sortedExpectedDataViews[1]);
@@ -640,7 +687,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(sortedExpectedDataViews[0]);
             expect(await menuEntries[1].getVisibleText()).to.be(sortedExpectedDataViews[1]);
@@ -652,7 +701,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(
               await PageObjects.observabilityLogExplorer.getDataViewsContextMenuTitle(
@@ -664,7 +715,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[0].getVisibleText()).to.be(expectedDataViews[0]);
             expect(await menuEntries[1].getVisibleText()).to.be(expectedDataViews[1]);
@@ -676,7 +729,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(menuEntries.length).to.be(2);
             expect(await menuEntries[0].getVisibleText()).to.be('logs-*');
@@ -688,7 +743,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const panelTitleNode = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+              );
 
             expect(
               await PageObjects.observabilityLogExplorer.getDataViewsContextMenuTitle(
@@ -700,7 +757,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getDataViewsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(await menuEntries[2].getVisibleText()).to.be(expectedDataViews[2]);
             menuEntries[2].click();
@@ -733,7 +792,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const [panelTitleNode, menuEntries] = await PageObjects.observabilityLogExplorer
               .getIntegrationsContextMenu()
-              .then((menu) =>
+              .then((menu: WebElementWrapper) =>
                 Promise.all([
                   PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                   PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -751,7 +810,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const [panelTitleNode, menuEntries] = await PageObjects.observabilityLogExplorer
               .getIntegrationsContextMenu()
-              .then((menu) =>
+              .then((menu: WebElementWrapper) =>
                 Promise.all([
                   PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                   PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -803,7 +862,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const [panelTitleNode, menuEntries] = await PageObjects.observabilityLogExplorer
               .getIntegrationsContextMenu()
-              .then((menu) =>
+              .then((menu: WebElementWrapper) =>
                 Promise.all([
                   PageObjects.observabilityLogExplorer.getPanelTitle(menu),
                   PageObjects.observabilityLogExplorer.getPanelEntries(menu),
@@ -820,7 +879,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getIntegrationsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             expect(menuEntries.length).to.be(1);
             expect(await menuEntries[0].getVisibleText()).to.be('error');
@@ -829,7 +890,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           // Navigate back to integrations
           const panelTitleNode = await PageObjects.observabilityLogExplorer
             .getIntegrationsContextMenu()
-            .then((menu) => PageObjects.observabilityLogExplorer.getPanelTitle(menu));
+            .then((menu: WebElementWrapper) =>
+              PageObjects.observabilityLogExplorer.getPanelTitle(menu)
+            );
           panelTitleNode.click();
 
           await retry.try(async () => {
@@ -846,7 +909,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await retry.try(async () => {
             const menuEntries = await PageObjects.observabilityLogExplorer
               .getIntegrationsContextMenu()
-              .then((menu) => PageObjects.observabilityLogExplorer.getPanelEntries(menu));
+              .then((menu: WebElementWrapper) =>
+                PageObjects.observabilityLogExplorer.getPanelEntries(menu)
+              );
 
             const searchValue = await PageObjects.observabilityLogExplorer.getSearchFieldValue();
             expect(searchValue).to.eql('err');
diff --git a/x-pack/test/functional/apps/observability_log_explorer/filter_controls.ts b/x-pack/test/functional/apps/observability_log_explorer/filter_controls.ts
index db04f6251d9bc4..36087a23e8c4c2 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/filter_controls.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/filter_controls.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
diff --git a/x-pack/test/functional/apps/observability_log_explorer/flyout.ts b/x-pack/test/functional/apps/observability_log_explorer/flyout.ts
index f8277db16e8db8..b2b71c817255a3 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/flyout.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/flyout.ts
@@ -54,9 +54,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
-    after('clean up archives', async () => {
+    after('clean up DataStream', async () => {
       if (cleanupDataStreamSetup) {
-        cleanupDataStreamSetup();
+        await cleanupDataStreamSetup();
       }
     });
 
diff --git a/x-pack/test/functional/apps/observability_log_explorer/flyout_highlights.ts b/x-pack/test/functional/apps/observability_log_explorer/flyout_highlights.ts
new file mode 100644
index 00000000000000..3b71935cd6fbc5
--- /dev/null
+++ b/x-pack/test/functional/apps/observability_log_explorer/flyout_highlights.ts
@@ -0,0 +1,283 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+const DATASET_NAME = 'flyout';
+const NAMESPACE = 'default';
+const DATA_STREAM_NAME = `logs-${DATASET_NAME}-${NAMESPACE}`;
+const NOW = Date.now();
+
+const sharedDoc = {
+  time: NOW + 1000,
+  logFilepath: '/flyout.log',
+  serviceName: 'frontend-node',
+  datasetName: DATASET_NAME,
+  namespace: NAMESPACE,
+  message: 'full document',
+  logLevel: 'info',
+  traceId: 'abcdef',
+  hostName: 'gke-edge-oblt-pool',
+  orchestratorClusterId: 'my-cluster-id',
+  orchestratorClusterName: 'my-cluster-id',
+  orchestratorResourceId: 'orchestratorResourceId',
+  cloudProvider: 'gcp',
+  cloudRegion: 'us-central-1',
+  cloudAz: 'us-central-1a',
+  cloudProjectId: 'elastic-project',
+  cloudInstanceId: 'BgfderflkjTheUiGuy',
+  agentName: 'node',
+};
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dataGrid = getService('dataGrid');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['observabilityLogExplorer']);
+
+  describe('Flyout highlight customization', () => {
+    let cleanupDataStreamSetup: () => Promise<void>;
+
+    describe('Service container', () => {
+      const { serviceName, traceId, ...rest } = sharedDoc;
+      const docWithoutServiceName = { ...rest, traceId, time: NOW - 1000 };
+      const docWithoutTraceId = { ...rest, serviceName, time: NOW - 2000 };
+      const docWithoutServiceContainer = { ...rest, time: NOW - 4000 };
+
+      const docs = [
+        sharedDoc,
+        docWithoutServiceName,
+        docWithoutTraceId,
+        docWithoutServiceContainer,
+      ];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+      });
+
+      after('clean up DataStream', async () => {
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the service container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.existOrFail('logExplorerFlyoutService');
+        await testSubjects.existOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the service container even when 1 field is missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.missingOrFail('logExplorerFlyoutService');
+        await testSubjects.existOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the service container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 3 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.missingOrFail('logExplorerFlyoutService');
+        await testSubjects.missingOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Infrastructure container', () => {
+      const { hostName, orchestratorClusterName, orchestratorResourceId, ...rest } = sharedDoc;
+      const docWithoutHostName = {
+        ...rest,
+        orchestratorClusterName,
+        orchestratorResourceId,
+        time: NOW - 1000,
+      };
+      const docWithoutInfrastructureContainer = { ...rest, time: NOW - 2000 };
+
+      const docs = [sharedDoc, docWithoutHostName, docWithoutInfrastructureContainer];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+      });
+
+      after('clean up DataStream', async () => {
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the infrastructure container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.existOrFail('logExplorerFlyoutHostName');
+        await testSubjects.existOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.existOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the infrastructure container even when 1 field is missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.missingOrFail('logExplorerFlyoutHostName');
+        await testSubjects.existOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.existOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the infrastructure container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 2 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.missingOrFail('logExplorerFlyoutHostName');
+        await testSubjects.missingOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.missingOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Cloud container', () => {
+      const { cloudProvider, cloudInstanceId, cloudProjectId, cloudRegion, cloudAz, ...rest } =
+        sharedDoc;
+      const docWithoutCloudProviderAndInstanceId = {
+        ...rest,
+        cloudProjectId,
+        cloudRegion,
+        cloudAz,
+        time: NOW - 1000,
+      };
+      const docWithoutCloudContainer = { ...rest, time: NOW - 2000 };
+
+      const docs = [sharedDoc, docWithoutCloudProviderAndInstanceId, docWithoutCloudContainer];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+      });
+
+      after('clean up DataStream', async () => {
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the cloud container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionCloud');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProjectId');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudInstanceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the cloud container even when some fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionCloud');
+
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudInstanceId');
+
+        await testSubjects.existOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProjectId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the cloud container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 2 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionCloud');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProjectId');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudInstanceId');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Other container', () => {
+      const { logFilepath, agentName, ...rest } = sharedDoc;
+      const docWithoutLogPathAndAgentName = {
+        ...rest,
+        time: NOW - 1000,
+      };
+
+      const docs = [sharedDoc, docWithoutLogPathAndAgentName];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+      });
+
+      after('clean up DataStream', async () => {
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the other container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionOther');
+        await testSubjects.existOrFail('logExplorerFlyoutLogPathFile');
+        await testSubjects.existOrFail('logExplorerFlyoutNamespace');
+        await testSubjects.existOrFail('logExplorerFlyoutDataset');
+        await testSubjects.existOrFail('logExplorerFlyoutLogShipper');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the other container even when some fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionOther');
+
+        await testSubjects.missingOrFail('logExplorerFlyoutLogPathFile');
+        await testSubjects.missingOrFail('logExplorerFlyoutLogShipper');
+
+        await testSubjects.existOrFail('logExplorerFlyoutNamespace');
+        await testSubjects.existOrFail('logExplorerFlyoutDataset');
+        await dataGrid.closeFlyout();
+      });
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/observability_log_explorer/header_menu.ts b/x-pack/test/functional/apps/observability_log_explorer/header_menu.ts
index eb3c94b62403bf..f87edc5fc23a50 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/header_menu.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/header_menu.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
diff --git a/x-pack/test/functional/apps/observability_log_explorer/index.ts b/x-pack/test/functional/apps/observability_log_explorer/index.ts
index 948910dab6ab4e..c1114211b41a9e 100644
--- a/x-pack/test/functional/apps/observability_log_explorer/index.ts
+++ b/x-pack/test/functional/apps/observability_log_explorer/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../ftr_provider_context';
+import { FtrProviderContext } from './config';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('Observability Log Explorer', function () {
@@ -16,5 +16,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./filter_controls'));
     loadTestFile(require.resolve('./flyout'));
     loadTestFile(require.resolve('./header_menu'));
+    loadTestFile(require.resolve('./flyout_highlights.ts'));
   });
 }
diff --git a/x-pack/test/functional/apps/snapshot_restore/snapshot_restore.ts b/x-pack/test/functional/apps/snapshot_restore/snapshot_restore.ts
index a1a6bfe6276f52..279babade39ffe 100644
--- a/x-pack/test/functional/apps/snapshot_restore/snapshot_restore.ts
+++ b/x-pack/test/functional/apps/snapshot_restore/snapshot_restore.ts
@@ -38,7 +38,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       });
 
       // Wait for snapshot to be ready
-      await pageObjects.common.sleep(1000);
+      await pageObjects.common.sleep(2000);
 
       // Refresh page so that the snapshot shows up in the snapshots table
       await browser.refresh();
diff --git a/x-pack/test/functional/es_archives/infra/logs_with_nano_date/data.json.gz b/x-pack/test/functional/es_archives/infra/logs_with_nano_date/data.json.gz
new file mode 100644
index 00000000000000..68e1284e7d1307
Binary files /dev/null and b/x-pack/test/functional/es_archives/infra/logs_with_nano_date/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/infra/logs_with_nano_date/mappings.json b/x-pack/test/functional/es_archives/infra/logs_with_nano_date/mappings.json
new file mode 100644
index 00000000000000..294ee1f204e935
--- /dev/null
+++ b/x-pack/test/functional/es_archives/infra/logs_with_nano_date/mappings.json
@@ -0,0 +1,419 @@
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-gaming-activity",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-gaming-activity"
+      ],
+      "name": "logs-gaming-activity",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-gaming-events",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-gaming-events"
+      ],
+      "name": "logs-gaming-events",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-gaming-scores",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-gaming-scores"
+      ],
+      "name": "logs-gaming-scores",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-manufacturing-downtime",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-manufacturing-downtime"
+      ],
+      "name": "logs-manufacturing-downtime",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-manufacturing-output",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-manufacturing-output"
+      ],
+      "name": "logs-manufacturing-output",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-manufacturing-quality",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-manufacturing-quality"
+      ],
+      "name": "logs-manufacturing-quality",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-retail-customers",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-retail-customers"
+      ],
+      "name": "logs-retail-customers",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-retail-inventory",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-retail-inventory"
+      ],
+      "name": "logs-retail-inventory",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-retail-promotions",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-retail-promotions"
+      ],
+      "name": "logs-retail-promotions",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "data_stream",
+  "value": {
+    "data_stream": "logs-retail-sales",
+    "template": {
+      "_meta": {
+        "description": "Template for my time series data",
+        "my-custom-meta-field": "More arbitrary metadata"
+      },
+      "data_stream": {
+        "allow_custom_routing": false,
+        "hidden": false
+      },
+      "index_patterns": [
+        "logs-retail-sales"
+      ],
+      "name": "logs-retail-sales",
+      "priority": 500,
+      "template": {
+        "mappings": {
+          "properties": {
+            "@timestamp": {
+              "format": "strict_date_optional_time_nanos",
+              "type": "date_nanos"
+            },
+            "data_stream": {
+              "properties": {
+                "namespace": {
+                  "type": "constant_keyword"
+                }
+              }
+            },
+            "message": {
+              "type": "wildcard"
+            }
+          }
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/rule_keyword_family/const_keyword/mappings.json b/x-pack/test/functional/es_archives/rule_keyword_family/const_keyword/mappings.json
index 7e3d74f8401420..8622a0f62cd5ad 100644
--- a/x-pack/test/functional/es_archives/rule_keyword_family/const_keyword/mappings.json
+++ b/x-pack/test/functional/es_archives/rule_keyword_family/const_keyword/mappings.json
@@ -39,7 +39,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/rule_keyword_family/keyword/mappings.json b/x-pack/test/functional/es_archives/rule_keyword_family/keyword/mappings.json
index 9d5274a0022790..233b1148f04b4b 100644
--- a/x-pack/test/functional/es_archives/rule_keyword_family/keyword/mappings.json
+++ b/x-pack/test/functional/es_archives/rule_keyword_family/keyword/mappings.json
@@ -25,7 +25,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/data.json b/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/data.json
new file mode 100644
index 00000000000000..dc677dd5bf812a
--- /dev/null
+++ b/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/data.json
@@ -0,0 +1,422 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "eabbdefc23da981f2b74ab58b82622a97bb9878caa11bc914e2adfacc94780f1",
+    "index": ".alerts-security.alerts-default",
+    "source": {
+      "@timestamp": "2023-04-27T11:03:57.906Z",
+      "Endpoint": {
+        "capabilities": [
+          "isolation",
+          "kill_process",
+          "suspend_process",
+          "running_processes",
+          "get_file",
+          "execute"
+        ],
+        "configuration": {
+          "isolation": true
+        },
+        "policy": {
+          "applied": {
+            "endpoint_policy_version": 3,
+            "id": "C2A9093E-E289-4C0A-AA44-8C32A414FA7A",
+            "name": "With Eventing",
+            "status": "success",
+            "version": 5
+          }
+        },
+        "state": {
+          "isolation": true
+        },
+        "status": "enrolled"
+      },
+      "agent": {
+        "id": "b563ce99-e373-4a1f-a5fe-97e956140aeb",
+        "type": "endpoint",
+        "version": "8.8.0"
+      },
+      "data_stream": {
+        "dataset": "endpoint.alerts",
+        "namespace": "default",
+        "type": "logs"
+      },
+      "dll": [
+        {
+          "Ext": {
+            "compile_time": 1534424710,
+            "malware_classification": {
+              "identifier": "Whitelisted",
+              "score": 0,
+              "threshold": 0,
+              "version": "3.0.0"
+            },
+            "mapped_address": 5362483200,
+            "mapped_size": 0
+          },
+          "code_signature": {
+            "subject_name": "Cybereason Inc",
+            "trusted": true
+          },
+          "hash": {
+            "md5": "1f2d082566b0fc5f2c238a5180db7451",
+            "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
+            "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2"
+          },
+          "path": "C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe",
+          "pe": {
+            "architecture": "x64"
+          }
+        }
+      ],
+      "ecs": {
+        "version": "1.4.0"
+      },
+      "elastic": {
+        "agent": {
+          "id": "b563ce99-e373-4a1f-a5fe-97e956140aeb"
+        }
+      },
+      "event.action": "creation",
+      "event.agent_id_status": "auth_metadata_missing",
+      "event.category": "malware",
+      "event.code": "malicious_file",
+      "event.dataset": "endpoint",
+      "event.id": "b28993d4-8b8a-4f0f-9f54-84a89bad66ae",
+      "event.ingested": "2023-04-27T10:58:03Z",
+      "event.kind": "signal",
+      "event.module": "endpoint",
+      "event.sequence": 5826,
+      "event.type": "creation",
+      "file": {
+        "Ext": {
+          "code_signature": [
+            {
+              "subject_name": "bad signer",
+              "trusted": false
+            }
+          ],
+          "malware_classification": {
+            "identifier": "endpointpe",
+            "score": 1,
+            "threshold": 0.66,
+            "version": "3.0.33"
+          },
+          "quarantine_message": "fake quarantine message",
+          "quarantine_result": true,
+          "temp_file_path": "C:/temp/fake_malware.exe"
+        },
+        "accessed": 1682752652103,
+        "created": 1682752652103,
+        "hash": {
+          "md5": "fake file md5",
+          "sha1": "fake file sha1",
+          "sha256": "fake file sha256"
+        },
+        "mtime": 1682752652103,
+        "name": "fake_malware.exe",
+        "owner": "SYSTEM",
+        "path": "C:/fake_malware.exe",
+        "size": 3456
+      },
+      "user": {
+        "name": "user1"
+      },
+      "host": {
+        "architecture": "wtnozeqvub",
+        "hostname": "Host-fwarau82er",
+        "id": "4260adf9-5e63-445d-92c6-e03359bcd342",
+        "ip": [
+          "10.249.37.72",
+          "10.150.39.243",
+          "10.186.17.170"
+        ],
+        "mac": [
+          "f5-f-97-dc-20-67",
+          "b5-56-ca-98-81-ca",
+          "22-86-39-4c-87-33"
+        ],
+        "name": "Host-fwarau82er",
+        "os": {
+          "Ext": {
+            "variant": "Darwin"
+          },
+          "family": "Darwin",
+          "full": "macOS Monterey",
+          "name": "macOS",
+          "platform": "macOS",
+          "version": "12.6.1"
+        }
+      },
+      "kibana.alert.ancestors": [
+        {
+          "depth": 0,
+          "id": "vT9cwocBh3b8EMpD8lsi",
+          "index": ".ds-logs-endpoint.alerts-default-2023.04.27-000001",
+          "type": "event"
+        }
+      ],
+      "kibana.alert.depth": 1,
+      "kibana.alert.last_detected": "2023-04-27T11:03:57.993Z",
+      "kibana.alert.original_event.action": "creation",
+      "kibana.alert.original_event.agent_id_status": "auth_metadata_missing",
+      "kibana.alert.original_event.category": "malware",
+      "kibana.alert.original_event.code": "malicious_file",
+      "kibana.alert.original_event.dataset": "endpoint",
+      "kibana.alert.original_event.id": "b28993d4-8b8a-4f0f-9f54-84a89bad66ae",
+      "kibana.alert.original_event.ingested": "2023-04-27T10:58:03Z",
+      "kibana.alert.original_event.kind": "alert",
+      "kibana.alert.original_event.module": "endpoint",
+      "kibana.alert.original_event.sequence": 5826,
+      "kibana.alert.original_event.type": "creation",
+      "kibana.alert.original_time": "2023-04-29T07:17:32.103Z",
+      "kibana.alert.reason": "malware event with process malware writer, file fake_malware.exe, on Host-fwarau82er created medium alert Endpoint Security.",
+      "kibana.alert.risk_score": 47,
+      "kibana.alert.rule.actions": [
+      ],
+      "kibana.alert.rule.author": [
+        "Elastic"
+      ],
+      "kibana.alert.rule.category": "Custom Query Rule",
+      "kibana.alert.rule.consumer": "siem",
+      "kibana.alert.rule.created_at": "2023-04-27T10:58:27.546Z",
+      "kibana.alert.rule.created_by": "elastic",
+      "kibana.alert.rule.description": "Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.",
+      "kibana.alert.rule.enabled": true,
+      "kibana.alert.rule.exceptions_list": [
+        {
+          "id": "endpoint_list",
+          "list_id": "endpoint_list",
+          "namespace_type": "agnostic",
+          "type": "endpoint"
+        }
+      ],
+      "kibana.alert.rule.execution.uuid": "ebf843ff-e0e1-47f8-9ed2-cc8066afbcef",
+      "kibana.alert.rule.false_positives": [
+      ],
+      "kibana.alert.rule.from": "now-10m",
+      "kibana.alert.rule.immutable": true,
+      "kibana.alert.rule.indices": [
+        "logs-endpoint.alerts-*"
+      ],
+      "kibana.alert.rule.interval": "5m",
+      "kibana.alert.rule.license": "Elastic License v2",
+      "kibana.alert.rule.max_signals": 10000,
+      "kibana.alert.rule.name": "Endpoint Security",
+      "kibana.alert.rule.parameters": {
+        "author": [
+          "Elastic"
+        ],
+        "description": "Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.",
+        "exceptions_list": [
+          {
+            "id": "endpoint_list",
+            "list_id": "endpoint_list",
+            "namespace_type": "agnostic",
+            "type": "endpoint"
+          }
+        ],
+        "false_positives": [
+        ],
+        "from": "now-10m",
+        "immutable": true,
+        "index": [
+          "logs-endpoint.alerts-*"
+        ],
+        "language": "kuery",
+        "license": "Elastic License v2",
+        "max_signals": 10000,
+        "query": "event.kind:alert and event.module:(endpoint and not endgame)\n",
+        "references": [
+        ],
+        "related_integrations": [
+          {
+            "package": "endpoint",
+            "version": "^8.2.0"
+          }
+        ],
+        "required_fields": [
+          {
+            "ecs": true,
+            "name": "event.kind",
+            "type": "keyword"
+          },
+          {
+            "ecs": true,
+            "name": "event.module",
+            "type": "keyword"
+          }
+        ],
+        "risk_score": 47,
+        "risk_score_mapping": [
+          {
+            "field": "event.risk_score",
+            "operator": "equals",
+            "value": ""
+          }
+        ],
+        "rule_id": "9a1a2dae-0b5f-4c3d-8305-a268d404c306",
+        "rule_name_override": "message",
+        "setup": "",
+        "severity": "medium",
+        "severity_mapping": [
+          {
+            "field": "event.severity",
+            "operator": "equals",
+            "severity": "low",
+            "value": "21"
+          },
+          {
+            "field": "event.severity",
+            "operator": "equals",
+            "severity": "medium",
+            "value": "47"
+          },
+          {
+            "field": "event.severity",
+            "operator": "equals",
+            "severity": "high",
+            "value": "73"
+          },
+          {
+            "field": "event.severity",
+            "operator": "equals",
+            "severity": "critical",
+            "value": "99"
+          }
+        ],
+        "threat": [
+        ],
+        "timestamp_override": "event.ingested",
+        "to": "now",
+        "type": "query",
+        "version": 101
+      },
+      "kibana.alert.rule.producer": "siem",
+      "kibana.alert.rule.references": [
+      ],
+      "kibana.alert.rule.revision": 0,
+      "kibana.alert.rule.risk_score": 47,
+      "kibana.alert.rule.risk_score_mapping": [
+        {
+          "field": "event.risk_score",
+          "operator": "equals",
+          "value": ""
+        }
+      ],
+      "kibana.alert.rule.rule_id": "9a1a2dae-0b5f-4c3d-8305-a268d404c306",
+      "kibana.alert.rule.rule_name_override": "message",
+      "kibana.alert.rule.rule_type_id": "siem.queryRule",
+      "kibana.alert.rule.severity": "medium",
+      "kibana.alert.rule.severity_mapping": [
+        {
+          "field": "event.severity",
+          "operator": "equals",
+          "severity": "low",
+          "value": "21"
+        },
+        {
+          "field": "event.severity",
+          "operator": "equals",
+          "severity": "medium",
+          "value": "47"
+        },
+        {
+          "field": "event.severity",
+          "operator": "equals",
+          "severity": "high",
+          "value": "73"
+        },
+        {
+          "field": "event.severity",
+          "operator": "equals",
+          "severity": "critical",
+          "value": "99"
+        }
+      ],
+      "kibana.alert.rule.tags": [
+        "Elastic",
+        "Endpoint Security"
+      ],
+      "kibana.alert.rule.threat": [
+      ],
+      "kibana.alert.rule.timestamp_override": "event.ingested",
+      "kibana.alert.rule.to": "now",
+      "kibana.alert.rule.type": "query",
+      "kibana.alert.rule.updated_at": "2023-04-27T10:58:27.546Z",
+      "kibana.alert.rule.updated_by": "elastic",
+      "kibana.alert.rule.uuid": "7015a3e2-e4ea-11ed-8c11-49608884878f",
+      "kibana.alert.rule.version": 101,
+      "kibana.alert.severity": "medium",
+      "kibana.alert.start": "2023-04-27T11:03:57.993Z",
+      "kibana.alert.status": "active",
+      "kibana.alert.url": "http://localhost:5601/app/security/alerts/redirect/eabbdefc23da981f2b74ab58b82622a97bb9878caa11bc914e2adfacc94780f1?index=.alerts-security.alerts-default&timestamp=2023-04-27T11:03:57.906Z",
+      "kibana.alert.uuid": "eabbdefc23da981f2b74ab58b82622a97bb9878caa11bc914e2adfacc94780f1",
+      "kibana.alert.workflow_status": "open",
+      "kibana.space_ids": [
+        "default"
+      ],
+      "kibana.version": "8.8.0",
+      "process": {
+        "Ext": {
+          "ancestry": [
+            "qa5jgw1wr7",
+            "5k1hclygc6"
+          ],
+          "code_signature": [
+            {
+              "subject_name": "bad signer",
+              "trusted": false
+            }
+          ],
+          "token": {
+            "domain": "NT AUTHORITY",
+            "integrity_level": 16384,
+            "integrity_level_name": "system",
+            "privileges": [
+              {
+                "description": "Replace a process level token",
+                "enabled": false,
+                "name": "SeAssignPrimaryTokenPrivilege"
+              }
+            ],
+            "sid": "S-1-5-18",
+            "type": "tokenPrimary",
+            "user": "SYSTEM"
+          },
+          "user": "SYSTEM"
+        },
+        "entity_id": "nqh8ts6ves",
+        "entry_leader": {
+          "entity_id": "jnm38bel0w",
+          "name": "fake entry",
+          "pid": 791
+        },
+        "executable": "C:/malware.exe",
+        "group_leader": {
+          "entity_id": "jnm38bel0w",
+          "name": "fake leader",
+          "pid": 848
+        },
+        "hash": {
+          "md5": "fake md5",
+          "sha1": "fake sha1",
+          "sha256": "fake sha256"
+        },
+        "name": "malware writer",
+        "parent": {
+          "entity_id": "qa5jgw1wr7",
+          "pid": 1
+        },
+        "pid": 2,
+        "session_leader": {
+          "entity_id": "jnm38bel0w",
+          "name": "fake session",
+          "pid": 909
+        },
+        "start": 1682752652103,
+        "uptime": 0
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/mappings.json b/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/mappings.json
new file mode 100644
index 00000000000000..f5a6e53cc4d603
--- /dev/null
+++ b/x-pack/test/functional/es_archives/security_solution/alerts/8.8.0/mappings.json
@@ -0,0 +1,7900 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".alerts-security.alerts-default": {
+        "is_write_index": true
+      },
+      ".siem-signals-default": {
+        "is_write_index": false
+      }
+    },
+    "index": ".internal.alerts-security.alerts-default-000001",
+    "mappings": {
+      "_meta": {
+        "kibana": {
+          "version": "8.8.0"
+        },
+        "managed": true,
+        "namespace": "default"
+      },
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "build": {
+              "properties": {
+                "original": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subdomain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "origin": {
+              "properties": {
+                "account": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "availability_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "instance": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "machine": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "project": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "provider": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "service": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "target": {
+              "properties": {
+                "account": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "availability_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "instance": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "machine": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "project": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "provider": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "service": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "usage": {
+                  "scaling_factor": 1000,
+                  "type": "scaled_float"
+                }
+              }
+            },
+            "disk": {
+              "properties": {
+                "read": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "write": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "hash": {
+                  "properties": {
+                    "all": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "memory": {
+              "properties": {
+                "usage": {
+                  "scaling_factor": 1000,
+                  "type": "scaled_float"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "network": {
+              "properties": {
+                "egress": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "ingress": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subdomain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "device": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "manufacturer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "model": {
+              "properties": {
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "digest_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exists": {
+                  "type": "boolean"
+                },
+                "signing_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "team_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "date"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ssdeep": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tlsh": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pehash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "email": {
+          "properties": {
+            "attachments": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "extension": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "hash": {
+                      "properties": {
+                        "md5": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha1": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha256": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha384": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha512": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ssdeep": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "tlsh": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "mime_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "bcc": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "cc": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "content_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery_timestamp": {
+              "type": "date"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "from": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "local_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message_id": {
+              "type": "wildcard"
+            },
+            "origination_timestamp": {
+              "type": "date"
+            },
+            "reply_to": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "sender": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "subject": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "to": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "x_mailer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "type": "match_only_text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "type": "wildcard"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "agent_id_status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reason": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "faas": {
+          "properties": {
+            "coldstart": {
+              "type": "boolean"
+            },
+            "execution": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trigger": {
+              "properties": {
+                "request_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "digest_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exists": {
+                  "type": "boolean"
+                },
+                "signing_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "team_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "date"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "elf": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "byte_order": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cpu_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "creation_date": {
+                  "type": "date"
+                },
+                "exports": {
+                  "type": "flattened"
+                },
+                "header": {
+                  "properties": {
+                    "abi_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "data": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "entrypoint": {
+                      "type": "long"
+                    },
+                    "object_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "os_abi": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "imports": {
+                  "type": "flattened"
+                },
+                "sections": {
+                  "properties": {
+                    "chi2": {
+                      "type": "long"
+                    },
+                    "entropy": {
+                      "type": "long"
+                    },
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "physical_offset": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "physical_size": {
+                      "type": "long"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "virtual_address": {
+                      "type": "long"
+                    },
+                    "virtual_size": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "segments": {
+                  "properties": {
+                    "sections": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "shared_libraries": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "telfhash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fork_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ssdeep": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tlsh": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pehash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "x509": {
+              "properties": {
+                "alternative_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "distinguished_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "state_or_province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "public_key_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_curve": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_exponent": {
+                  "type": "long"
+                },
+                "public_key_size": {
+                  "type": "long"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "distinguished_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "state_or_province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "boot": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "usage": {
+                  "scaling_factor": 1000,
+                  "type": "scaled_float"
+                }
+              }
+            },
+            "disk": {
+              "properties": {
+                "read": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "write": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "network": {
+              "properties": {
+                "egress": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "packets": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "ingress": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "packets": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pid_ns_ino": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk": {
+              "properties": {
+                "calculated_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calculated_score": {
+                  "type": "float"
+                },
+                "calculated_score_norm": {
+                  "type": "float"
+                },
+                "static_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "static_score": {
+                  "type": "float"
+                },
+                "static_score_norm": {
+                  "type": "float"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "type": "wildcard"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mime_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "type": "wildcard"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "mime_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "alert": {
+              "properties": {
+                "action_group": {
+                  "type": "keyword"
+                },
+                "ancestors": {
+                  "properties": {
+                    "depth": {
+                      "type": "long"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "rule": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "building_block_type": {
+                  "type": "keyword"
+                },
+                "case_ids": {
+                  "type": "keyword"
+                },
+                "depth": {
+                  "type": "long"
+                },
+                "duration": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "end": {
+                  "type": "date"
+                },
+                "flapping": {
+                  "type": "boolean"
+                },
+                "flapping_history": {
+                  "type": "boolean"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "index": {
+                      "type": "integer"
+                    }
+                  }
+                },
+                "instance": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "last_detected": {
+                  "type": "date"
+                },
+                "maintenance_window_ids": {
+                  "type": "keyword"
+                },
+                "new_terms": {
+                  "type": "keyword"
+                },
+                "original_event": {
+                  "properties": {
+                    "action": {
+                      "type": "keyword"
+                    },
+                    "agent_id_status": {
+                      "type": "keyword"
+                    },
+                    "category": {
+                      "type": "keyword"
+                    },
+                    "code": {
+                      "type": "keyword"
+                    },
+                    "created": {
+                      "type": "date"
+                    },
+                    "dataset": {
+                      "type": "keyword"
+                    },
+                    "duration": {
+                      "type": "keyword"
+                    },
+                    "end": {
+                      "type": "date"
+                    },
+                    "hash": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "ingested": {
+                      "type": "date"
+                    },
+                    "kind": {
+                      "type": "keyword"
+                    },
+                    "module": {
+                      "type": "keyword"
+                    },
+                    "original": {
+                      "type": "keyword"
+                    },
+                    "outcome": {
+                      "type": "keyword"
+                    },
+                    "provider": {
+                      "type": "keyword"
+                    },
+                    "reason": {
+                      "type": "keyword"
+                    },
+                    "reference": {
+                      "type": "keyword"
+                    },
+                    "risk_score": {
+                      "type": "float"
+                    },
+                    "risk_score_norm": {
+                      "type": "float"
+                    },
+                    "sequence": {
+                      "type": "long"
+                    },
+                    "severity": {
+                      "type": "long"
+                    },
+                    "start": {
+                      "type": "date"
+                    },
+                    "timezone": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "url": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "original_time": {
+                  "type": "date"
+                },
+                "reason": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "float"
+                },
+                "rule": {
+                  "properties": {
+                    "author": {
+                      "type": "keyword"
+                    },
+                    "building_block_type": {
+                      "type": "keyword"
+                    },
+                    "category": {
+                      "type": "keyword"
+                    },
+                    "consumer": {
+                      "type": "keyword"
+                    },
+                    "created_at": {
+                      "type": "date"
+                    },
+                    "created_by": {
+                      "type": "keyword"
+                    },
+                    "description": {
+                      "type": "keyword"
+                    },
+                    "enabled": {
+                      "type": "keyword"
+                    },
+                    "exceptions_list": {
+                      "type": "object"
+                    },
+                    "execution": {
+                      "properties": {
+                        "uuid": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "false_positives": {
+                      "type": "keyword"
+                    },
+                    "from": {
+                      "type": "keyword"
+                    },
+                    "immutable": {
+                      "type": "keyword"
+                    },
+                    "interval": {
+                      "type": "keyword"
+                    },
+                    "license": {
+                      "type": "keyword"
+                    },
+                    "max_signals": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "type": "keyword"
+                    },
+                    "note": {
+                      "type": "keyword"
+                    },
+                    "parameters": {
+                      "ignore_above": 4096,
+                      "type": "flattened"
+                    },
+                    "producer": {
+                      "type": "keyword"
+                    },
+                    "references": {
+                      "type": "keyword"
+                    },
+                    "revision": {
+                      "type": "long"
+                    },
+                    "rule_id": {
+                      "type": "keyword"
+                    },
+                    "rule_name_override": {
+                      "type": "keyword"
+                    },
+                    "rule_type_id": {
+                      "type": "keyword"
+                    },
+                    "tags": {
+                      "type": "keyword"
+                    },
+                    "threat": {
+                      "properties": {
+                        "framework": {
+                          "type": "keyword"
+                        },
+                        "tactic": {
+                          "properties": {
+                            "id": {
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "type": "keyword"
+                            },
+                            "reference": {
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "technique": {
+                          "properties": {
+                            "id": {
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "type": "keyword"
+                            },
+                            "reference": {
+                              "type": "keyword"
+                            },
+                            "subtechnique": {
+                              "properties": {
+                                "id": {
+                                  "type": "keyword"
+                                },
+                                "name": {
+                                  "type": "keyword"
+                                },
+                                "reference": {
+                                  "type": "keyword"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "timeline_id": {
+                      "type": "keyword"
+                    },
+                    "timeline_title": {
+                      "type": "keyword"
+                    },
+                    "timestamp_override": {
+                      "type": "keyword"
+                    },
+                    "to": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "updated_at": {
+                      "type": "date"
+                    },
+                    "updated_by": {
+                      "type": "keyword"
+                    },
+                    "uuid": {
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "severity": {
+                  "type": "keyword"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "status": {
+                  "type": "keyword"
+                },
+                "suppression": {
+                  "properties": {
+                    "docs_count": {
+                      "type": "long"
+                    },
+                    "end": {
+                      "type": "date"
+                    },
+                    "start": {
+                      "type": "date"
+                    },
+                    "terms": {
+                      "properties": {
+                        "field": {
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "system_status": {
+                  "type": "keyword"
+                },
+                "threshold_result": {
+                  "properties": {
+                    "cardinality": {
+                      "properties": {
+                        "field": {
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "count": {
+                      "type": "long"
+                    },
+                    "from": {
+                      "type": "date"
+                    },
+                    "terms": {
+                      "properties": {
+                        "field": {
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "time_range": {
+                  "format": "epoch_millis||strict_date_optional_time",
+                  "type": "date_range"
+                },
+                "url": {
+                  "ignore_above": 2048,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "type": "keyword"
+                },
+                "workflow_reason": {
+                  "type": "keyword"
+                },
+                "workflow_status": {
+                  "type": "keyword"
+                },
+                "workflow_user": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "space_ids": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "version"
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "file": {
+              "properties": {
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "syslog": {
+              "properties": {
+                "appname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "msgid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "procid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "structured_data": {
+                  "type": "flattened"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "type": "match_only_text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "orchestrator": {
+          "properties": {
+            "api_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "cluster": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "url": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "organization": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resource": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip": {
+                  "type": "ip"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "digest_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exists": {
+                  "type": "boolean"
+                },
+                "signing_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "team_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "date"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "type": "wildcard"
+            },
+            "elf": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "byte_order": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cpu_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "creation_date": {
+                  "type": "date"
+                },
+                "exports": {
+                  "type": "flattened"
+                },
+                "header": {
+                  "properties": {
+                    "abi_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "data": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "entrypoint": {
+                      "type": "long"
+                    },
+                    "object_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "os_abi": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "imports": {
+                  "type": "flattened"
+                },
+                "sections": {
+                  "properties": {
+                    "chi2": {
+                      "type": "long"
+                    },
+                    "entropy": {
+                      "type": "long"
+                    },
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "physical_offset": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "physical_size": {
+                      "type": "long"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "virtual_address": {
+                      "type": "long"
+                    },
+                    "virtual_size": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "segments": {
+                  "properties": {
+                    "sections": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "shared_libraries": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "telfhash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "end": {
+              "type": "date"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entry_leader": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "attested_groups": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "attested_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "type": "wildcard"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entry_meta": {
+                  "properties": {
+                    "source": {
+                      "properties": {
+                        "ip": {
+                          "type": "ip"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "interactive": {
+                  "type": "boolean"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "properties": {
+                    "entity_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pid": {
+                      "type": "long"
+                    },
+                    "session_leader": {
+                      "properties": {
+                        "entity_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "pid": {
+                          "type": "long"
+                        },
+                        "start": {
+                          "type": "date"
+                        }
+                      }
+                    },
+                    "start": {
+                      "type": "date"
+                    }
+                  }
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "real_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "real_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "same_as_process": {
+                  "type": "boolean"
+                },
+                "saved_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "saved_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "start": {
+                  "type": "date"
+                },
+                "supplemental_groups": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tty": {
+                  "properties": {
+                    "char_device": {
+                      "properties": {
+                        "major": {
+                          "type": "long"
+                        },
+                        "minor": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "env_vars": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "group_leader": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "type": "wildcard"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "interactive": {
+                  "type": "boolean"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "real_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "real_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "same_as_process": {
+                  "type": "boolean"
+                },
+                "saved_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "saved_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "start": {
+                  "type": "date"
+                },
+                "supplemental_groups": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tty": {
+                  "properties": {
+                    "char_device": {
+                      "properties": {
+                        "major": {
+                          "type": "long"
+                        },
+                        "minor": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ssdeep": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tlsh": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "interactive": {
+              "type": "boolean"
+            },
+            "io": {
+              "properties": {
+                "bytes_skipped": {
+                  "properties": {
+                    "length": {
+                      "type": "long"
+                    },
+                    "offset": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "max_bytes_per_process_exceeded": {
+                  "type": "boolean"
+                },
+                "text": {
+                  "type": "wildcard"
+                },
+                "total_bytes_captured": {
+                  "type": "long"
+                },
+                "total_bytes_skipped": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "digest_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "signing_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "team_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timestamp": {
+                      "type": "date"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "type": "wildcard"
+                },
+                "elf": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "byte_order": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "cpu_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "creation_date": {
+                      "type": "date"
+                    },
+                    "exports": {
+                      "type": "flattened"
+                    },
+                    "header": {
+                      "properties": {
+                        "abi_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "class": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "data": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "entrypoint": {
+                          "type": "long"
+                        },
+                        "object_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "os_abi": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "imports": {
+                      "type": "flattened"
+                    },
+                    "sections": {
+                      "properties": {
+                        "chi2": {
+                          "type": "long"
+                        },
+                        "entropy": {
+                          "type": "long"
+                        },
+                        "flags": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "physical_offset": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "physical_size": {
+                          "type": "long"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "virtual_address": {
+                          "type": "long"
+                        },
+                        "virtual_size": {
+                          "type": "long"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "segments": {
+                      "properties": {
+                        "sections": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "shared_libraries": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "telfhash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "end": {
+                  "type": "date"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "group_leader": {
+                  "properties": {
+                    "entity_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pid": {
+                      "type": "long"
+                    },
+                    "start": {
+                      "type": "date"
+                    }
+                  }
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha384": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ssdeep": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tlsh": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "interactive": {
+                  "type": "boolean"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pe": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "company": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "description": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "file_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "original_file_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pehash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "product": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "real_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "real_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "saved_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "saved_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "start": {
+                  "type": "date"
+                },
+                "supplemental_groups": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tty": {
+                  "properties": {
+                    "char_device": {
+                      "properties": {
+                        "major": {
+                          "type": "long"
+                        },
+                        "minor": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pehash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "previous": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "real_group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "real_user": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved_group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved_user": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "session_leader": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "type": "wildcard"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "interactive": {
+                  "type": "boolean"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "properties": {
+                    "entity_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pid": {
+                      "type": "long"
+                    },
+                    "session_leader": {
+                      "properties": {
+                        "entity_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "pid": {
+                          "type": "long"
+                        },
+                        "start": {
+                          "type": "date"
+                        }
+                      }
+                    },
+                    "start": {
+                      "type": "date"
+                    }
+                  }
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "real_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "real_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "same_as_process": {
+                  "type": "boolean"
+                },
+                "saved_group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "saved_user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "start": {
+                  "type": "date"
+                },
+                "supplemental_groups": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tty": {
+                  "properties": {
+                    "char_device": {
+                      "properties": {
+                        "major": {
+                          "type": "long"
+                        },
+                        "minor": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "start": {
+              "type": "date"
+            },
+            "supplemental_groups": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tty": {
+              "properties": {
+                "char_device": {
+                  "properties": {
+                    "major": {
+                      "type": "long"
+                    },
+                    "minor": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "columns": {
+                  "type": "long"
+                },
+                "rows": {
+                  "type": "long"
+                }
+              }
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "type": "wildcard"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hosts": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subdomain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "origin": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "environment": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ephemeral_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "node": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "role": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "target": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "environment": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ephemeral_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "node": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "role": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "signal": {
+          "properties": {
+            "ancestors": {
+              "properties": {
+                "depth": {
+                  "path": "kibana.alert.ancestors.depth",
+                  "type": "alias"
+                },
+                "id": {
+                  "path": "kibana.alert.ancestors.id",
+                  "type": "alias"
+                },
+                "index": {
+                  "path": "kibana.alert.ancestors.index",
+                  "type": "alias"
+                },
+                "type": {
+                  "path": "kibana.alert.ancestors.type",
+                  "type": "alias"
+                }
+              }
+            },
+            "depth": {
+              "path": "kibana.alert.depth",
+              "type": "alias"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "path": "kibana.alert.group.id",
+                  "type": "alias"
+                },
+                "index": {
+                  "path": "kibana.alert.group.index",
+                  "type": "alias"
+                }
+              }
+            },
+            "original_event": {
+              "properties": {
+                "action": {
+                  "path": "kibana.alert.original_event.action",
+                  "type": "alias"
+                },
+                "category": {
+                  "path": "kibana.alert.original_event.category",
+                  "type": "alias"
+                },
+                "code": {
+                  "path": "kibana.alert.original_event.code",
+                  "type": "alias"
+                },
+                "created": {
+                  "path": "kibana.alert.original_event.created",
+                  "type": "alias"
+                },
+                "dataset": {
+                  "path": "kibana.alert.original_event.dataset",
+                  "type": "alias"
+                },
+                "duration": {
+                  "path": "kibana.alert.original_event.duration",
+                  "type": "alias"
+                },
+                "end": {
+                  "path": "kibana.alert.original_event.end",
+                  "type": "alias"
+                },
+                "hash": {
+                  "path": "kibana.alert.original_event.hash",
+                  "type": "alias"
+                },
+                "id": {
+                  "path": "kibana.alert.original_event.id",
+                  "type": "alias"
+                },
+                "kind": {
+                  "path": "kibana.alert.original_event.kind",
+                  "type": "alias"
+                },
+                "module": {
+                  "path": "kibana.alert.original_event.module",
+                  "type": "alias"
+                },
+                "outcome": {
+                  "path": "kibana.alert.original_event.outcome",
+                  "type": "alias"
+                },
+                "provider": {
+                  "path": "kibana.alert.original_event.provider",
+                  "type": "alias"
+                },
+                "reason": {
+                  "path": "kibana.alert.original_event.reason",
+                  "type": "alias"
+                },
+                "risk_score": {
+                  "path": "kibana.alert.original_event.risk_score",
+                  "type": "alias"
+                },
+                "risk_score_norm": {
+                  "path": "kibana.alert.original_event.risk_score_norm",
+                  "type": "alias"
+                },
+                "sequence": {
+                  "path": "kibana.alert.original_event.sequence",
+                  "type": "alias"
+                },
+                "severity": {
+                  "path": "kibana.alert.original_event.severity",
+                  "type": "alias"
+                },
+                "start": {
+                  "path": "kibana.alert.original_event.start",
+                  "type": "alias"
+                },
+                "timezone": {
+                  "path": "kibana.alert.original_event.timezone",
+                  "type": "alias"
+                },
+                "type": {
+                  "path": "kibana.alert.original_event.type",
+                  "type": "alias"
+                }
+              }
+            },
+            "original_time": {
+              "path": "kibana.alert.original_time",
+              "type": "alias"
+            },
+            "reason": {
+              "path": "kibana.alert.reason",
+              "type": "alias"
+            },
+            "rule": {
+              "properties": {
+                "author": {
+                  "path": "kibana.alert.rule.author",
+                  "type": "alias"
+                },
+                "building_block_type": {
+                  "path": "kibana.alert.building_block_type",
+                  "type": "alias"
+                },
+                "created_at": {
+                  "path": "kibana.alert.rule.created_at",
+                  "type": "alias"
+                },
+                "created_by": {
+                  "path": "kibana.alert.rule.created_by",
+                  "type": "alias"
+                },
+                "description": {
+                  "path": "kibana.alert.rule.description",
+                  "type": "alias"
+                },
+                "enabled": {
+                  "path": "kibana.alert.rule.enabled",
+                  "type": "alias"
+                },
+                "false_positives": {
+                  "path": "kibana.alert.rule.false_positives",
+                  "type": "alias"
+                },
+                "from": {
+                  "path": "kibana.alert.rule.from",
+                  "type": "alias"
+                },
+                "id": {
+                  "path": "kibana.alert.rule.uuid",
+                  "type": "alias"
+                },
+                "immutable": {
+                  "path": "kibana.alert.rule.immutable",
+                  "type": "alias"
+                },
+                "interval": {
+                  "path": "kibana.alert.rule.interval",
+                  "type": "alias"
+                },
+                "license": {
+                  "path": "kibana.alert.rule.license",
+                  "type": "alias"
+                },
+                "max_signals": {
+                  "path": "kibana.alert.rule.max_signals",
+                  "type": "alias"
+                },
+                "name": {
+                  "path": "kibana.alert.rule.name",
+                  "type": "alias"
+                },
+                "note": {
+                  "path": "kibana.alert.rule.note",
+                  "type": "alias"
+                },
+                "references": {
+                  "path": "kibana.alert.rule.references",
+                  "type": "alias"
+                },
+                "risk_score": {
+                  "path": "kibana.alert.risk_score",
+                  "type": "alias"
+                },
+                "rule_id": {
+                  "path": "kibana.alert.rule.rule_id",
+                  "type": "alias"
+                },
+                "rule_name_override": {
+                  "path": "kibana.alert.rule.rule_name_override",
+                  "type": "alias"
+                },
+                "severity": {
+                  "path": "kibana.alert.severity",
+                  "type": "alias"
+                },
+                "tags": {
+                  "path": "kibana.alert.rule.tags",
+                  "type": "alias"
+                },
+                "threat": {
+                  "properties": {
+                    "framework": {
+                      "path": "kibana.alert.rule.threat.framework",
+                      "type": "alias"
+                    },
+                    "tactic": {
+                      "properties": {
+                        "id": {
+                          "path": "kibana.alert.rule.threat.tactic.id",
+                          "type": "alias"
+                        },
+                        "name": {
+                          "path": "kibana.alert.rule.threat.tactic.name",
+                          "type": "alias"
+                        },
+                        "reference": {
+                          "path": "kibana.alert.rule.threat.tactic.reference",
+                          "type": "alias"
+                        }
+                      }
+                    },
+                    "technique": {
+                      "properties": {
+                        "id": {
+                          "path": "kibana.alert.rule.threat.technique.id",
+                          "type": "alias"
+                        },
+                        "name": {
+                          "path": "kibana.alert.rule.threat.technique.name",
+                          "type": "alias"
+                        },
+                        "reference": {
+                          "path": "kibana.alert.rule.threat.technique.reference",
+                          "type": "alias"
+                        },
+                        "subtechnique": {
+                          "properties": {
+                            "id": {
+                              "path": "kibana.alert.rule.threat.technique.subtechnique.id",
+                              "type": "alias"
+                            },
+                            "name": {
+                              "path": "kibana.alert.rule.threat.technique.subtechnique.name",
+                              "type": "alias"
+                            },
+                            "reference": {
+                              "path": "kibana.alert.rule.threat.technique.subtechnique.reference",
+                              "type": "alias"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "timeline_id": {
+                  "path": "kibana.alert.rule.timeline_id",
+                  "type": "alias"
+                },
+                "timeline_title": {
+                  "path": "kibana.alert.rule.timeline_title",
+                  "type": "alias"
+                },
+                "timestamp_override": {
+                  "path": "kibana.alert.rule.timestamp_override",
+                  "type": "alias"
+                },
+                "to": {
+                  "path": "kibana.alert.rule.to",
+                  "type": "alias"
+                },
+                "type": {
+                  "path": "kibana.alert.rule.type",
+                  "type": "alias"
+                },
+                "updated_at": {
+                  "path": "kibana.alert.rule.updated_at",
+                  "type": "alias"
+                },
+                "updated_by": {
+                  "path": "kibana.alert.rule.updated_by",
+                  "type": "alias"
+                },
+                "version": {
+                  "path": "kibana.alert.rule.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "status": {
+              "path": "kibana.alert.workflow_status",
+              "type": "alias"
+            },
+            "threshold_result": {
+              "properties": {
+                "cardinality": {
+                  "properties": {
+                    "field": {
+                      "path": "kibana.alert.threshold_result.cardinality.field",
+                      "type": "alias"
+                    },
+                    "value": {
+                      "path": "kibana.alert.threshold_result.cardinality.value",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "count": {
+                  "path": "kibana.alert.threshold_result.count",
+                  "type": "alias"
+                },
+                "from": {
+                  "path": "kibana.alert.threshold_result.from",
+                  "type": "alias"
+                },
+                "terms": {
+                  "properties": {
+                    "field": {
+                      "path": "kibana.alert.threshold_result.terms.field",
+                      "type": "alias"
+                    },
+                    "value": {
+                      "path": "kibana.alert.threshold_result.terms.value",
+                      "type": "alias"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "postal_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timezone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subdomain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tags": {
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "enrichments": {
+              "properties": {
+                "indicator": {
+                  "properties": {
+                    "as": {
+                      "properties": {
+                        "number": {
+                          "type": "long"
+                        },
+                        "organization": {
+                          "properties": {
+                            "name": {
+                              "fields": {
+                                "text": {
+                                  "type": "match_only_text"
+                                }
+                              },
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "confidence": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "description": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "email": {
+                      "properties": {
+                        "address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "file": {
+                      "properties": {
+                        "accessed": {
+                          "type": "date"
+                        },
+                        "attributes": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "code_signature": {
+                          "properties": {
+                            "digest_algorithm": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "exists": {
+                              "type": "boolean"
+                            },
+                            "signing_id": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "status": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "team_id": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "timestamp": {
+                              "type": "date"
+                            },
+                            "trusted": {
+                              "type": "boolean"
+                            },
+                            "valid": {
+                              "type": "boolean"
+                            }
+                          }
+                        },
+                        "created": {
+                          "type": "date"
+                        },
+                        "ctime": {
+                          "type": "date"
+                        },
+                        "device": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "directory": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "drive_letter": {
+                          "ignore_above": 1,
+                          "type": "keyword"
+                        },
+                        "elf": {
+                          "properties": {
+                            "architecture": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "byte_order": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "cpu_type": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "creation_date": {
+                              "type": "date"
+                            },
+                            "exports": {
+                              "type": "flattened"
+                            },
+                            "header": {
+                              "properties": {
+                                "abi_version": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "class": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "data": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "entrypoint": {
+                                  "type": "long"
+                                },
+                                "object_version": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "os_abi": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "type": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "version": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                }
+                              }
+                            },
+                            "imports": {
+                              "type": "flattened"
+                            },
+                            "sections": {
+                              "properties": {
+                                "chi2": {
+                                  "type": "long"
+                                },
+                                "entropy": {
+                                  "type": "long"
+                                },
+                                "flags": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "name": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "physical_offset": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "physical_size": {
+                                  "type": "long"
+                                },
+                                "type": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "virtual_address": {
+                                  "type": "long"
+                                },
+                                "virtual_size": {
+                                  "type": "long"
+                                }
+                              },
+                              "type": "nested"
+                            },
+                            "segments": {
+                              "properties": {
+                                "sections": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "type": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                }
+                              },
+                              "type": "nested"
+                            },
+                            "shared_libraries": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "telfhash": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "extension": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "fork_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "gid": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "group": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "hash": {
+                          "properties": {
+                            "md5": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "sha1": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "sha256": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "sha384": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "sha512": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "ssdeep": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "tlsh": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "inode": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "mime_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "mode": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "mtime": {
+                          "type": "date"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "owner": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "path": {
+                          "fields": {
+                            "text": {
+                              "type": "match_only_text"
+                            }
+                          },
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "pe": {
+                          "properties": {
+                            "architecture": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "company": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "description": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "file_version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "imphash": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "original_file_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pehash": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "product": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "size": {
+                          "type": "long"
+                        },
+                        "target_path": {
+                          "fields": {
+                            "text": {
+                              "type": "match_only_text"
+                            }
+                          },
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "uid": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "x509": {
+                          "properties": {
+                            "alternative_names": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "issuer": {
+                              "properties": {
+                                "common_name": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "country": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "distinguished_name": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "locality": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "organization": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "organizational_unit": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "state_or_province": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                }
+                              }
+                            },
+                            "not_after": {
+                              "type": "date"
+                            },
+                            "not_before": {
+                              "type": "date"
+                            },
+                            "public_key_algorithm": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "public_key_curve": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "public_key_exponent": {
+                              "type": "long"
+                            },
+                            "public_key_size": {
+                              "type": "long"
+                            },
+                            "serial_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "signature_algorithm": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject": {
+                              "properties": {
+                                "common_name": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "country": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "distinguished_name": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "locality": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "organization": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "organizational_unit": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                },
+                                "state_or_province": {
+                                  "ignore_above": 1024,
+                                  "type": "keyword"
+                                }
+                              }
+                            },
+                            "version_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "first_seen": {
+                      "type": "date"
+                    },
+                    "geo": {
+                      "properties": {
+                        "city_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "continent_code": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "continent_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country_iso_code": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "location": {
+                          "type": "geo_point"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "postal_code": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "region_iso_code": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "region_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timezone": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "ip": {
+                      "type": "ip"
+                    },
+                    "last_seen": {
+                      "type": "date"
+                    },
+                    "marking": {
+                      "properties": {
+                        "tlp": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "tlp_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "modified_at": {
+                      "type": "date"
+                    },
+                    "port": {
+                      "type": "long"
+                    },
+                    "provider": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "reference": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "registry": {
+                      "properties": {
+                        "data": {
+                          "properties": {
+                            "bytes": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "strings": {
+                              "type": "wildcard"
+                            },
+                            "type": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "hive": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "key": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "path": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "value": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "scanner_stats": {
+                      "type": "long"
+                    },
+                    "sightings": {
+                      "type": "long"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "url": {
+                      "properties": {
+                        "domain": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "extension": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "fragment": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "full": {
+                          "fields": {
+                            "text": {
+                              "type": "match_only_text"
+                            }
+                          },
+                          "type": "wildcard"
+                        },
+                        "original": {
+                          "fields": {
+                            "text": {
+                              "type": "match_only_text"
+                            }
+                          },
+                          "type": "wildcard"
+                        },
+                        "password": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "path": {
+                          "type": "wildcard"
+                        },
+                        "port": {
+                          "type": "long"
+                        },
+                        "query": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "registered_domain": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "scheme": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subdomain": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "top_level_domain": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "username": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "x509": {
+                      "properties": {
+                        "alternative_names": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "issuer": {
+                          "properties": {
+                            "common_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "country": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "distinguished_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "locality": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organization": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organizational_unit": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "state_or_province": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "not_after": {
+                          "type": "date"
+                        },
+                        "not_before": {
+                          "type": "date"
+                        },
+                        "public_key_algorithm": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "public_key_curve": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "public_key_exponent": {
+                          "type": "long"
+                        },
+                        "public_key_size": {
+                          "type": "long"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "signature_algorithm": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject": {
+                          "properties": {
+                            "common_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "country": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "distinguished_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "locality": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organization": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organizational_unit": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "state_or_province": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "version_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "matched": {
+                  "properties": {
+                    "atomic": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "index": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "occurred": {
+                      "type": "date"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "feed": {
+              "properties": {
+                "dashboard_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "alias": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "indicator": {
+              "properties": {
+                "as": {
+                  "properties": {
+                    "number": {
+                      "type": "long"
+                    },
+                    "organization": {
+                      "properties": {
+                        "name": {
+                          "fields": {
+                            "text": {
+                              "type": "match_only_text"
+                            }
+                          },
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "confidence": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "properties": {
+                    "address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "file": {
+                  "properties": {
+                    "accessed": {
+                      "type": "date"
+                    },
+                    "attributes": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "code_signature": {
+                      "properties": {
+                        "digest_algorithm": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "exists": {
+                          "type": "boolean"
+                        },
+                        "signing_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "status": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "team_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp": {
+                          "type": "date"
+                        },
+                        "trusted": {
+                          "type": "boolean"
+                        },
+                        "valid": {
+                          "type": "boolean"
+                        }
+                      }
+                    },
+                    "created": {
+                      "type": "date"
+                    },
+                    "ctime": {
+                      "type": "date"
+                    },
+                    "device": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "directory": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "drive_letter": {
+                      "ignore_above": 1,
+                      "type": "keyword"
+                    },
+                    "elf": {
+                      "properties": {
+                        "architecture": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "byte_order": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "cpu_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "creation_date": {
+                          "type": "date"
+                        },
+                        "exports": {
+                          "type": "flattened"
+                        },
+                        "header": {
+                          "properties": {
+                            "abi_version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "class": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "data": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "entrypoint": {
+                              "type": "long"
+                            },
+                            "object_version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "os_abi": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "type": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "version": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "imports": {
+                          "type": "flattened"
+                        },
+                        "sections": {
+                          "properties": {
+                            "chi2": {
+                              "type": "long"
+                            },
+                            "entropy": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "physical_offset": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "physical_size": {
+                              "type": "long"
+                            },
+                            "type": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "virtual_address": {
+                              "type": "long"
+                            },
+                            "virtual_size": {
+                              "type": "long"
+                            }
+                          },
+                          "type": "nested"
+                        },
+                        "segments": {
+                          "properties": {
+                            "sections": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "type": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          },
+                          "type": "nested"
+                        },
+                        "shared_libraries": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "telfhash": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "extension": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "fork_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "gid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "group": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "hash": {
+                      "properties": {
+                        "md5": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha1": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha256": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha384": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha512": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ssdeep": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "tlsh": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "inode": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mime_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mode": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mtime": {
+                      "type": "date"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "owner": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pe": {
+                      "properties": {
+                        "architecture": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "company": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "description": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "file_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "imphash": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "original_file_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "pehash": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "product": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    },
+                    "target_path": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "uid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "x509": {
+                      "properties": {
+                        "alternative_names": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "issuer": {
+                          "properties": {
+                            "common_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "country": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "distinguished_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "locality": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organization": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organizational_unit": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "state_or_province": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "not_after": {
+                          "type": "date"
+                        },
+                        "not_before": {
+                          "type": "date"
+                        },
+                        "public_key_algorithm": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "public_key_curve": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "public_key_exponent": {
+                          "type": "long"
+                        },
+                        "public_key_size": {
+                          "type": "long"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "signature_algorithm": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject": {
+                          "properties": {
+                            "common_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "country": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "distinguished_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "locality": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organization": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "organizational_unit": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "state_or_province": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "version_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "first_seen": {
+                  "type": "date"
+                },
+                "geo": {
+                  "properties": {
+                    "city_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "continent_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "continent_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country_iso_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "location": {
+                      "type": "geo_point"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "postal_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_iso_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timezone": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "ip": {
+                  "type": "ip"
+                },
+                "last_seen": {
+                  "type": "date"
+                },
+                "marking": {
+                  "properties": {
+                    "tlp": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tlp_version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "modified_at": {
+                  "type": "date"
+                },
+                "port": {
+                  "type": "long"
+                },
+                "provider": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registry": {
+                  "properties": {
+                    "data": {
+                      "properties": {
+                        "bytes": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "strings": {
+                          "type": "wildcard"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "hive": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "scanner_stats": {
+                  "type": "long"
+                },
+                "sightings": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "url": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "extension": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "fragment": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "full": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "type": "wildcard"
+                    },
+                    "original": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "type": "wildcard"
+                    },
+                    "password": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "type": "wildcard"
+                    },
+                    "port": {
+                      "type": "long"
+                    },
+                    "query": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "registered_domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "scheme": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subdomain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "top_level_domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "x509": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_curve": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_exponent": {
+                      "type": "long"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "software": {
+              "properties": {
+                "alias": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platforms": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subtechnique": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "type": "match_only_text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "reference": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "x509": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_curve": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_exponent": {
+                      "type": "long"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "x509": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_curve": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_exponent": {
+                      "type": "long"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "distinguished_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "state_or_province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "type": "wildcard"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "type": "wildcard"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "type": "wildcard"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subdomain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "changes": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "effective": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk": {
+              "properties": {
+                "calculated_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calculated_score": {
+                  "type": "float"
+                },
+                "calculated_score_norm": {
+                  "type": "float"
+                },
+                "static_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "static_score": {
+                  "type": "float"
+                },
+                "static_score_norm": {
+                  "type": "float"
+                }
+              }
+            },
+            "roles": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "target": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "roles": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "match_only_text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "type": "match_only_text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "mapping": {
+          "total_fields": {
+            "limit": "2500"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/security_solution/ignore_fields/mappings.json b/x-pack/test/functional/es_archives/security_solution/ignore_fields/mappings.json
index e2c8ca3c2bc89a..3c2cbeac06cca1 100644
--- a/x-pack/test/functional/es_archives/security_solution/ignore_fields/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/ignore_fields/mappings.json
@@ -32,7 +32,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/security_solution/runtime/mappings.json b/x-pack/test/functional/es_archives/security_solution/runtime/mappings.json
index fd3f30f2a21299..e0adb6cb55742e 100644
--- a/x-pack/test/functional/es_archives/security_solution/runtime/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/runtime/mappings.json
@@ -7027,7 +7027,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1",
         "mapping": {
diff --git a/x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields/mappings.json b/x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields/mappings.json
index 2e34eae159a7f7..ed15855be8e313 100644
--- a/x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields/mappings.json
@@ -108,7 +108,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds/mappings.json b/x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds/mappings.json
index fd8880fe0bc49e..056d6467f510f6 100644
--- a/x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds/mappings.json
@@ -13,7 +13,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/security_solution/timestamp_override_5/mappings.json b/x-pack/test/functional/es_archives/security_solution/timestamp_override_5/mappings.json
index a9735aaeca8ef9..fd6f02966837cb 100644
--- a/x-pack/test/functional/es_archives/security_solution/timestamp_override_5/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timestamp_override_5/mappings.json
@@ -30,7 +30,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/es_archives/security_solution/timestamp_override_6/mappings.json b/x-pack/test/functional/es_archives/security_solution/timestamp_override_6/mappings.json
index e3d8afd7a5b338..b1b35d6e1a23b2 100644
--- a/x-pack/test/functional/es_archives/security_solution/timestamp_override_6/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timestamp_override_6/mappings.json
@@ -20,7 +20,6 @@
     },
     "settings": {
       "index": {
-        "refresh_interval": "1s",
         "number_of_replicas": "1",
         "number_of_shards": "1"
       }
diff --git a/x-pack/test/functional/page_objects/observability_log_explorer.ts b/x-pack/test/functional/page_objects/observability_log_explorer.ts
index 2978e3205f4640..0b3266465c32e0 100644
--- a/x-pack/test/functional/page_objects/observability_log_explorer.ts
+++ b/x-pack/test/functional/page_objects/observability_log_explorer.ts
@@ -406,12 +406,24 @@ export function ObservabilityLogExplorerPageObject({
 
 interface MockLogDoc {
   time: number;
-  logFilepath: string;
+  logFilepath?: string;
   serviceName?: string;
   namespace: string;
   datasetName: string;
   message?: string;
   logLevel?: string;
+  traceId?: string;
+  hostName?: string;
+  orchestratorClusterId?: string;
+  orchestratorClusterName?: string;
+  orchestratorResourceId?: string;
+  cloudProvider?: string;
+  cloudRegion?: string;
+  cloudAz?: string;
+  cloudProjectId?: string;
+  cloudInstanceId?: string;
+  agentName?: string;
+
   [key: string]: unknown;
 }
 
@@ -423,6 +435,17 @@ export function createLogDoc({
   datasetName,
   message,
   logLevel,
+  traceId,
+  hostName,
+  orchestratorClusterId,
+  orchestratorClusterName,
+  orchestratorResourceId,
+  cloudProvider,
+  cloudRegion,
+  cloudAz,
+  cloudProjectId,
+  cloudInstanceId,
+  agentName,
   ...extraFields
 }: MockLogDoc) {
   return {
@@ -452,6 +475,17 @@ export function createLogDoc({
       dataset: datasetName,
     },
     ...(logLevel && { 'log.level': logLevel }),
+    ...(traceId && { 'trace.id': traceId }),
+    ...(hostName && { 'host.name': hostName }),
+    ...(orchestratorClusterId && { 'orchestrator.cluster.id': orchestratorClusterId }),
+    ...(orchestratorClusterName && { 'orchestrator.cluster.name': orchestratorClusterName }),
+    ...(orchestratorResourceId && { 'orchestrator.resource.id': orchestratorResourceId }),
+    ...(cloudProvider && { 'cloud.provider': cloudProvider }),
+    ...(cloudRegion && { 'cloud.region': cloudRegion }),
+    ...(cloudAz && { 'cloud.availability_zone': cloudAz }),
+    ...(cloudProjectId && { 'cloud.project.id': cloudProjectId }),
+    ...(cloudInstanceId && { 'cloud.instance.id': cloudInstanceId }),
+    ...(agentName && { 'agent.name': agentName }),
     ...extraFields,
   };
 }
diff --git a/x-pack/test/functional/services/cases/list.ts b/x-pack/test/functional/services/cases/list.ts
index a83b11da78b781..ef3e61acf52131 100644
--- a/x-pack/test/functional/services/cases/list.ts
+++ b/x-pack/test/functional/services/cases/list.ts
@@ -19,6 +19,7 @@ export function CasesTableServiceProvider(
   const testSubjects = getService('testSubjects');
   const find = getService('find');
   const header = getPageObject('header');
+  const browser = getService('browser');
   const retry = getService('retry');
   const config = getService('config');
 
@@ -392,5 +393,31 @@ export function CasesTableServiceProvider(
 
       return await titleElement.getVisibleText();
     },
+
+    async hasColumn(columnName: string) {
+      const column = await find.allByCssSelector(
+        `th.euiTableHeaderCell span[title="${columnName}"]`
+      );
+      return column.length !== 0;
+    },
+
+    async openColumnsPopover() {
+      await testSubjects.click('column-selection-popover-button');
+      await testSubjects.existOrFail('column-selection-popover-drag-drop-context');
+    },
+
+    async closeColumnsPopover() {
+      await testSubjects.click('column-selection-popover-button');
+    },
+
+    async toggleColumnInPopover(columnId: string) {
+      await this.openColumnsPopover();
+
+      await testSubjects.existOrFail(`column-selection-switch-${columnId}`);
+      await testSubjects.click(`column-selection-switch-${columnId}`);
+
+      // closes the popover
+      await browser.pressKeys(browser.keys.ESCAPE);
+    },
   };
 }
diff --git a/x-pack/test/functional/services/logs_ui/log_stream.ts b/x-pack/test/functional/services/logs_ui/log_stream.ts
index 214290bd21ef48..1a068439a2d2d9 100644
--- a/x-pack/test/functional/services/logs_ui/log_stream.ts
+++ b/x-pack/test/functional/services/logs_ui/log_stream.ts
@@ -12,6 +12,7 @@ import { TabsParams } from '../../page_objects/infra_logs_page';
 export function LogStreamPageProvider({ getPageObjects, getService }: FtrProviderContext) {
   const pageObjects = getPageObjects(['infraLogs']);
   const retry = getService('retry');
+  const find = getService('find');
   const testSubjects = getService('testSubjects');
 
   return {
@@ -43,6 +44,31 @@ export function LogStreamPageProvider({ getPageObjects, getService }: FtrProvide
       return await testSubjects.findAllDescendant('~logColumn', entryElement);
     },
 
+    async getLogEntryColumnValueByName(
+      entryElement: WebElementWrapper,
+      column: string
+    ): Promise<string> {
+      const columnElement = await testSubjects.findDescendant(`~${column}`, entryElement);
+
+      const contentElement = await columnElement.findByCssSelector(
+        `[data-test-subj='LogEntryColumnContent']`
+      );
+
+      return await contentElement.getVisibleText();
+    },
+
+    async openLogEntryDetailsFlyout(entryElement: WebElementWrapper) {
+      await entryElement.click();
+
+      const menuButton = await testSubjects.findDescendant(
+        `~infraLogEntryContextMenuButton`,
+        entryElement
+      );
+      await menuButton.click();
+
+      await find.clickByButtonText('View details');
+    },
+
     async getNoLogsIndicesPrompt() {
       return await testSubjects.find('noLogsIndicesPrompt');
     },
diff --git a/x-pack/test/functional_cors/plugins/kibana_cors_test/server/index.ts b/x-pack/test/functional_cors/plugins/kibana_cors_test/server/index.ts
index 6412a3892660dc..59b1414effa5d6 100644
--- a/x-pack/test/functional_cors/plugins/kibana_cors_test/server/index.ts
+++ b/x-pack/test/functional_cors/plugins/kibana_cors_test/server/index.ts
@@ -9,7 +9,8 @@ import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core
 import { CorsTestPlugin } from './plugin';
 import { configSchema, ConfigSchema } from './config';
 
-export const plugin = (initContext: PluginInitializerContext) => new CorsTestPlugin(initContext);
+export const plugin = async (initContext: PluginInitializerContext) =>
+  new CorsTestPlugin(initContext);
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
diff --git a/x-pack/test/functional_embedded/plugins/iframe_embedded/server/index.ts b/x-pack/test/functional_embedded/plugins/iframe_embedded/server/index.ts
index 19c53e78c48762..8501a5920f76ad 100644
--- a/x-pack/test/functional_embedded/plugins/iframe_embedded/server/index.ts
+++ b/x-pack/test/functional_embedded/plugins/iframe_embedded/server/index.ts
@@ -8,5 +8,5 @@
 import { PluginInitializerContext } from '@kbn/core/server';
 import { IframeEmbeddedPlugin } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) =>
+export const plugin = async (initContext: PluginInitializerContext) =>
   new IframeEmbeddedPlugin(initContext);
diff --git a/x-pack/test/functional_execution_context/plugins/alerts/server/index.ts b/x-pack/test/functional_execution_context/plugins/alerts/server/index.ts
index dbd04e32e860bc..0047ae70a993df 100644
--- a/x-pack/test/functional_execution_context/plugins/alerts/server/index.ts
+++ b/x-pack/test/functional_execution_context/plugins/alerts/server/index.ts
@@ -8,4 +8,4 @@
 import './ensure_apm_started';
 import { FixturePlugin } from './plugin';
 
-export const plugin = () => new FixturePlugin();
+export const plugin = async () => new FixturePlugin();
diff --git a/x-pack/test/functional_execution_context/tests/browser.ts b/x-pack/test/functional_execution_context/tests/browser.ts
index 1696b7ef3c3124..f7d265316decb8 100644
--- a/x-pack/test/functional_execution_context/tests/browser.ts
+++ b/x-pack/test/functional_execution_context/tests/browser.ts
@@ -12,8 +12,28 @@ import { assertLogContains, isExecutionContextLog, readLogFile } from '../test_u
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'home', 'timePicker']);
 
-  // Failing: See https://github.com/elastic/kibana/issues/166007
-  describe.skip('Browser apps', () => {
+  describe('Browser apps', () => {
+    let logs: Ecs[];
+    const retry = getService('retry');
+
+    const logContains = async ({
+      predicate,
+      description,
+    }: {
+      predicate: (record: Ecs) => boolean;
+      description: string;
+    }) => {
+      return retry.try(async () => {
+        try {
+          await assertLogContains({ logs, predicate, description });
+        } catch (err) {
+          // if we did not find our predicate in the logs, wait a bit and parse them again
+          await new Promise((resolve) => setTimeout(resolve, 10000));
+          logs = await readLogFile();
+          throw err;
+        }
+      });
+    };
     before(async () => {
       await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
         useActualUrl: true,
@@ -31,8 +51,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     describe('discover app', () => {
-      let logs: Ecs[];
-
       before(async () => {
         await PageObjects.common.navigateToApp('discover');
         await PageObjects.timePicker.setCommonlyUsedTime('Last_7 days');
@@ -53,16 +71,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       describe('propagates context for Discover', () => {
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: (record) =>
               Boolean(record.http?.request?.id?.includes('kibana:application:discover')),
-            logs,
           });
         });
 
         it('propagates to Kibana logs (fetch documents)', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs (fetch documents)',
             predicate: checkExecutionContextEntry({
               type: 'application',
@@ -77,12 +94,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 description: 'fetch documents',
               },
             }),
-            logs,
           });
         });
 
         it('propagates to Kibana logs (fetch chart data and total hits)', async () => {
-          await assertLogContains({
+          await logContains({
             description:
               'execution context propagates to Kibana logs (fetch chart data and total hits)',
             predicate: checkExecutionContextEntry({
@@ -105,15 +121,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 },
               },
             }),
-            logs,
           });
         });
       });
     });
 
     describe('dashboard app', () => {
-      let logs: Ecs[];
-
       before(async () => {
         await PageObjects.common.navigateToApp('dashboard');
         await PageObjects.dashboard.loadSavedDashboard('[Flights] Global Flight Dashboard');
@@ -170,17 +183,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       describe('propagates context for Lens visualizations', () => {
         describe('lnsXY', () => {
           it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
               predicate: checkHttpRequestId(
                 'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsXY:086ac2e9-dd16-4b45-92b8-1e43ff7e3f65'
               ),
-              logs,
             });
           });
 
           it('propagates to Kibana logs', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Kibana logs',
               predicate: checkExecutionContextEntry({
                 type: 'application',
@@ -202,24 +214,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   },
                 },
               }),
-              logs,
             });
           });
         });
 
-        describe.skip('lnsMetric', () => {
+        describe('lnsMetric', () => {
           it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
               predicate: checkHttpRequestId(
-                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsLegacyMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
+                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
               ),
-              logs,
             });
           });
 
           it('propagates to Kibana logs', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Kibana logs',
               predicate: checkExecutionContextEntry({
                 name: 'dashboards',
@@ -234,31 +244,29 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   description: '[Flights] Global Flight Dashboard',
                   child: {
                     type: 'lens',
-                    name: 'lnsLegacyMetric',
+                    name: 'lnsMetric',
                     id: 'b766e3b8-4544-46ed-99e6-9ecc4847e2a2',
                     description: '',
                     url: '/app/lens#/edit_by_value',
                   },
                 },
               }),
-              logs,
             });
           });
         });
 
         describe('lnsDatatable', () => {
           it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
               predicate: checkHttpRequestId(
                 'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsDatatable:fb86b32f-fb7a-45cf-9511-f366fef51bbd'
               ),
-              logs,
             });
           });
 
           it('propagates to Kibana logs', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Kibana logs',
               predicate: checkExecutionContextEntry({
                 name: 'dashboards',
@@ -280,24 +288,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   },
                 },
               }),
-              logs,
             });
           });
         });
 
         describe('lnsPie', () => {
           it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
               predicate: checkHttpRequestId(
                 'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsPie:5d53db36-2d5a-4adc-af7b-cec4c1a294e0'
               ),
-              logs,
             });
           });
 
           it('propagates to Kibana logs', async () => {
-            await assertLogContains({
+            await logContains({
               description: 'execution context propagates to Kibana logs',
               predicate: checkExecutionContextEntry({
                 name: 'dashboards',
@@ -319,7 +325,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   },
                 },
               }),
-              logs,
             });
           });
         });
@@ -327,17 +332,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       describe('propagates context for built-in Discover', () => {
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
               'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;search:discover:571aaf70-4c88-11e8-b3d7-01146121b73d'
             ),
-            logs,
           });
         });
 
         it('propagates to Kibana logs', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               type: 'application',
@@ -359,22 +363,20 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 },
               },
             }),
-            logs,
           });
         });
       });
 
       describe.skip('propagates context for TSVB visualizations', () => {
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId('agg_based:metrics:bcb63b50-4c89-11e8-b3d7-01146121b73d'),
-            logs,
           });
         });
 
         it('propagates to Kibana logs', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               name: 'dashboards',
@@ -390,24 +392,23 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 url: '/app/visualize#/edit/bcb63b50-4c89-11e8-b3d7-01146121b73d',
               },
             }),
-            logs,
           });
         });
       });
 
       describe('propagates context for Vega visualizations', () => {
+        // CHECKPOINT this is the test that failed and caused the global .skip()
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
               'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b'
             ),
-            logs,
           });
         });
 
         it('propagates to Kibana logs', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               name: 'dashboards',
@@ -429,24 +430,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 },
               },
             }),
-            logs,
           });
         });
       });
 
       describe.skip('propagates context for Tag Cloud visualization', () => {
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
               'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:tagcloud:293b5a30-4c8f-11e8-b3d7-01146121b73d'
             ),
-            logs,
           });
         });
 
         it('propagates to Kibana logs', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               name: 'dashboards',
@@ -468,24 +467,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 },
               },
             }),
-            logs,
           });
         });
       });
 
       describe.skip('propagates context for Vertical bar visualization', () => {
         it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
               'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:histogram:9886b410-4c8b-11e8-b3d7-01146121b73d'
             ),
-            logs,
           });
         });
 
         it('propagates to Kibana logs', async () => {
-          await assertLogContains({
+          await logContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               type: 'application',
@@ -507,7 +504,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 },
               },
             }),
-            logs,
           });
         });
       });
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
index 51a37c1eaccd91..c1d2b2a9d7c0c9 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group2/list_view.ts
@@ -656,5 +656,81 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
         });
       });
     });
+
+    describe('Column Selection', () => {
+      afterEach(async () => {
+        await toasts.dismissAllToastsWithChecks();
+      });
+
+      before(async () => {
+        await cases.api.createNthRandomCases(1);
+        await header.waitUntilLoadingHasFinished();
+        await cases.casesTable.waitForCasesToBeListed();
+      });
+
+      after(async () => {
+        await cases.api.deleteAllCases();
+        await cases.casesTable.waitForCasesToBeDeleted();
+        await browser.clearLocalStorage();
+      });
+
+      it('column selection popover button exists', async () => {
+        await testSubjects.existOrFail('column-selection-popover-button');
+      });
+
+      it('selecting a column works correctly', async () => {
+        expect(await cases.casesTable.hasColumn('Closed on')).to.be(false);
+
+        await cases.casesTable.toggleColumnInPopover('closedAt');
+
+        expect(await cases.casesTable.hasColumn('Closed on')).to.be(true);
+      });
+
+      it('deselecting columns works correctly', async () => {
+        expect(await cases.casesTable.hasColumn('Name')).to.be(true);
+
+        await cases.casesTable.toggleColumnInPopover('title');
+
+        expect(await cases.casesTable.hasColumn('Name')).to.be(false);
+      });
+
+      it('"Hide All" columns works correctly', async () => {
+        await cases.casesTable.openColumnsPopover();
+
+        await testSubjects.click('column-selection-popover-hide-all-button');
+
+        await cases.casesTable.closeColumnsPopover();
+
+        expect(await cases.casesTable.hasColumn('Name')).to.be(false);
+        expect(await cases.casesTable.hasColumn('Assignees')).to.be(false);
+        expect(await cases.casesTable.hasColumn('Tags')).to.be(false);
+        expect(await cases.casesTable.hasColumn('Category')).to.be(false);
+      });
+
+      it('"Show All" columns works correctly', async () => {
+        await cases.casesTable.openColumnsPopover();
+
+        await testSubjects.click('column-selection-popover-show-all-button');
+
+        await cases.casesTable.closeColumnsPopover();
+
+        expect(await cases.casesTable.hasColumn('Name')).to.be(true);
+        expect(await cases.casesTable.hasColumn('Assignees')).to.be(true);
+        expect(await cases.casesTable.hasColumn('Tags')).to.be(true);
+        expect(await cases.casesTable.hasColumn('Category')).to.be(true);
+        expect(await cases.casesTable.hasColumn('Closed on')).to.be(true);
+      });
+
+      it('search and toggle column works correctly', async () => {
+        await cases.casesTable.openColumnsPopover();
+
+        const input = await testSubjects.find('column-selection-popover-search');
+        await input.type('name');
+
+        await testSubjects.existOrFail('column-selection-switch-title');
+        await testSubjects.missingOrFail('column-selection-switch-closedAt');
+        await testSubjects.missingOrFail('column-selection-switch-category');
+      });
+    });
   });
 };
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
index cdf9cc87684ad5..3cceb01b549980 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
@@ -155,6 +155,19 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await testSubjects.click('notifyWhenSelect');
       await testSubjects.click('onThrottleInterval');
       await testSubjects.setValue('throttleInput', '10');
+
+      // Alerts search bar (conditional actions)
+      await testSubjects.click('alertsFilterQueryToggle');
+
+      await pageObjects.header.waitUntilLoadingHasFinished();
+      await testSubjects.click('addFilter');
+      await testSubjects.click('filterFieldSuggestionList');
+      await comboBox.set('filterFieldSuggestionList', '_id');
+      await comboBox.set('filterOperatorList', 'is not');
+      await testSubjects.setValue('filterParams', 'fake-rule-id');
+      await testSubjects.click('saveFilter');
+      await testSubjects.setValue('queryInput', '_id: *');
+
       const messageTextArea = await find.byCssSelector('[data-test-subj="messageTextArea"]');
       expect(await messageTextArea.getAttribute('value')).to.eql(
         `Rule '{{rule.name}}' is active for group '{{context.group}}':
diff --git a/x-pack/test/functional_with_es_ssl/plugins/alerts/server/index.ts b/x-pack/test/functional_with_es_ssl/plugins/alerts/server/index.ts
index b7c2aea144b5b1..131cc04b22bf6e 100644
--- a/x-pack/test/functional_with_es_ssl/plugins/alerts/server/index.ts
+++ b/x-pack/test/functional_with_es_ssl/plugins/alerts/server/index.ts
@@ -8,4 +8,4 @@
 import { PluginInitializer } from '@kbn/core/server';
 import { AlertingFixturePlugin } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () => new AlertingFixturePlugin();
+export const plugin: PluginInitializer<void, void> = async () => new AlertingFixturePlugin();
diff --git a/x-pack/test/functional_with_es_ssl/plugins/cases/server/index.ts b/x-pack/test/functional_with_es_ssl/plugins/cases/server/index.ts
index df682115bd93a2..ef145ab0ee92f3 100644
--- a/x-pack/test/functional_with_es_ssl/plugins/cases/server/index.ts
+++ b/x-pack/test/functional_with_es_ssl/plugins/cases/server/index.ts
@@ -8,4 +8,4 @@
 import { PluginInitializer } from '@kbn/core/server';
 import { CasesFixturePlugin } from './plugin';
 
-export const plugin: PluginInitializer<void, void> = () => new CasesFixturePlugin();
+export const plugin: PluginInitializer<void, void> = async () => new CasesFixturePlugin();
diff --git a/x-pack/test/osquery_cypress/agent.ts b/x-pack/test/osquery_cypress/agent.ts
index cd7969703c4831..63429fb4e5b7e3 100644
--- a/x-pack/test/osquery_cypress/agent.ts
+++ b/x-pack/test/osquery_cypress/agent.ts
@@ -8,7 +8,10 @@
 import execa from 'execa';
 import { ToolingLog } from '@kbn/tooling-log';
 import { KbnClient } from '@kbn/test';
-import { waitForHostToEnroll } from '@kbn/security-solution-plugin/scripts/endpoint/common/fleet_services';
+import {
+  fetchFleetServerUrl,
+  waitForHostToEnroll,
+} from '@kbn/security-solution-plugin/scripts/endpoint/common/fleet_services';
 
 import { getLatestVersion } from './artifact_manager';
 import { Manager } from './resource_manager';
@@ -40,6 +43,9 @@ export class AgentManager extends Manager {
     const artifact = `docker.elastic.co/beats/elastic-agent:${await getLatestVersion()}`;
     this.log.info(artifact);
     const containerName = generateRandomString(12);
+    const fleetServerUrl =
+      (await fetchFleetServerUrl(this.kbnClient)) ??
+      `https://host.docker.internal:${this.fleetServerPort}`;
 
     const dockerArgs = [
       'run',
@@ -55,7 +61,7 @@ export class AgentManager extends Manager {
       '--env',
       'FLEET_ENROLL=1',
       '--env',
-      `FLEET_URL=https://host.docker.internal:${this.fleetServerPort}`,
+      `FLEET_URL=${fleetServerUrl}`,
       '--env',
       `FLEET_ENROLLMENT_TOKEN=${this.policyEnrollmentKey}`,
       '--env',
@@ -64,8 +70,12 @@ export class AgentManager extends Manager {
       artifact,
     ];
 
-    this.agentContainerId = (await execa('docker', dockerArgs)).stdout;
-    await waitForHostToEnroll(this.kbnClient, containerName);
+    const startedContainer = await execa('docker', dockerArgs);
+
+    this.log.info(`agent docker container started:\n${JSON.stringify(startedContainer, null, 2)}`);
+
+    this.agentContainerId = startedContainer.stdout;
+    await waitForHostToEnroll(this.kbnClient, this.log, containerName, 240000);
   }
 
   public cleanup() {
diff --git a/x-pack/test/osquery_cypress/fleet_server.ts b/x-pack/test/osquery_cypress/fleet_server.ts
index f1fa7a174ae375..264bf9f8698915 100644
--- a/x-pack/test/osquery_cypress/fleet_server.ts
+++ b/x-pack/test/osquery_cypress/fleet_server.ts
@@ -6,40 +6,52 @@
  */
 
 import { ToolingLog } from '@kbn/tooling-log';
-import execa from 'execa';
-import { runFleetServerIfNeeded } from '@kbn/security-solution-plugin/scripts/endpoint/endpoint_agent_runner/fleet_server';
+import { KbnClient } from '@kbn/test';
+import {
+  StartedFleetServer,
+  startFleetServer,
+} from '@kbn/security-solution-plugin/scripts/endpoint/common/fleet_server/fleet_server_services';
 import { Manager } from './resource_manager';
+import { getLatestAvailableAgentVersion } from './utils';
 
 export class FleetManager extends Manager {
-  private fleetContainerId?: string;
-  private log: ToolingLog;
+  private fleetServer: StartedFleetServer | undefined = undefined;
 
-  constructor(log: ToolingLog) {
+  constructor(
+    private readonly kbnClient: KbnClient,
+    private readonly log: ToolingLog,
+    private readonly port: number
+  ) {
     super();
-    this.log = log;
   }
 
   public async setup(): Promise<void> {
-    const fleetServerConfig = await runFleetServerIfNeeded();
-
-    if (!fleetServerConfig) {
-      throw new Error('Fleet server config not found');
+    const version = await getLatestAvailableAgentVersion(this.kbnClient);
+    this.fleetServer = await startFleetServer({
+      kbnClient: this.kbnClient,
+      logger: this.log,
+      port: this.port,
+      force: true,
+      version,
+    });
+
+    if (!this.fleetServer) {
+      throw new Error('Fleet server was not started');
     }
-
-    this.fleetContainerId = fleetServerConfig.fleetServerContainerId;
   }
 
   public cleanup() {
     super.cleanup();
 
     this.log.info('Removing old fleet config');
-    if (this.fleetContainerId) {
+    if (this.fleetServer) {
       this.log.info('Closing fleet process');
 
       try {
-        execa.sync('docker', ['kill', this.fleetContainerId]);
+        this.fleetServer.stopNow();
       } catch (err) {
         this.log.error('Error closing fleet server process');
+        this.log.verbose(err);
       }
       this.log.info('Fleet server process closed');
     }
diff --git a/x-pack/test/osquery_cypress/runner.ts b/x-pack/test/osquery_cypress/runner.ts
index 7e7ac5e652fd73..486305a41cfc04 100644
--- a/x-pack/test/osquery_cypress/runner.ts
+++ b/x-pack/test/osquery_cypress/runner.ts
@@ -8,45 +8,30 @@
 import Url from 'url';
 
 import { verifyDockerInstalled, maybeCreateDockerNetwork } from '@kbn/es';
-import { startRuntimeServices } from '@kbn/security-solution-plugin/scripts/endpoint/endpoint_agent_runner/runtime';
+import { createToolingLogger } from '@kbn/security-solution-plugin/common/endpoint/data_loaders/utils';
+import { prefixedOutputLogger } from '@kbn/security-solution-plugin/scripts/endpoint/common/utils';
 import { FtrProviderContext } from './ftr_provider_context';
 
 import { AgentManager } from './agent';
 import { FleetManager } from './fleet_server';
-import { createAgentPolicy, getLatestAvailableAgentVersion } from './utils';
+import { createAgentPolicy } from './utils';
 
 async function setupFleetAgent({ getService }: FtrProviderContext) {
-  const log = getService('log');
+  // Un-comment line below to set tooling log levels to verbose. Useful when debugging
+  // createToolingLogger.defaultLogLevel = 'verbose';
+
+  // const log = getService('log');
   const config = getService('config');
   const kbnClient = getService('kibanaServer');
 
-  const elasticUrl = Url.format(config.get('servers.elasticsearch'));
-  const kibanaUrl = Url.format(config.get('servers.kibana'));
-  const fleetServerUrl = Url.format({
-    protocol: config.get('servers.kibana.protocol'),
-    hostname: config.get('servers.kibana.hostname'),
-    port: config.get('servers.fleetserver.port'),
-  });
-  const username = config.get('servers.elasticsearch.username');
-  const password = config.get('servers.elasticsearch.password');
+  const log = prefixedOutputLogger('cy.OSQuery', createToolingLogger());
 
   await verifyDockerInstalled(log);
   await maybeCreateDockerNetwork(log);
+  await new FleetManager(kbnClient, log, config.get('servers.fleetserver.port')).setup();
 
-  await startRuntimeServices({
-    log,
-    elasticUrl,
-    kibanaUrl,
-    fleetServerUrl,
-    username,
-    password,
-    version: await getLatestAvailableAgentVersion(kbnClient),
-  });
-
-  await new FleetManager(log).setup();
-
-  const policyEnrollmentKey = await createAgentPolicy(kbnClient, log, 'Default policy');
-  const policyEnrollmentKeyTwo = await createAgentPolicy(kbnClient, log, 'Osquery policy');
+  const policyEnrollmentKey = await createAgentPolicy(kbnClient, log, `Default policy`);
+  const policyEnrollmentKeyTwo = await createAgentPolicy(kbnClient, log, `Osquery policy`);
 
   const port = config.get('servers.fleetserver.port');
 
diff --git a/x-pack/test/plugin_api_integration/plugins/elasticsearch_client/server/index.ts b/x-pack/test/plugin_api_integration/plugins/elasticsearch_client/server/index.ts
index c101370938471e..e95ccfe3eaa127 100644
--- a/x-pack/test/plugin_api_integration/plugins/elasticsearch_client/server/index.ts
+++ b/x-pack/test/plugin_api_integration/plugins/elasticsearch_client/server/index.ts
@@ -7,4 +7,4 @@
 
 import { ElasticsearchClientXPack } from './plugin';
 
-export const plugin = () => new ElasticsearchClientXPack();
+export const plugin = async () => new ElasticsearchClientXPack();
diff --git a/x-pack/test/plugin_api_integration/plugins/event_log/server/index.ts b/x-pack/test/plugin_api_integration/plugins/event_log/server/index.ts
index eb8bfa1b80cff5..24c0958a58488b 100644
--- a/x-pack/test/plugin_api_integration/plugins/event_log/server/index.ts
+++ b/x-pack/test/plugin_api_integration/plugins/event_log/server/index.ts
@@ -8,5 +8,5 @@
 import { PluginInitializerContext } from '@kbn/core/server';
 import { EventLogFixturePlugin } from './plugin';
 
-export const plugin = (initContext: PluginInitializerContext) =>
+export const plugin = async (initContext: PluginInitializerContext) =>
   new EventLogFixturePlugin(initContext);
diff --git a/x-pack/test/plugin_api_integration/plugins/feature_usage_test/server/index.ts b/x-pack/test/plugin_api_integration/plugins/feature_usage_test/server/index.ts
index b649fbc8082723..6d0e1606f00440 100644
--- a/x-pack/test/plugin_api_integration/plugins/feature_usage_test/server/index.ts
+++ b/x-pack/test/plugin_api_integration/plugins/feature_usage_test/server/index.ts
@@ -15,4 +15,4 @@ import {
 export const plugin: PluginInitializer<
   FeatureUsageTestPluginSetup,
   FeatureUsageTestPluginStart
-> = () => new FeatureUsageTestPlugin();
+> = async () => new FeatureUsageTestPlugin();
diff --git a/x-pack/test/plugin_api_integration/plugins/sample_task_plugin/server/index.ts b/x-pack/test/plugin_api_integration/plugins/sample_task_plugin/server/index.ts
index bed262d69ea183..9ef27eac563357 100644
--- a/x-pack/test/plugin_api_integration/plugins/sample_task_plugin/server/index.ts
+++ b/x-pack/test/plugin_api_integration/plugins/sample_task_plugin/server/index.ts
@@ -7,4 +7,4 @@
 
 import { SampleTaskManagerFixturePlugin } from './plugin';
 
-export const plugin = () => new SampleTaskManagerFixturePlugin();
+export const plugin = async () => new SampleTaskManagerFixturePlugin();
diff --git a/x-pack/test/plugin_api_perf/plugins/task_manager_performance/server/index.ts b/x-pack/test/plugin_api_perf/plugins/task_manager_performance/server/index.ts
index bed262d69ea183..9ef27eac563357 100644
--- a/x-pack/test/plugin_api_perf/plugins/task_manager_performance/server/index.ts
+++ b/x-pack/test/plugin_api_perf/plugins/task_manager_performance/server/index.ts
@@ -7,4 +7,4 @@
 
 import { SampleTaskManagerFixturePlugin } from './plugin';
 
-export const plugin = () => new SampleTaskManagerFixturePlugin();
+export const plugin = async () => new SampleTaskManagerFixturePlugin();
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/csv_v2.ts b/x-pack/test/reporting_api_integration/reporting_and_security/csv_v2.ts
index 04ff7adc357e3a..5b70c5db2fd8ae 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/csv_v2.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/csv_v2.ts
@@ -5,14 +5,13 @@
  * 2.0.
  */
 
-import { DISCOVER_APP_LOCATOR } from '@kbn/discover-plugin/common';
 import expect from '@kbn/expect';
-import type {
-  JobParamsCsvFromSavedObject,
-  ReportApiJSON,
-} from '@kbn/reporting-plugin/common/types';
-import rison from '@kbn/rison';
 import request from 'supertest';
+
+import { DISCOVER_APP_LOCATOR } from '@kbn/discover-plugin/common';
+import type { JobParamsCsvFromSavedObject } from '@kbn/reporting-export-types-csv-common';
+import type { ReportApiJSON } from '@kbn/reporting-common/types';
+import rison from '@kbn/rison';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 const LOGSTASH_DATA_ARCHIVE = 'test/functional/fixtures/es_archiver/logstash_functional';
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/download_csv_dashboard.ts b/x-pack/test/reporting_api_integration/reporting_and_security/download_csv_dashboard.ts
index f71efb61aeb2cd..bd389cd49ea87b 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/download_csv_dashboard.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/download_csv_dashboard.ts
@@ -6,8 +6,8 @@
  */
 
 import expect from '@kbn/expect';
+import type { JobParamsDownloadCSV } from '@kbn/reporting-export-types-csv-common';
 import supertest from 'supertest';
-import { JobParamsDownloadCSV } from '@kbn/reporting-plugin/server/export_types/csv_searchsource_immediate/types';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 const getMockJobParams = (obj: object) => {
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/error_codes.ts b/x-pack/test/reporting_api_integration/reporting_and_security/error_codes.ts
index 0d83da710ba237..1f417a3d526c24 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/error_codes.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/error_codes.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { INTERNAL_ROUTES } from '@kbn/reporting-plugin/common/constants/routes';
-import { ReportApiJSON } from '@kbn/reporting-plugin/common/types';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts b/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
index d7f9d772f826df..951fdf8ec5772d 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/generate_csv_discover.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { SerializedSearchSourceFields } from '@kbn/data-plugin/common';
-import { ReportApiJSON } from '@kbn/reporting-plugin/common/types';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/ilm_migration_apis.ts b/x-pack/test/reporting_api_integration/reporting_and_security/ilm_migration_apis.ts
index 6f719743649429..172d415ff26958 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/ilm_migration_apis.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/ilm_migration_apis.ts
@@ -6,7 +6,7 @@
  */
 
 import expect from '@kbn/expect';
-import { ILM_POLICY_NAME } from '@kbn/reporting-plugin/common/constants';
+import { ILM_POLICY_NAME } from '@kbn/reporting-common/constants';
 import { INTERNAL_ROUTES } from '@kbn/reporting-plugin/common/constants/routes';
 import { FtrProviderContext } from '../ftr_provider_context';
 
diff --git a/x-pack/test/reporting_api_integration/reporting_without_security/job_apis_csv.ts b/x-pack/test/reporting_api_integration/reporting_without_security/job_apis_csv.ts
index 30f58524b46f8b..921ad4ef6a9155 100644
--- a/x-pack/test/reporting_api_integration/reporting_without_security/job_apis_csv.ts
+++ b/x-pack/test/reporting_api_integration/reporting_without_security/job_apis_csv.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 import { INTERNAL_ROUTES } from '@kbn/reporting-plugin/common/constants/routes';
-import { ReportApiJSON } from '@kbn/reporting-plugin/common/types';
+import { ReportApiJSON } from '@kbn/reporting-common/types';
 import { pick } from 'lodash';
 import { FtrProviderContext } from '../ftr_provider_context';
 
diff --git a/x-pack/test/reporting_api_integration/services/scenarios.ts b/x-pack/test/reporting_api_integration/services/scenarios.ts
index dee9c082314666..98471d94cc4e66 100644
--- a/x-pack/test/reporting_api_integration/services/scenarios.ts
+++ b/x-pack/test/reporting_api_integration/services/scenarios.ts
@@ -6,10 +6,9 @@
  */
 
 import { INTERNAL_ROUTES } from '@kbn/reporting-plugin/common/constants/routes';
-import { JobParamsCSV } from '@kbn/reporting-plugin/server/export_types/csv_searchsource/types';
-import { JobParamsDownloadCSV } from '@kbn/reporting-plugin/server/export_types/csv_searchsource_immediate/types';
-import { JobParamsPNGV2 } from '@kbn/reporting-plugin/server/export_types/png_v2/types';
-import { JobParamsPDFDeprecated } from '@kbn/reporting-plugin/server/export_types/printable_pdf/types';
+import type { JobParamsPDFDeprecated } from '@kbn/reporting-export-types-pdf-common';
+import type { JobParamsPNGV2 } from '@kbn/reporting-export-types-png-common';
+import type { JobParamsCSV, JobParamsDownloadCSV } from '@kbn/reporting-export-types-csv-common';
 import rison from '@kbn/rison';
 import { FtrProviderContext } from '../ftr_provider_context';
 
diff --git a/x-pack/test/saved_object_api_integration/common/plugins/saved_object_test_plugin/server/index.ts b/x-pack/test/saved_object_api_integration/common/plugins/saved_object_test_plugin/server/index.ts
index 1db5fe493b35b1..e30ef09b951eef 100644
--- a/x-pack/test/saved_object_api_integration/common/plugins/saved_object_test_plugin/server/index.ts
+++ b/x-pack/test/saved_object_api_integration/common/plugins/saved_object_test_plugin/server/index.ts
@@ -7,6 +7,6 @@
 
 import { Plugin } from './plugin';
 
-export function plugin() {
+export async function plugin() {
   return new Plugin();
 }
diff --git a/x-pack/test/security_api_integration/plugins/audit_log/server/index.ts b/x-pack/test/security_api_integration/plugins/audit_log/server/index.ts
index 7328c41ac6d1ab..342396a8cde4bf 100644
--- a/x-pack/test/security_api_integration/plugins/audit_log/server/index.ts
+++ b/x-pack/test/security_api_integration/plugins/audit_log/server/index.ts
@@ -7,4 +7,4 @@
 
 import { AuditTrailTestPlugin } from './plugin';
 
-export const plugin = () => new AuditTrailTestPlugin();
+export const plugin = async () => new AuditTrailTestPlugin();
diff --git a/x-pack/test/security_api_integration/plugins/oidc_provider/server/index.ts b/x-pack/test/security_api_integration/plugins/oidc_provider/server/index.ts
index b5a6123de4398e..82e460a6a4c27d 100644
--- a/x-pack/test/security_api_integration/plugins/oidc_provider/server/index.ts
+++ b/x-pack/test/security_api_integration/plugins/oidc_provider/server/index.ts
@@ -8,7 +8,7 @@
 import type { PluginInitializer, Plugin } from '@kbn/core/server';
 import { initRoutes } from './init_routes';
 
-export const plugin: PluginInitializer<void, void> = (): Plugin => ({
+export const plugin: PluginInitializer<void, void> = async (): Promise<Plugin> => ({
   setup: (core) => initRoutes(core.http.createRouter()),
   start: () => {},
   stop: () => {},
diff --git a/x-pack/test/security_api_integration/plugins/saml_provider/server/index.ts b/x-pack/test/security_api_integration/plugins/saml_provider/server/index.ts
index 5558cceea25728..9a5efa5fa6861c 100644
--- a/x-pack/test/security_api_integration/plugins/saml_provider/server/index.ts
+++ b/x-pack/test/security_api_integration/plugins/saml_provider/server/index.ts
@@ -8,7 +8,7 @@
 import type { PluginInitializer, Plugin } from '@kbn/core/server';
 import { initRoutes } from './init_routes';
 
-export const plugin: PluginInitializer<void, void> = (): Plugin => ({
+export const plugin: PluginInitializer<void, void> = async (): Promise<Plugin> => ({
   setup: (core) => initRoutes(core),
   start: () => {},
   stop: () => {},
diff --git a/x-pack/test/security_api_integration/plugins/user_profiles_consumer/server/index.ts b/x-pack/test/security_api_integration/plugins/user_profiles_consumer/server/index.ts
index 9467c7b4358b45..7cd8187558a88d 100644
--- a/x-pack/test/security_api_integration/plugins/user_profiles_consumer/server/index.ts
+++ b/x-pack/test/security_api_integration/plugins/user_profiles_consumer/server/index.ts
@@ -26,11 +26,8 @@ export interface PluginStartDependencies {
   spaces: SpacesPluginStart;
 }
 
-export const plugin: PluginInitializer<void, void> = (): Plugin<
-  void,
-  void,
-  PluginSetupDependencies,
-  PluginStartDependencies
+export const plugin: PluginInitializer<void, void> = async (): Promise<
+  Plugin<void, void, PluginSetupDependencies, PluginStartDependencies>
 > => ({
   setup: (core: CoreSetup<PluginStartDependencies>) => initRoutes(core),
   start: () => {},
diff --git a/x-pack/test/security_functional/plugins/test_endpoints/server/index.ts b/x-pack/test/security_functional/plugins/test_endpoints/server/index.ts
index 33ce96a3cfffa5..38ad79b2132184 100644
--- a/x-pack/test/security_functional/plugins/test_endpoints/server/index.ts
+++ b/x-pack/test/security_functional/plugins/test_endpoints/server/index.ts
@@ -20,9 +20,9 @@ export interface PluginStartDependencies {
   taskManager: TaskManagerStartContract;
 }
 
-export const plugin: PluginInitializer<void, void> = (
+export const plugin: PluginInitializer<void, void> = async (
   initializerContext
-): Plugin<void, void, PluginSetupDependencies, PluginStartDependencies> => ({
+): Promise<Plugin<void, void, PluginSetupDependencies, PluginStartDependencies>> => ({
   setup: (core: CoreSetup<PluginStartDependencies>) => initRoutes(initializerContext, core),
   start: () => {},
   stop: () => {},
diff --git a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
index 6238282722cfc7..374538e593efae 100644
--- a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
+++ b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
@@ -11,15 +11,18 @@ export interface CreateTestConfigOptions {
   kbnTestServerArgs?: string[];
   kbnTestServerEnv?: Record<string, string>;
 }
+import { services } from '../../../../test_serverless/api_integration/services';
 
 export function createTestConfig(options: CreateTestConfigOptions) {
   return async ({ readConfigFile }: FtrConfigProviderContext) => {
     const svlSharedConfig = await readConfigFile(
       require.resolve('../../../../test_serverless/shared/config.base.ts')
     );
-
     return {
       ...svlSharedConfig.getAll(),
+      services: {
+        ...services,
+      },
       kbnTestServer: {
         ...svlSharedConfig.get('kbnTestServer'),
         serverArgs: [
diff --git a/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/data.json b/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/data.json
new file mode 100644
index 00000000000000..80ccf200301c72
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/data.json
@@ -0,0 +1,418 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "978783",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.595350Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978783/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "domain should match the auditbeat hosts' data's source.ip",
+          "domain": "159.89.119.67",
+          "first_seen": "2021-01-26T11:09:04.000Z",
+          "provider": "geenensp",
+          "type": "url",
+          "url": {
+            "full": "http://159.89.119.67:59600/bin.sh",
+            "scheme": "http"
+          }
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": false,
+          "tags": null,
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "978784",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.616763Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978782/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "this should not match the auditbeat hosts data",
+          "ip": "125.46.136.106",
+          "first_seen": "2021-01-26T11:06:03.000Z",
+          "provider": "geenensp",
+          "type": "ip"
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": true,
+          "tags": [
+            "32-bit",
+            "elf",
+            "mips"
+          ],
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "978785",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.616763Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978782/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "this should match auditbeat/hosts on both port and ip",
+          "ip": "45.115.45.3",
+          "port": 57324,
+          "first_seen": "2021-01-26T11:06:03.000Z",
+          "provider": "geenensp",
+          "type": "url"
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": true,
+          "tags": [
+            "32-bit",
+            "elf",
+            "mips"
+          ],
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "978787",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.616763Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978782/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "this should match auditbeat/hosts on ip",
+          "ip": "45.115.45.3",
+          "first_seen": "2021-01-26T11:06:03.000Z",
+          "provider": "other_provider",
+          "type": "ip"
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": true,
+          "tags": [
+            "32-bit",
+            "elf",
+            "mips"
+          ],
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "978766",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.595350Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978783/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "domain should match the auditbeat hosts' data's source.ip",
+          "domain": "172.16.0.0",
+          "ip": "8.8.8.8",
+          "port": 777,
+          "first_seen": "2021-01-26T11:09:04.000Z",
+          "provider": "geenensp",
+          "type": "url",
+          "url": {
+            "full": "http://159.89.119.67:59600/bin.sh",
+            "scheme": "http"
+          }
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": false,
+          "tags": null,
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "978767",
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "source": {
+      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "agent": {
+        "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
+        "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
+        "name": "MacBook-Pro-de-Gloria.local",
+        "type": "filebeat",
+        "version": "8.0.0"
+      },
+      "ecs": {
+        "version": "1.6.0"
+      },
+      "event": {
+        "category": "threat",
+        "created": "2021-01-26T11:09:05.529Z",
+        "dataset": "ti_abusech.malware",
+        "ingested": "2021-01-26T11:09:06.595350Z",
+        "kind": "enrichment",
+        "module": "threatintel",
+        "reference": "https://urlhaus.abuse.ch/url/978783/",
+        "type": "indicator"
+      },
+      "fileset": {
+        "name": "abuseurl"
+      },
+      "input": {
+        "type": "httpjson"
+      },
+      "service": {
+        "type": "threatintel"
+      },
+      "tags": [
+        "threatintel-abuseurls",
+        "forwarded"
+      ],
+      "threat": {
+        "indicator": {
+          "description": "domain should match the auditbeat hosts' data's source.ip",
+          "domain": "172.16.0.0",
+          "ip": "9.9.9.9",
+          "port": 123,
+          "first_seen": "2021-01-26T11:09:04.000Z",
+          "provider": "geenensp",
+          "type": "url",
+          "url": {
+            "full": "http://159.89.119.67:59600/bin.sh",
+            "scheme": "http"
+          }
+        }
+      },
+      "threatintel": {
+        "abuseurl": {
+          "blacklists": {
+            "spamhaus_dbl": "not listed",
+            "surbl": "not listed"
+          },
+          "larted": false,
+          "tags": null,
+          "threat": "malware_download",
+          "url_status": "online"
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/mappings.json b/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/mappings.json
new file mode 100644
index 00000000000000..eda2430daef92c
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/es_archive/serverless/filebeat/threat_intel/mappings.json
@@ -0,0 +1,240 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {},
+    "index": "filebeat-8.0.0-2021.01.26-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "filebeat",
+        "version": "7.0.0"
+      },
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "@version": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "indicator": {
+              "properties": {
+                "as": {
+                  "properties": {
+                    "number": {
+                      "type": "long"
+                    },
+                    "organization": {
+                      "properties": {
+                        "name": {
+                          "fields": {
+                            "text": {
+                              "norms": false,
+                              "type": "text"
+                            }
+                          },
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "confidence": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dataset": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "wildcard"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "properties": {
+                    "address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "first_seen": {
+                  "type": "date"
+                },
+                "geo": {
+                  "properties": {
+                    "city_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "continent_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country_iso_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "location": {
+                      "type": "geo_point"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_iso_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "ip": {
+                  "type": "ip"
+                },
+                "last_seen": {
+                  "type": "date"
+                },
+                "marking": {
+                  "properties": {
+                    "tlp": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "matched": {
+                  "properties": {
+                    "atomic": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "port": {
+                  "type": "long"
+                },
+                "provider": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "scanner_stats": {
+                  "type": "long"
+                },
+                "sightings": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subtechnique": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "reference": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/security_solution_api_integration/package.json b/x-pack/test/security_solution_api_integration/package.json
index 89f6e0f164f8ed..95b8972021d566 100644
--- a/x-pack/test/security_solution_api_integration/package.json
+++ b/x-pack/test/security_solution_api_integration/package.json
@@ -19,11 +19,26 @@
     "exception_operators_date_numeric_types:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/date_numeric_types serverless qaEnv",
     "exception_operators_date_numeric_types:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/date_numeric_types ess",
     "exception_operators_date_numeric_types:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/date_numeric_types ess essEnv",
-    "exception_operators_keyword_text_long:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/keyword_text_long serverless",
-    "exception_operators_keyword_text_long:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/keyword_text_long serverless serverlessEnv",
-    "exception_operators_keyword_text_long:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/keyword_text_long serverless qaEnv",
-    "exception_operators_keyword_text_long:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/keyword_text_long ess",
-    "exception_operators_keyword_text_long:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/keyword_text_long ess essEnv",
+    "exception_operators_keyword:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/keyword serverless",
+    "exception_operators_keyword:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/keyword serverless serverlessEnv",
+    "exception_operators_keyword:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/keyword serverless qaEnv",
+    "exception_operators_keyword:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/keyword ess",
+    "exception_operators_keyword:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/keyword ess essEnv",
+    "exception_operators_ips:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/ips serverless",
+    "exception_operators_ips:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/ips serverless serverlessEnv",
+    "exception_operators_ips:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/ips serverless qaEnv",
+    "exception_operators_ips:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/ips ess",
+    "exception_operators_ips:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/ips ess essEnv",
+    "exception_operators_long:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/long serverless",
+    "exception_operators_long:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/long serverless serverlessEnv",
+    "exception_operators_long:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/long serverless qaEnv",
+    "exception_operators_long:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/long ess",
+    "exception_operators_long:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/long ess essEnv",
+    "exception_operators_text:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/text serverless",
+    "exception_operators_text:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/text serverless serverlessEnv",
+    "exception_operators_text:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/text serverless qaEnv",
+    "exception_operators_text:server:ess": "npm run initialize-server:dr:default exceptions/operators_data_types/text ess",
+    "exception_operators_text:runner:ess": "npm run run-tests:dr:default exceptions/operators_data_types/text ess essEnv",
     "exception_operators_ips_text_array:server:serverless": "npm run initialize-server:dr:default exceptions/operators_data_types/ips_text_array serverless",
     "exception_operators_ips_text_array:runner:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/ips_text_array serverless serverlessEnv",
     "exception_operators_ips_text_array:qa:serverless": "npm run run-tests:dr:default exceptions/operators_data_types/ips_text_array serverless qaEnv",
@@ -68,6 +83,12 @@
     "prebuilt_rules_update_prebuilt_rules_package:runner:serverless": "npm run run-tests:dr:default prebuilt_rules/update_prebuilt_rules_package serverless serverlessEnv",
     "prebuilt_rules_update_prebuilt_rules_package:qa:serverless": "npm run run-tests:dr:default prebuilt_rules/update_prebuilt_rules_package serverless qaEnv",
     "prebuilt_rules_update_prebuilt_rules_package:server:ess": "npm run initialize-server:dr:default prebuilt_rules/update_prebuilt_rules_package ess",
-    "prebuilt_rules_update_prebuilt_rules_package:runner:ess": "npm run run-tests:dr:default prebuilt_rules/update_prebuilt_rules_package ess essEnvs"
+    "prebuilt_rules_update_prebuilt_rules_package:runner:ess": "npm run run-tests:dr:default prebuilt_rules/update_prebuilt_rules_package ess essEnvs",
+    "rule_execution_logic:server:serverless": "npm run initialize-server:dr:default rule_execution_logic serverless",
+    "rule_execution_logic:runner:serverless": "npm run run-tests:dr:default rule_execution_logic serverless serverlessEnv",
+    "rule_execution_logic:qa:serverless": "npm run run-tests:dr:default rule_execution_logic serverless qaEnv",
+    "rule_execution_logic:server:ess": "npm run initialize-server:dr:default rule_execution_logic ess",
+    "rule_execution_logic:runner:ess": "npm run run-tests:dr:default rule_execution_logic ess essEnv"
+
   }
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/add_actions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/add_actions.ts
index 257378f7442b9c..8046eb89e0a280 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/add_actions.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/add_actions.ts
@@ -5,108 +5,134 @@
  * 2.0.
  */
 
-import expect from '@kbn/expect';
+import expect from 'expect';
 
-import { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
 import {
-  createAlertsIndex,
   deleteAllRules,
-  removeServerGeneratedProperties,
-  getWebHookAction,
-  getRuleWithWebHookAction,
-  getSimpleRuleOutputWithWebHookAction,
   waitForRuleSuccess,
-  createRule,
   deleteAllAlerts,
-  updateUsername,
+  getCustomQueryRuleParams,
+  createWebHookRuleAction,
+  fetchRule,
 } from '../../utils';
 import { FtrProviderContext } from '../../../../ftr_provider_context';
-import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
-  // TODO: add a new service
-  const config = getService('config');
-  const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
-  const isServerless = config.get('serverless');
-  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
-  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
   describe('@serverless @ess add_actions', () => {
     describe('adding actions', () => {
-      before(async () => {
-        await esArchiver.load(path);
-      });
-
-      after(async () => {
-        await esArchiver.unload(path);
-      });
-
       beforeEach(async () => {
-        await createAlertsIndex(supertest, log);
-      });
-
-      afterEach(async () => {
+        await es.indices.delete({ index: 'logs-test', ignore_unavailable: true });
+        await es.indices.create({
+          index: 'logs-test',
+          mappings: {
+            properties: {
+              '@timestamp': {
+                type: 'date',
+              },
+            },
+          },
+        });
         await deleteAllAlerts(supertest, log, es);
         await deleteAllRules(supertest, log);
       });
 
-      it('should be able to create a new webhook action and attach it to a rule', async () => {
-        // create a new action
-        const { body: hookAction } = await supertest
-          .post('/api/actions/action')
+      it('creates rule with a new webhook action', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
+        };
+
+        const { body } = await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
           .set('kbn-xsrf', 'true')
-          .set('x-elastic-internal-origin', 'foo')
-          .send(getWebHookAction())
+          .set('elastic-api-version', '2023-10-31')
+          .send(
+            getCustomQueryRuleParams({
+              actions: [ruleAction],
+            })
+          )
           .expect(200);
 
-        const rule = await createRule(supertest, log, getRuleWithWebHookAction(hookAction.id));
-        const bodyToCompare = removeServerGeneratedProperties(rule);
-        const expected = getSimpleRuleOutputWithWebHookAction(
-          `${bodyToCompare?.actions?.[0].id}`,
-          `${bodyToCompare?.actions?.[0].uuid}`
-        );
-        const expectedRuleWithUserUpdated = updateUsername(expected, ELASTICSEARCH_USERNAME);
-        expect(bodyToCompare).to.eql(expectedRuleWithUserUpdated);
+        expect(body.actions).toEqual([expect.objectContaining(ruleAction)]);
       });
 
-      it('should be able to create a new webhook action and attach it to a rule without a meta field and run it correctly', async () => {
-        // create a new action
-        const { body: hookAction } = await supertest
-          .post('/api/actions/action')
+      it('expects rule with a webhook action runs successfully', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        const {
+          body: { id },
+        } = await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
           .set('kbn-xsrf', 'true')
-          .set('x-elastic-internal-origin', 'foo')
-          .send(getWebHookAction())
+          .set('elastic-api-version', '2023-10-31')
+          .send(
+            getCustomQueryRuleParams({
+              index: ['logs-test'],
+              actions: [
+                {
+                  group: 'default',
+                  id: webhookAction.id,
+                  params: {
+                    body: '{}',
+                  },
+                  action_type_id: '.webhook',
+                },
+              ],
+              enabled: true,
+            })
+          )
           .expect(200);
 
-        const rule = await createRule(
-          supertest,
-          log,
-          getRuleWithWebHookAction(hookAction.id, true)
-        );
-        await waitForRuleSuccess({ supertest, log, id: rule.id });
+        await waitForRuleSuccess({ supertest, log, id });
+
+        const rule = await fetchRule(supertest, { id });
+
+        expect(rule?.execution_summary?.last_execution?.status).toBe('succeeded');
       });
 
-      it('should be able to create a new webhook action and attach it to a rule with a meta field and run it correctly', async () => {
-        // create a new action
-        const { body: hookAction } = await supertest
-          .post('/api/actions/action')
+      it('expects rule with a webhook action and meta field runs successfully', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        const {
+          body: { id },
+        } = await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
           .set('kbn-xsrf', 'true')
-          .set('x-elastic-internal-origin', 'foo')
-          .send(getWebHookAction())
+          .set('elastic-api-version', '2023-10-31')
+          .send(
+            getCustomQueryRuleParams({
+              index: ['logs-test'],
+              actions: [
+                {
+                  group: 'default',
+                  id: webhookAction.id,
+                  params: {
+                    body: '{}',
+                  },
+                  action_type_id: '.webhook',
+                },
+              ],
+              meta: {},
+              enabled: true,
+            })
+          )
           .expect(200);
 
-        // create a rule with the action attached and a meta field
-        const ruleWithAction: RuleCreateProps = {
-          ...getRuleWithWebHookAction(hookAction.id, true),
-          meta: {},
-        };
+        await waitForRuleSuccess({ supertest, log, id });
+
+        const rule = await fetchRule(supertest, { id });
 
-        const rule = await createRule(supertest, log, ruleWithAction);
-        await waitForRuleSuccess({ supertest, log, id: rule.id });
+        expect(rule?.execution_summary?.last_execution?.status).toBe('succeeded');
       });
     });
   });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/update_actions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/update_actions.ts
index f56d949eadd382..333e76550a7406 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/update_actions.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/actions/update_actions.ts
@@ -5,205 +5,245 @@
  * 2.0.
  */
 
-import expect from '@kbn/expect';
-import { omit } from 'lodash';
+import expect from 'expect';
 
-import { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ELASTIC_SECURITY_RULE_ID } from '@kbn/security-solution-plugin/common';
+import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
 import {
-  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  removeServerGeneratedProperties,
   getRuleWithWebHookAction,
-  getSimpleRuleOutputWithWebHookAction,
   waitForRuleSuccess,
-  createRule,
-  getSimpleRule,
   updateRule,
   installMockPrebuiltRules,
-  getRule,
-  createNewAction,
+  fetchRule,
+  createWebHookRuleAction,
   findImmutableRuleById,
-  getPrebuiltRulesAndTimelinesStatus,
-  getSimpleRuleOutput,
   ruleToUpdateSchema,
-  updateUsername,
+  getCustomQueryRuleParams,
+  getPrebuiltRulesAndTimelinesStatus,
 } from '../../utils';
 import { FtrProviderContext } from '../../../../ftr_provider_context';
-import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
 export default ({ getService }: FtrProviderContext) => {
   const es = getService('es');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const log = getService('log');
-  // TODO: add a new service
-  const config = getService('config');
-  const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
-  const isServerless = config.get('serverless');
-  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
-  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
   const getImmutableRule = async () => {
     await installMockPrebuiltRules(supertest, es);
-    return getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+    return fetchRule(supertest, { ruleId: ELASTIC_SECURITY_RULE_ID });
   };
 
   describe('@serverless @ess update_actions', () => {
     describe('updating actions', () => {
-      before(async () => {
-        await esArchiver.load(path);
-      });
-
-      after(async () => {
-        await esArchiver.unload(path);
-      });
-
       beforeEach(async () => {
-        await createAlertsIndex(supertest, log);
-      });
-
-      afterEach(async () => {
         await deleteAllAlerts(supertest, log, es);
         await deleteAllRules(supertest, log);
       });
 
-      it('should be able to create a new webhook action and update a rule with the webhook action', async () => {
-        const hookAction = await createNewAction(supertest, log);
-        const rule = getSimpleRule();
-        await createRule(supertest, log, rule);
-        const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, rule);
-        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
-        const bodyToCompare = removeServerGeneratedProperties(updatedRule);
-
-        const expectedRule = {
-          ...getSimpleRuleOutputWithWebHookAction(
-            `${bodyToCompare.actions?.[0].id}`,
-            `${bodyToCompare.actions?.[0].uuid}`
-          ),
-          revision: 1, // revision bump is required since this is an updated rule and this is part of the testing that we do bump the revision number on update
+      it('updates rule with a webhook action', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .send(getCustomQueryRuleParams({ rule_id: 'rule-1' }))
+          .expect(200);
+
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
         };
-        const expectedRuleWithUserUpdated = updateUsername(expectedRule, ELASTICSEARCH_USERNAME);
+        const updatedRule = await updateRule(
+          supertest,
+          getCustomQueryRuleParams({
+            rule_id: 'rule-1',
+            actions: [ruleAction],
+          })
+        );
 
-        expect(bodyToCompare).to.eql(expectedRuleWithUserUpdated);
+        expect(updatedRule.actions).toEqual([expect.objectContaining(ruleAction)]);
       });
 
-      it('should be able to add a new webhook action and then remove the action from the rule again', async () => {
-        const hookAction = await createNewAction(supertest, log);
-        const rule = getSimpleRule();
-        await createRule(supertest, log, rule);
-        const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, rule);
-        await updateRule(supertest, log, ruleToUpdate);
-        const ruleAfterActionRemoved = await updateRule(supertest, log, rule);
-        const bodyToCompare = removeServerGeneratedProperties(ruleAfterActionRemoved);
-        const expected = {
-          ...getSimpleRuleOutput(),
-          revision: 2, // revision bump is required since this is an updated rule and this is part of the testing that we do bump the revision number on update
-        };
-        const expectedRuleWithUserUpdated = updateUsername(expected, ELASTICSEARCH_USERNAME);
-        expect(bodyToCompare).to.eql(expectedRuleWithUserUpdated);
-      });
+      it('removes webhook from a rule', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .send(
+            getCustomQueryRuleParams({
+              rule_id: 'rule-1',
+              actions: [
+                {
+                  group: 'default',
+                  id: webhookAction.id,
+                  params: {
+                    body: '{}',
+                  },
+                  action_type_id: '.webhook',
+                },
+              ],
+            })
+          )
+          .expect(200);
+
+        const updatedRule = await updateRule(
+          supertest,
+          getCustomQueryRuleParams({
+            rule_id: 'rule-1',
+            actions: undefined,
+          })
+        );
 
-      it('should be able to create a new webhook action and attach it to a rule without a meta field and run it correctly', async () => {
-        const hookAction = await createNewAction(supertest, log);
-        const rule = getSimpleRule();
-        await createRule(supertest, log, rule);
-        const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, true, rule);
-        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
-        await waitForRuleSuccess({ supertest, log, id: updatedRule.id });
+        expect(updatedRule.actions).toEqual([]);
       });
 
-      it('@skipInQA should be able to create a new webhook action and attach it to a rule with a meta field and run it correctly', async () => {
-        const hookAction = await createNewAction(supertest, log);
-        const rule = getSimpleRule();
-        await createRule(supertest, log, rule);
-        const ruleToUpdate: RuleCreateProps = {
-          ...getRuleWithWebHookAction(hookAction.id, true, rule),
-          meta: {}, // create a rule with the action attached and a meta field
+      it('expects an updated rule with a webhook action runs successfully', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .send(getCustomQueryRuleParams({ rule_id: 'rule-1' }))
+          .expect(200);
+
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
         };
-        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
+        const updatedRule = await updateRule(
+          supertest,
+          getCustomQueryRuleParams({
+            rule_id: 'rule-1',
+            actions: [ruleAction],
+            enabled: true,
+          })
+        );
+
         await waitForRuleSuccess({ supertest, log, id: updatedRule.id });
-      });
 
-      it('@skipInQA should not change properties of immutable rule when applying actions to it', async () => {
-        // actions and throttle to be removed from assertion (it asserted in a separate test case)
-        const actionsProps = ['actions', 'throttle'];
+        const { body } = await supertest
+          .get(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .query({ id: updatedRule.id })
+          .expect(200);
 
-        const immutableRule = await getImmutableRule();
-        const hookAction = await createNewAction(supertest, log);
-        const ruleToUpdate = getRuleWithWebHookAction(
-          hookAction.id,
-          immutableRule.enabled,
-          ruleToUpdateSchema(immutableRule)
-        );
-        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
-        const expected = omit(removeServerGeneratedProperties(updatedRule), actionsProps);
+        expect(body?.execution_summary?.last_execution?.status).toBe('succeeded');
+      });
 
-        const immutableRuleToAssert = {
-          ...omit(removeServerGeneratedProperties(immutableRule), actionsProps),
-          revision: 1, // Unlike `version` which is static for immutable rules, `revision` will increment when an action/exception is added
+      it('@skipInQA expects an updated rule with a webhook action and meta field runs successfully', async () => {
+        const webhookAction = await createWebHookRuleAction(supertest);
+
+        await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .send(getCustomQueryRuleParams({ rule_id: 'rule-1' }))
+          .expect(200);
+
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
         };
+        const updatedRule = await updateRule(
+          supertest,
+          getCustomQueryRuleParams({
+            rule_id: 'rule-1',
+            actions: [ruleAction],
+            meta: {},
+            enabled: true,
+          })
+        );
 
-        expect(immutableRuleToAssert).to.eql(expected);
-        expect(expected.immutable).to.be(true); // It should stay immutable true when returning
+        await waitForRuleSuccess({ supertest, log, id: updatedRule.id });
+
+        const { body } = await supertest
+          .get(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .set('elastic-api-version', '2023-10-31')
+          .query({ id: updatedRule.id })
+          .expect(200);
+
+        expect(body?.execution_summary?.last_execution?.status).toBe('succeeded');
       });
 
-      it('@skipInQA should be able to create a new webhook action and attach it to an immutable rule', async () => {
+      it('@skipInQA adds a webhook to an immutable rule', async () => {
         const immutableRule = await getImmutableRule();
-        const hookAction = await createNewAction(supertest, log);
-        const ruleToUpdate = getRuleWithWebHookAction(
-          hookAction.id,
-          immutableRule.enabled,
-          ruleToUpdateSchema(immutableRule)
-        );
-        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
-        const bodyToCompare = removeServerGeneratedProperties(updatedRule);
-
-        const expected = getSimpleRuleOutputWithWebHookAction(
-          `${bodyToCompare.actions?.[0].id}`,
-          `${bodyToCompare.actions?.[0].uuid}`
+        const webhookAction = await createWebHookRuleAction(supertest);
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
+        };
+        const updatedRule = await updateRule(
+          supertest,
+          getCustomQueryRuleParams({
+            rule_id: ELASTIC_SECURITY_RULE_ID,
+            actions: [ruleAction],
+          })
         );
 
-        const expectedRuleWithUserUpdated = updateUsername(expected, ELASTICSEARCH_USERNAME);
-        expect(bodyToCompare.actions).to.eql(expectedRuleWithUserUpdated.actions);
-        expect(bodyToCompare.throttle).to.eql(expectedRuleWithUserUpdated.throttle);
+        expect(updatedRule.actions).toEqual([expect.objectContaining(ruleAction)]);
+        expect(updatedRule.throttle).toEqual(immutableRule.throttle);
       });
 
       it('@skipInQA should be able to create a new webhook action, attach it to an immutable rule and the count of prepackaged rules should not increase. If this fails, suspect the immutable tags are not staying on the rule correctly.', async () => {
         const immutableRule = await getImmutableRule();
-        const hookAction = await createNewAction(supertest, log);
+        const hookAction = await createWebHookRuleAction(supertest);
         const ruleToUpdate = getRuleWithWebHookAction(
           hookAction.id,
           immutableRule.enabled,
           ruleToUpdateSchema(immutableRule)
         );
-        await updateRule(supertest, log, ruleToUpdate);
+        await updateRule(supertest, ruleToUpdate);
 
         const status = await getPrebuiltRulesAndTimelinesStatus(supertest);
-        expect(status.rules_not_installed).to.eql(0);
+        expect(status.rules_not_installed).toBe(0);
       });
 
       it('@skipInQA should be able to create a new webhook action, attach it to an immutable rule and the rule should stay immutable when searching against immutable tags', async () => {
         const immutableRule = await getImmutableRule();
-        const hookAction = await createNewAction(supertest, log);
+        const webhookAction = await createWebHookRuleAction(supertest);
+        const ruleAction = {
+          group: 'default',
+          id: webhookAction.id,
+          params: {
+            body: '{}',
+          },
+          action_type_id: '.webhook',
+        };
         const ruleToUpdate = getRuleWithWebHookAction(
-          hookAction.id,
+          webhookAction.id,
           immutableRule.enabled,
           ruleToUpdateSchema(immutableRule)
         );
-        await updateRule(supertest, log, ruleToUpdate);
+        await updateRule(supertest, ruleToUpdate);
         const body = await findImmutableRuleById(supertest, log, ELASTIC_SECURITY_RULE_ID);
 
-        expect(body.data.length).to.eql(1); // should have only one length to the data set, otherwise we have duplicates or the tags were removed and that is incredibly bad.
-        const bodyToCompare = removeServerGeneratedProperties(body.data[0]);
-        const expected = getSimpleRuleOutputWithWebHookAction(
-          `${bodyToCompare.actions?.[0].id}`,
-          `${bodyToCompare.actions?.[0].uuid}`
-        );
-        const expectedRuleWithUserUpdated = updateUsername(expected, ELASTICSEARCH_USERNAME);
-        expect(bodyToCompare.actions).to.eql(expectedRuleWithUserUpdated.actions);
-        expect(bodyToCompare.immutable).to.be(true);
+        expect(body.data.length).toBe(1); // should have only one length to the data set, otherwise we have duplicates or the tags were removed and that is incredibly bad.
+        expect(body.data[0].actions).toEqual([expect.objectContaining(ruleAction)]);
+        expect(body.data[0].immutable).toBeTruthy();
       });
     });
   });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/alerts_compatibility.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/alerts_compatibility.ts
index 9e4a9d05771d15..7df54659da8ced 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/alerts_compatibility.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/alerts_compatibility.ts
@@ -36,7 +36,7 @@ import {
   waitFor,
   waitForRuleSuccess,
   waitForAlertsToBePresent,
-  removeRandomValuedProperties,
+  removeRandomValuedPropertiesFromAlert,
 } from '../../utils';
 import { FtrProviderContext } from '../../../../ftr_provider_context';
 
@@ -231,11 +231,11 @@ export default ({ getService }: FtrProviderContext) => {
         expect(signalsOpen.hits.hits.length).greaterThan(0);
         const hit = signalsOpen.hits.hits[0];
         expect(hit._source?.kibana).to.eql(undefined);
-        const source = removeRandomValuedProperties(hit._source);
+        const source = removeRandomValuedPropertiesFromAlert(hit._source);
         expect(source).to.eql({
           'kibana.alert.rule.category': 'Custom Query Rule',
           'kibana.alert.rule.consumer': 'siem',
-          'kibana.alert.rule.name': 'Signal Testing Query',
+          'kibana.alert.rule.name': 'Alert Testing Query',
           'kibana.alert.rule.producer': 'siem',
           'kibana.alert.rule.rule_type_id': 'siem.queryRule',
           'kibana.space_ids': ['default'],
@@ -322,7 +322,7 @@ export default ({ getService }: FtrProviderContext) => {
           'kibana.alert.workflow_tags': [],
           'kibana.alert.depth': 2,
           'kibana.alert.reason':
-            'event on security-linux-1 created high alert Signal Testing Query.',
+            'event on security-linux-1 created high alert Alert Testing Query.',
           'kibana.alert.severity': 'high',
           'kibana.alert.risk_score': 1,
           'kibana.alert.rule.parameters': {
@@ -393,11 +393,11 @@ export default ({ getService }: FtrProviderContext) => {
         expect(signalsOpen.hits.hits.length).greaterThan(0);
         const hit = signalsOpen.hits.hits[0];
         expect(hit._source?.kibana).to.eql(undefined);
-        const source = removeRandomValuedProperties(hit._source);
+        const source = removeRandomValuedPropertiesFromAlert(hit._source);
         expect(source).to.eql({
           'kibana.alert.rule.category': 'Custom Query Rule',
           'kibana.alert.rule.consumer': 'siem',
-          'kibana.alert.rule.name': 'Signal Testing Query',
+          'kibana.alert.rule.name': 'Alert Testing Query',
           'kibana.alert.rule.producer': 'siem',
           'kibana.alert.rule.rule_type_id': 'siem.queryRule',
           'kibana.space_ids': ['default'],
@@ -484,7 +484,7 @@ export default ({ getService }: FtrProviderContext) => {
           'kibana.alert.workflow_tags': [],
           'kibana.alert.depth': 2,
           'kibana.alert.reason':
-            'event on security-linux-1 created high alert Signal Testing Query.',
+            'event on security-linux-1 created high alert Alert Testing Query.',
           'kibana.alert.severity': 'high',
           'kibana.alert.risk_score': 1,
           'kibana.alert.rule.parameters': {
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
index ec10972a7062e7..9d03e3503a4809 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
@@ -17,7 +17,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     testFiles: [require.resolve('..')],
     junit: {
       reportName:
-        'Detection Engine ESS/ Exception Operators Data Types API date_numeric_types Integration Tests',
+        'Detection Engine ESS - Exception Operators Data Types API - Date_numeric_types Integration Tests',
     },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
index 3ec867abab432e..df64ace832d802 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
@@ -11,6 +11,6 @@ export default createTestConfig({
   testFiles: [require.resolve('..')],
   junit: {
     reportName:
-      'Detection Engine Serverless/ Exception Operators Data Types date_numeric_types API Integration Tests',
+      'Detection Engine Serverless - Exception Operators Data Types API - Date_numeric_types Integration Tests',
   },
 });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
index 2ba798031818e9..966bcfa8f269a9 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
@@ -7,7 +7,7 @@
 import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
 export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('Detection exceptions data types and operators', function () {
+  describe('Detection exceptions data and numeric types', function () {
     loadTestFile(require.resolve('./date'));
     loadTestFile(require.resolve('./double'));
     loadTestFile(require.resolve('./float'));
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/ess.config.ts
similarity index 86%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/ess.config.ts
index 221f6d883bd35d..114f4e628b7ac8 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/ess.config.ts
@@ -17,7 +17,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     testFiles: [require.resolve('..')],
     junit: {
       reportName:
-        'Detection Engine ESS/ Exception Operators Data Types API ips_text_array Integration Tests',
+        'Detection Engine ESS - Exception Operators Data Types API- IPS Integration Tests',
     },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/serverless.config.ts
similarity index 80%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/serverless.config.ts
index c81563fdad84b8..80ec0198524b33 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/configs/serverless.config.ts
@@ -11,6 +11,6 @@ export default createTestConfig({
   testFiles: [require.resolve('..')],
   junit: {
     reportName:
-      'Detection Engine Serverless/ Exception Operators Data Types ips_text_array API Integration Tests',
+      'Detection Engine Serverless - Exception Operators Data Types API- IPS API Integration Tests',
   },
 });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/index.ts
similarity index 55%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/index.ts
index ac107392d4b5c3..ae58fe9aa371ba 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/index.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 5', function () {
-    loadTestFile(require.resolve('./keyword_family'));
+  describe('Detection exceptions IPs', function () {
+    loadTestFile(require.resolve('./ip'));
+    loadTestFile(require.resolve('./ip_array'));
   });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/ip.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/ip.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/ip_array.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips/ip_array.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/ess.config.ts
similarity index 86%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/ess.config.ts
index b9689194300647..8b19e9b0d8c6da 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/ess.config.ts
@@ -17,7 +17,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     testFiles: [require.resolve('..')],
     junit: {
       reportName:
-        'Detection Engine ESS/ Exception Operators Data Types API keyword_text_long Integration Tests',
+        'Detection Engine ESS - Exception Operators Data Types API- Keyword Integration Tests',
     },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/serverless.config.ts
similarity index 80%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/serverless.config.ts
index daf867a3a68390..3e209f3c04e852 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/configs/serverless.config.ts
@@ -11,6 +11,6 @@ export default createTestConfig({
   testFiles: [require.resolve('..')],
   junit: {
     reportName:
-      'Detection Engine Serverless/ Exception Operators Data Types keyword_text_long API Integration Tests',
+      'Detection Engine Serverless - Exception Operators Data Types API - Keyword Integration Tests',
   },
 });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/index.ts
similarity index 75%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/index.ts
index ad0a5d847b0fde..4325aa331f1464 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/index.ts
@@ -8,10 +8,8 @@
 import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
 export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('Detection exceptions data types and operators', function () {
+  describe('Detection exceptions Keyword', function () {
     loadTestFile(require.resolve('./keyword'));
     loadTestFile(require.resolve('./keyword_array'));
-    loadTestFile(require.resolve('./long'));
-    loadTestFile(require.resolve('./text'));
   });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/keyword.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/keyword.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/keyword_array.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword/keyword_array.ts
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/ess.config.ts
similarity index 59%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/ess.config.ts
index 2430b8f2148d9a..5438e929d9b22d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/ess.config.ts
@@ -7,12 +7,17 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName:
+        'Detection Engine ESS - Exception Operators Data Types API - Long Integration Tests',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/serverless.config.ts
new file mode 100644
index 00000000000000..646062b09db91f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/configs/serverless.config.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine Serverless - Exception Operators Data Types API - Long Integration Tests',
+  },
+});
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/helpers/get_metric_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/index.ts
similarity index 51%
rename from x-pack/plugins/observability/public/components/custom_threshold/helpers/get_metric_id.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/index.ts
index a60af79ac6e2da..2a1acd57cba398 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/helpers/get_metric_id.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/index.ts
@@ -5,8 +5,10 @@
  * 2.0.
  */
 
-import { MetricsExplorerOptionsMetric } from '../../../../common/custom_threshold_rule/types';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-export const getMetricId = (metric: MetricsExplorerOptionsMetric, index: string | number) => {
-  return `metric_${index}`;
+export default ({ loadTestFile }: FtrProviderContext): void => {
+  describe('Detection exceptions long', function () {
+    loadTestFile(require.resolve('./long'));
+  });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/long.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/long.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/long.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/long/long.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/ess.config.ts
new file mode 100644
index 00000000000000..01bb5ebdd21eb5
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/ess.config.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName:
+        'Detection Engine ESS - - Exception Operators Data Types API - Text Integration Tests',
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/serverless.config.ts
new file mode 100644
index 00000000000000..3c67f4c7ad06cc
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/configs/serverless.config.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine Serverless - Exception Operators Data Types API - Text Integration Tests',
+  },
+});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/index.ts
similarity index 85%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/index.ts
index 63f4639a964120..38354ffdcb3656 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/index.ts
@@ -10,7 +10,6 @@ import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection exceptions data types and operators', function () {
     loadTestFile(require.resolve('./text_array'));
-    loadTestFile(require.resolve('./ip'));
-    loadTestFile(require.resolve('./ip_array'));
+    loadTestFile(require.resolve('./text'));
   });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/text.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/text.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/text.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/text.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/text_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/text_array.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/text_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/text/text_array.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
index 19391784466d38..4a9004910d3b52 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
@@ -16,7 +16,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     ...functionalConfig.getAll(),
     testFiles: [require.resolve('..')],
     junit: {
-      reportName: 'Detection Engine ESS/ Exception Workflows API Integration Tests',
+      reportName: 'Detection Engine ESS - Exception - Workflows API Integration Tests',
     },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
index 1702c03591b640..32e5ca5e8d0616 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
@@ -10,6 +10,6 @@ import { createTestConfig } from '../../../../../../config/serverless/config.bas
 export default createTestConfig({
   testFiles: [require.resolve('..')],
   junit: {
-    reportName: 'Detection Engine Serverless/ Exception Workflows API Integration Tests',
+    reportName: 'Detection Engine Serverless - Exception - Workflows API Integration Tests',
   },
 });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
index 7a4b757c80775c..3607cba64151e6 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
@@ -17,7 +17,7 @@ import {
 } from '@kbn/securitysolution-io-ts-list-types';
 import { getCreateExceptionListMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
 import {
-  getRule,
+  fetchRule,
   createRule,
   getSimpleRule,
   createAlertsIndex,
@@ -78,7 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
         })
         .expect(200);
 
-      const udpatedRule = await getRule(supertest, log, rule.rule_id);
+      const udpatedRule = await fetchRule(supertest, { ruleId: rule.rule_id });
       const defaultList = udpatedRule.exceptions_list.find((list) => list.type === 'rule_default');
 
       const itemsWithoutServerGeneratedValues = items.map(
@@ -134,7 +134,7 @@ export default ({ getService }: FtrProviderContext) => {
         })
         .expect(200);
 
-      const udpatedRule = await getRule(supertest, log, rule.rule_id);
+      const udpatedRule = await fetchRule(supertest, { ruleId: rule.rule_id });
       const defaultList = udpatedRule.exceptions_list.find((list) => list.type === 'rule_default');
 
       const itemsWithoutServerGeneratedValues = items.map(
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
index fb5c385ab2c7b4..f62501b026c205 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
@@ -31,7 +31,7 @@ import { ELASTIC_SECURITY_RULE_ID } from '@kbn/security-solution-plugin/common';
 import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 import {
   createAlertsIndex,
-  getRule,
+  fetchRule,
   createRule,
   getSimpleRule,
   deleteAllRules,
@@ -184,7 +184,9 @@ export default ({ getService }: FtrProviderContext) => {
           await installMockPrebuiltRules(supertest, es);
 
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one exceptions_list
 
           // remove the exceptions list as a user is allowed to remove it from an immutable rule
@@ -195,7 +197,9 @@ export default ({ getService }: FtrProviderContext) => {
             .send({ rule_id: ELASTIC_SECURITY_RULE_ID, exceptions_list: [] })
             .expect(200);
 
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRuleSecondTime.exceptions_list.length).toEqual(0);
         });
 
@@ -209,7 +213,9 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -231,7 +237,9 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           expect(immutableRuleSecondTime.exceptions_list.length).toEqual(2);
         });
@@ -240,7 +248,9 @@ export default ({ getService }: FtrProviderContext) => {
           await installMockPrebuiltRules(supertest, es);
 
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           await supertest
@@ -252,7 +262,9 @@ export default ({ getService }: FtrProviderContext) => {
 
           await downgradeImmutableRule(es, log, ELASTIC_SECURITY_RULE_ID);
           await installMockPrebuiltRules(supertest, es);
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           // We should have a length of 1 and it should be the same as our original before we tried to remove it using patch
           expect(immutableRuleSecondTime.exceptions_list.length).toEqual(1);
@@ -269,7 +281,9 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           // remove the exception list and only have a single list that is not an endpoint_list
@@ -292,7 +306,9 @@ export default ({ getService }: FtrProviderContext) => {
 
           await downgradeImmutableRule(es, log, ELASTIC_SECURITY_RULE_ID);
           await installMockPrebuiltRules(supertest, es);
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           expect(immutableRuleSecondTime.exceptions_list).toEqual([
             ...immutableRule.exceptions_list,
@@ -309,13 +325,17 @@ export default ({ getService }: FtrProviderContext) => {
           await installMockPrebuiltRules(supertest, es);
 
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           await downgradeImmutableRule(es, log, ELASTIC_SECURITY_RULE_ID);
           await installMockPrebuiltRules(supertest, es);
 
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           // The installed rule should have both the original immutable exceptions list back and the
           // new list the user added.
@@ -334,7 +354,9 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
           await supertest
@@ -357,7 +379,9 @@ export default ({ getService }: FtrProviderContext) => {
 
           await downgradeImmutableRule(es, log, ELASTIC_SECURITY_RULE_ID);
           await installMockPrebuiltRules(supertest, es);
-          const immutableRuleSecondTime = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRuleSecondTime = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
 
           // It should be the same as what the user added originally
           expect(immutableRuleSecondTime.exceptions_list).toEqual([
@@ -390,7 +414,7 @@ export default ({ getService }: FtrProviderContext) => {
             throw new Error('Cannot find a rule without exceptions_list in the sample data');
           }
 
-          const immutableRule = await getRule(supertest, log, ruleId);
+          const immutableRule = await fetchRule(supertest, { ruleId });
           expect(immutableRule.exceptions_list.length).toEqual(0); // make sure we have no exceptions_list
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -413,7 +437,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           await downgradeImmutableRule(es, log, ruleId);
           await installMockPrebuiltRules(supertest, es);
-          const immutableRuleSecondTime = await getRule(supertest, log, ruleId);
+          const immutableRuleSecondTime = await fetchRule(supertest, { ruleId });
 
           expect(immutableRuleSecondTime.exceptions_list).toEqual([
             {
@@ -435,7 +459,9 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -476,7 +502,9 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, log, ELASTIC_SECURITY_RULE_ID);
+          const immutableRule = await fetchRule(supertest, {
+            ruleId: ELASTIC_SECURITY_RULE_ID,
+          });
           expect(immutableRule.exceptions_list.length).toBeGreaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -533,7 +561,8 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
 
-      describe('tests with auditbeat data', () => {
+      // FLAKY: https://github.com/elastic/kibana/issues/169664
+      describe.skip('tests with auditbeat data', () => {
         before(async () => {
           await esArchiver.load(path);
         });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
index 5ace976f1f4fc8..a887f07cb2cfe5 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import expect from '@kbn/expect';
+import { omit } from 'lodash';
+import expect from 'expect';
 
 import {
   DETECTION_ENGINE_RULES_URL,
@@ -13,45 +14,33 @@ import {
   NOTIFICATION_THROTTLE_NO_ACTIONS,
   NOTIFICATION_THROTTLE_RULE,
 } from '@kbn/security-solution-plugin/common/constants';
-import { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
 
 import { FtrProviderContext } from '../../../../ftr_provider_context';
 import {
-  createAlertsIndex,
   deleteAllRules,
-  getSimpleRule,
-  getSimpleRuleOutput,
-  getSimpleRuleOutputWithoutRuleId,
-  getSimpleRuleWithoutRuleId,
-  removeServerGeneratedProperties,
-  removeServerGeneratedPropertiesIncludingRuleId,
-  getSimpleMlRule,
-  getSimpleMlRuleOutput,
   waitForRuleSuccess,
-  getRuleForAlertTesting,
-  getRuleForAlertTestingWithTimestampOverride,
   waitForAlertToComplete,
   waitForAlertsToBePresent,
-  getThresholdRuleForAlertTesting,
   waitForRulePartialFailure,
-  createRule,
   deleteAllAlerts,
-  removeUUIDFromActions,
   getActionsWithFrequencies,
   getActionsWithoutFrequencies,
   getSomeActionsWithFrequencies,
-  updateUsername,
+  getCustomQueryRuleParams,
+  getSavedQueryRuleParams,
+  getMLRuleParams,
+  getThresholdRuleParams,
+  generateEvent,
+  fetchRule,
 } from '../../utils';
 import {
   createUserAndRole,
   deleteUserAndRole,
 } from '../../../../../common/services/security_solution';
-import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
 export default ({ getService }: FtrProviderContext) => {
-  const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
@@ -59,60 +48,67 @@ export default ({ getService }: FtrProviderContext) => {
   // TODO: add a new service
   const config = getService('config');
   const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
-  const isServerless = config.get('serverless');
-  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
-  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
   describe('@serverless @ess create_rules', () => {
-    describe('creating rules', () => {
+    describe('rule creation', () => {
       before(async () => {
-        await esArchiver.load(path);
-      });
-
-      after(async () => {
-        await esArchiver.unload(path);
+        await es.indices.delete({ index: 'logs-test', ignore_unavailable: true });
+        await es.indices.create({
+          index: 'logs-test',
+          mappings: {
+            properties: {
+              '@timestamp': {
+                type: 'date',
+              },
+            },
+          },
+        });
       });
 
       beforeEach(async () => {
-        await createAlertsIndex(supertest, log);
-      });
-
-      afterEach(async () => {
         await deleteAllAlerts(supertest, log, es);
         await deleteAllRules(supertest, log);
       });
 
-      describe('saved query', () => {
-        it('should create a saved query rule and query a data view', async () => {
-          const savedQueryRule = {
-            ...getSimpleRule(),
-            data_view_id: 'my-data-view',
-            type: 'saved_query',
-            saved_id: 'my-saved-query-id',
-          };
+      describe('elastic admin', () => {
+        it('creates a custom query rule', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(savedQueryRule)
+            .send(getCustomQueryRuleParams())
             .expect(200);
 
-          expect(body.data_view_id).to.eql('my-data-view');
+          expect(body).toEqual(
+            expect.objectContaining({
+              ...getCustomQueryRuleParams(),
+              created_by: ELASTICSEARCH_USERNAME,
+              updated_by: ELASTICSEARCH_USERNAME,
+            })
+          );
         });
-      });
 
-      describe('elastic admin', () => {
-        it('should create a single rule with a rule_id', async () => {
+        it('creates a saved query rule', async () => {
+          const savedQueryRuleParams = getSavedQueryRuleParams({
+            data_view_id: 'my-data-view',
+            type: 'saved_query',
+            saved_id: 'my-saved-query-id',
+          });
+
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleRule())
+            .send(savedQueryRuleParams)
             .expect(200);
 
-          const bodyToCompare = removeServerGeneratedProperties(body);
-          const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-          expect(bodyToCompare).to.eql(expectedRule);
+          expect(body).toEqual(
+            expect.objectContaining({
+              ...savedQueryRuleParams,
+              created_by: ELASTICSEARCH_USERNAME,
+              updated_by: ELASTICSEARCH_USERNAME,
+            })
+          );
         });
 
         /*
@@ -134,183 +130,149 @@ export default ({ getService }: FtrProviderContext) => {
          This adds an e2e test for the backend to catch that in case
          this pops up again elsewhere.
         */
-        it('should create a single rule with a rule_id and validate it ran successfully', async () => {
-          const rule = {
-            ...getRuleForAlertTesting(['auditbeat-*']),
-            query: 'process.executable: "/usr/bin/sudo"',
-          };
-          const { body } = await supertest
+        it('expects rule runs successfully', async () => {
+          const {
+            body: { id },
+          } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(getCustomQueryRuleParams({ enabled: true }))
             .expect(200);
 
-          await waitForRuleSuccess({ supertest, log, id: body.id });
+          await waitForRuleSuccess({ supertest, log, id });
+
+          const rule = await fetchRule(supertest, { id });
+
+          expect(rule?.execution_summary?.last_execution?.status).toBe('succeeded');
         });
 
-        it('should create a single rule with a rule_id and an index pattern that does not match anything available and partial failure for the rule', async () => {
-          const simpleRule = getRuleForAlertTesting(['does-not-exist-*']);
-          const { body } = await supertest
+        it('expects rule partial failure due to index pattern matching nothing', async () => {
+          const {
+            body: { id },
+          } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(simpleRule)
+            .send(
+              getCustomQueryRuleParams({
+                index: ['does-not-exist-*'],
+                enabled: true,
+              })
+            )
             .expect(200);
 
           await waitForRulePartialFailure({
             supertest,
             log,
-            id: body.id,
+            id,
           });
 
-          const { body: rule } = await supertest
-            .get(DETECTION_ENGINE_RULES_URL)
-            .set('kbn-xsrf', 'true')
-            .set('elastic-api-version', '2023-10-31')
-            .query({ id: body.id })
-            .expect(200);
+          const rule = await fetchRule(supertest, { id });
 
-          // TODO: https://github.com/elastic/kibana/pull/121644 clean up, make type-safe
-          expect(rule?.execution_summary?.last_execution.status).to.eql('partial failure');
-          expect(rule?.execution_summary?.last_execution.message).to.eql(
+          expect(rule?.execution_summary?.last_execution.status).toBe('partial failure');
+          expect(rule?.execution_summary?.last_execution.message).toBe(
             'This rule is attempting to query data from Elasticsearch indices listed in the "Index patterns" section of the rule definition, however no index matching: ["does-not-exist-*"] was found. This warning will continue to appear until a matching index is created or this rule is disabled.'
           );
         });
 
-        it('should create a single rule with a rule_id and an index pattern that does not match anything and an index pattern that does and the rule should be successful', async () => {
-          const rule = {
-            ...getRuleForAlertTesting(['does-not-exist-*', 'auditbeat-*']),
-            query: 'process.executable: "/usr/bin/sudo"',
-          };
-          const { body } = await supertest
+        it('expects rule runs successfully with only one index pattern matching existing index', async () => {
+          const {
+            body: { id },
+          } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(
+              getCustomQueryRuleParams({
+                index: ['does-not-exist-*', 'logs-test'],
+                enabled: true,
+              })
+            )
             .expect(200);
 
-          await waitForRuleSuccess({ supertest, log, id: body.id });
+          await waitForRuleSuccess({ supertest, log, id });
+
+          const rule = await fetchRule(supertest, { id });
+
+          expect(rule?.execution_summary?.last_execution?.status).toBe('succeeded');
         });
 
-        it('should create a single rule without an input index', async () => {
-          const rule: RuleCreateProps = {
-            name: 'Simple Rule Query',
-            description: 'Simple Rule Query',
-            enabled: true,
-            risk_score: 1,
-            rule_id: 'rule-1',
-            severity: 'high',
-            type: 'query',
-            query: 'user.name: root or user.name: admin',
-          };
-          const expected = {
-            actions: [],
-            author: [],
-            created_by: ELASTICSEARCH_USERNAME,
-            description: 'Simple Rule Query',
-            enabled: true,
-            false_positives: [],
-            from: 'now-6m',
-            immutable: false,
-            interval: '5m',
-            rule_id: 'rule-1',
-            language: 'kuery',
-            output_index: '',
-            max_signals: 100,
-            risk_score: 1,
-            risk_score_mapping: [],
-            name: 'Simple Rule Query',
-            query: 'user.name: root or user.name: admin',
-            references: [],
-            related_integrations: [],
-            required_fields: [],
-            revision: 0,
-            setup: '',
-            severity: 'high',
-            severity_mapping: [],
-            updated_by: ELASTICSEARCH_USERNAME,
-            tags: [],
-            to: 'now',
-            type: 'query',
-            threat: [],
-            exceptions_list: [],
-            version: 1,
-          };
+        it('creates a rule without an input index', async () => {
+          const ruleParams = getCustomQueryRuleParams({
+            index: undefined,
+          });
 
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(ruleParams)
             .expect(200);
 
-          const bodyToCompare = removeServerGeneratedProperties(body);
-          expect(bodyToCompare).to.eql(expected);
+          expect(body.index).toBeUndefined();
+          expect(body).toEqual(expect.objectContaining(omit(ruleParams, 'index')));
         });
 
-        it('should create a single rule without a rule_id', async () => {
+        it('creates a custom query rule without rule_id specified', async () => {
+          const ruleParams = getCustomQueryRuleParams({
+            rule_id: undefined,
+          });
+
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleRuleWithoutRuleId())
+            .send(ruleParams)
             .expect(200);
 
-          const bodyToCompare = removeServerGeneratedPropertiesIncludingRuleId(body);
-          const expectedRule = updateUsername(
-            getSimpleRuleOutputWithoutRuleId(),
-            ELASTICSEARCH_USERNAME
+          expect(body).toEqual(
+            expect.objectContaining({ ...ruleParams, rule_id: expect.any(String) })
           );
-          expect(bodyToCompare).to.eql(expectedRule);
         });
 
-        it('creates a single Machine Learning rule from a legacy ML Rule format', async () => {
-          const legacyMlRule = {
-            ...getSimpleMlRule(),
-            machine_learning_job_id: 'some_job_id',
-          };
+        it('creates a ML rule with legacy machine_learning_job_id', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(legacyMlRule)
+            .send(getMLRuleParams({ machine_learning_job_id: 'some_job_id' }))
             .expect(200);
 
-          const bodyToCompare = removeServerGeneratedProperties(body);
-          const expectedRule = updateUsername(getSimpleMlRuleOutput(), ELASTICSEARCH_USERNAME);
-          expect(bodyToCompare).to.eql(expectedRule);
+          expect(body).toEqual(
+            expect.objectContaining(getMLRuleParams({ machine_learning_job_id: ['some_job_id'] }))
+          );
         });
 
-        it('should create a single Machine Learning rule', async () => {
+        it('creates a ML rule', async () => {
+          const ruleParams = getMLRuleParams({ machine_learning_job_id: ['some_job_id'] });
+
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleMlRule())
+            .send(ruleParams)
             .expect(200);
 
-          const bodyToCompare = removeServerGeneratedProperties(body);
-          const expectedRule = updateUsername(getSimpleMlRuleOutput(), ELASTICSEARCH_USERNAME);
-          expect(bodyToCompare).to.eql(expectedRule);
+          expect(body).toEqual(expect.objectContaining(ruleParams));
         });
 
-        it('should cause a 409 conflict if we attempt to create the same rule_id twice', async () => {
+        it('causes a 409 conflict if the same rule_id is used twice', async () => {
           await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleRule())
+            .send(getCustomQueryRuleParams({ rule_id: 'rule-1' }))
             .expect(200);
 
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleRule())
+            .send(getCustomQueryRuleParams({ rule_id: 'rule-1' }))
             .expect(409);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             message: 'rule_id: "rule-1" already exists',
             status_code: 409,
           });
@@ -318,117 +280,119 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       describe('exception', () => {
-        it('should not create a rule if trying to add more than one default rule exception list', async () => {
-          const rule: RuleCreateProps = {
-            name: 'Simple Rule Query',
-            description: 'Simple Rule Query',
-            enabled: true,
-            risk_score: 1,
-            rule_id: 'rule-1',
-            severity: 'high',
-            type: 'query',
-            query: 'user.name: root or user.name: admin',
-            exceptions_list: [
-              {
-                id: '2',
-                list_id: '123',
-                namespace_type: 'single',
-                type: ExceptionListTypeEnum.RULE_DEFAULT,
-              },
-              {
-                id: '1',
-                list_id: '456',
-                namespace_type: 'single',
-                type: ExceptionListTypeEnum.RULE_DEFAULT,
-              },
-            ],
-          };
-
+        it('does NOT create a rule if trying to add more than one default rule exception list', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(
+              getCustomQueryRuleParams({
+                exceptions_list: [
+                  {
+                    id: '2',
+                    list_id: '123',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.RULE_DEFAULT,
+                  },
+                  {
+                    id: '1',
+                    list_id: '456',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.RULE_DEFAULT,
+                  },
+                ],
+              })
+            )
             .expect(500);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             message: 'More than one default exception list found on rule',
             status_code: 500,
           });
         });
 
-        it('should not create a rule if trying to add default rule exception list which attached to another', async () => {
-          const rule: RuleCreateProps = {
-            name: 'Simple Rule Query',
-            description: 'Simple Rule Query',
-            enabled: true,
-            risk_score: 1,
-            rule_id: 'rule-1',
-            severity: 'high',
-            type: 'query',
-            query: 'user.name: root or user.name: admin',
-            exceptions_list: [
-              {
-                id: '2',
-                list_id: '123',
-                namespace_type: 'single',
-                type: ExceptionListTypeEnum.RULE_DEFAULT,
-              },
-            ],
-          };
-
+        it('does NOT create a rule when there is an attempt to share non sharable exception ("rule_default" type)', async () => {
           const { body: ruleWithException } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(
+              getCustomQueryRuleParams({
+                rule_id: 'rule-1',
+                exceptions_list: [
+                  {
+                    id: '2',
+                    list_id: '123',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.RULE_DEFAULT,
+                  },
+                ],
+              })
+            )
             .expect(200);
 
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send({ ...rule, rule_id: 'rule-2' })
+            .send(
+              getCustomQueryRuleParams({
+                rule_id: 'rule-2',
+                exceptions_list: [
+                  {
+                    id: '2',
+                    list_id: '123',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.RULE_DEFAULT,
+                  },
+                ],
+              })
+            )
             .expect(409);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             message: `default exception list already exists in rule(s): ${ruleWithException.id}`,
             status_code: 409,
           });
         });
 
-        it('allow to create a rule if trying to add shared rule exception list which attached to another', async () => {
-          const rule: RuleCreateProps = {
-            name: 'Simple Rule Query',
-            description: 'Simple Rule Query',
-            enabled: true,
-            risk_score: 1,
-            rule_id: 'rule-1',
-            severity: 'high',
-            type: 'query',
-            query: 'user.name: root or user.name: admin',
-            exceptions_list: [
-              {
-                id: '2',
-                list_id: '123',
-                namespace_type: 'single',
-                type: ExceptionListTypeEnum.DETECTION,
-              },
-            ],
-          };
-
+        it('creates a rule when shared exception type is used ("detection" type)', async () => {
           await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(
+              getCustomQueryRuleParams({
+                rule_id: 'rule-1',
+                exceptions_list: [
+                  {
+                    id: '2',
+                    list_id: '123',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.DETECTION,
+                  },
+                ],
+              })
+            )
             .expect(200);
 
           await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send({ ...rule, rule_id: 'rule-2' })
+            .send(
+              getCustomQueryRuleParams({
+                rule_id: 'rule-2',
+                exceptions_list: [
+                  {
+                    id: '2',
+                    list_id: '123',
+                    namespace_type: 'single',
+                    type: ExceptionListTypeEnum.DETECTION,
+                  },
+                ],
+              })
+            )
             .expect(200);
         });
       });
@@ -450,22 +414,22 @@ export default ({ getService }: FtrProviderContext) => {
             .auth(role, 'changeme')
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(getSimpleRule())
+            .send(getCustomQueryRuleParams())
             .expect(403);
         });
       });
 
       describe('threshold validation', () => {
-        it('should result in 400 error if no threshold-specific fields are provided', async () => {
-          const { threshold, ...rule } = getThresholdRuleForAlertTesting(['*']);
+        it('returns HTTP 400 error when NO threshold field is provided', async () => {
+          const ruleParams = getThresholdRuleParams();
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(omit(ruleParams, 'threshold'))
             .expect(400);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             error: 'Bad Request',
             message:
               '[request body]: type: Invalid literal value, expected "eql", language: Invalid literal value, expected "eql", type: Invalid literal value, expected "query", type: Invalid literal value, expected "saved_query", saved_id: Required, and 14 more',
@@ -473,70 +437,71 @@ export default ({ getService }: FtrProviderContext) => {
           });
         });
 
-        it('should result in 400 error if more than 3 threshold fields', async () => {
-          const rule = getThresholdRuleForAlertTesting(['*']);
+        it('returns HTTP 400 error when there are more than 3 threshold fields provided', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send({
-              ...rule,
-              threshold: {
-                ...rule.threshold,
-                field: ['field-1', 'field-2', 'field-3', 'field-4'],
-              },
-            })
+            .send(
+              getThresholdRuleParams({
+                threshold: {
+                  field: ['field-1', 'field-2', 'field-3', 'field-4'],
+                  value: 1,
+                },
+              })
+            )
             .expect(400);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             message: ['Number of fields must be 3 or less'],
             status_code: 400,
           });
         });
 
-        it('should result in 400 error if threshold value is less than 1', async () => {
-          const rule = getThresholdRuleForAlertTesting(['*']);
+        it('returns HTTP 400 error when threshold value is less than 1', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send({
-              ...rule,
-              threshold: {
-                ...rule.threshold,
-                value: 0,
-              },
-            })
+            .send(
+              getThresholdRuleParams({
+                threshold: {
+                  field: ['field-1'],
+                  value: 0,
+                },
+              })
+            )
             .expect(400);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             error: 'Bad Request',
             message: '[request body]: threshold.value: Number must be greater than or equal to 1',
             statusCode: 400,
           });
         });
 
-        it('should result in 400 error if cardinality is also an agg field', async () => {
-          const rule = getThresholdRuleForAlertTesting(['*']);
+        it('returns HTTP 400 error when cardinality is also an agg field', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send({
-              ...rule,
-              threshold: {
-                ...rule.threshold,
-                cardinality: [
-                  {
-                    field: 'process.name',
-                    value: 5,
-                  },
-                ],
-              },
-            })
+            .send(
+              getThresholdRuleParams({
+                threshold: {
+                  field: ['process.name'],
+                  value: 1,
+                  cardinality: [
+                    {
+                      field: 'process.name',
+                      value: 5,
+                    },
+                  ],
+                },
+              })
+            )
             .expect(400);
 
-          expect(body).to.eql({
+          expect(body).toEqual({
             message: ['Cardinality of a field that is being aggregated on is always 1'],
             status_code: 400,
           });
@@ -544,38 +509,38 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       describe('investigation_fields', () => {
-        it('should create a rule with investigation_fields', async () => {
-          const rule = {
-            ...getSimpleRule(),
-            investigation_fields: {
-              field_names: ['host.name'],
-            },
-          };
+        it('creates a rule with investigation_fields', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send(
+              getCustomQueryRuleParams({
+                investigation_fields: {
+                  field_names: ['host.name'],
+                },
+              })
+            )
             .expect(200);
 
-          expect(body.investigation_fields).to.eql({
+          expect(body.investigation_fields).toEqual({
             field_names: ['host.name'],
           });
         });
 
-        it('should NOT create a rule with legacy investigation_fields', async () => {
-          const rule = {
-            ...getSimpleRule(),
-            investigation_fields: ['host.name'],
-          };
+        it('does NOT create a rule with legacy investigation_fields', async () => {
           const { body } = await supertest
             .post(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .set('elastic-api-version', '2023-10-31')
-            .send(rule)
+            .send({
+              ...getCustomQueryRuleParams(),
+              // type system doesn't allow to use the legacy format as params for getCustomQueryRuleParams()
+              investigation_fields: ['host.name'],
+            })
             .expect(400);
 
-          expect(body.message).to.eql(
+          expect(body.message).toBe(
             '[request body]: investigation_fields: Expected object, received array, type: Invalid literal value, expected "eql", language: Invalid literal value, expected "eql", investigation_fields: Expected object, received array, investigation_fields: Expected object, received array, and 22 more'
           );
         });
@@ -584,135 +549,141 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('@brokenInServerless missing timestamps', () => {
       beforeEach(async () => {
-        await createAlertsIndex(supertest, log);
-        // to edit these files run the following script
-        // cd $HOME/kibana/x-pack && nvm use && node ../scripts/es_archiver edit security_solution/timestamp_override
-        await esArchiver.load(
-          'x-pack/test/functional/es_archives/security_solution/timestamp_override'
-        );
-      });
-      afterEach(async () => {
+        await es.indices.delete({ index: 'myfakeindex-1', ignore_unavailable: true });
+        await es.indices.create({
+          index: 'myfakeindex-1',
+          mappings: {
+            properties: {
+              '@timestamp': {
+                type: 'date',
+              },
+            },
+          },
+        });
+        await es.index({
+          index: 'myfakeindex-1',
+          document: generateEvent({ '@timestamp': Date.now() - 1 }),
+        });
+        await es.index({
+          index: 'myfakeindex-1',
+          document: generateEvent({ '@timestamp': Date.now() - 2 }),
+        });
         await deleteAllAlerts(supertest, log, es);
         await deleteAllRules(supertest, log);
-        await esArchiver.unload(
-          'x-pack/test/functional/es_archives/security_solution/timestamp_override'
-        );
       });
 
-      it('should create a single rule which has a timestamp override for an index pattern that does not exist and write a partial failure status', async () => {
-        // defaults to event.ingested timestamp override.
-        // event.ingested is one of the timestamp fields set on the es archive data
-        // inside of x-pack/test/functional/es_archives/security_solution/timestamp_override/data.json.gz
-        const simpleRule = getRuleForAlertTestingWithTimestampOverride(['myfakeindex-1']);
-        const { body } = await supertest
+      it('expects partial failure for a rule with timestamp override and index pattern matching no indices', async () => {
+        const {
+          body: { id },
+        } = await supertest
           .post(DETECTION_ENGINE_RULES_URL)
           .set('kbn-xsrf', 'true')
           .set('elastic-api-version', '2023-10-31')
-          .send(simpleRule)
+          .send(
+            getCustomQueryRuleParams({
+              index: ['myfakeindex-1'],
+              timestamp_override: 'event.ingested',
+              enabled: true,
+            })
+          )
           .expect(200);
-        const bodyId = body.id;
 
-        await waitForAlertToComplete(supertest, log, bodyId);
+        await waitForAlertToComplete(supertest, log, id);
         await waitForRulePartialFailure({
           supertest,
           log,
-          id: bodyId,
+          id,
         });
 
-        const { body: rule } = await supertest
-          .get(DETECTION_ENGINE_RULES_URL)
-          .set('kbn-xsrf', 'true')
-          .set('elastic-api-version', '2023-10-31')
-          .query({ id: bodyId })
-          .expect(200);
+        const rule = await fetchRule(supertest, { id });
 
-        // TODO: https://github.com/elastic/kibana/pull/121644 clean up, make type-safe
-        expect(rule?.execution_summary?.last_execution.status).to.eql('partial failure');
-        expect(rule?.execution_summary?.last_execution.message).to.eql(
+        expect(rule?.execution_summary?.last_execution.status).toEqual('partial failure');
+        expect(rule?.execution_summary?.last_execution.message).toEqual(
           'The following indices are missing the timestamp override field "event.ingested": ["myfakeindex-1"]'
         );
       });
 
-      it('should create a single rule which has a timestamp override and generates two signals with a "partial failure" status', async () => {
-        // defaults to event.ingested timestamp override.
-        // event.ingested is one of the timestamp fields set on the es archive data
-        // inside of x-pack/test/functional/es_archives/security_solution/timestamp_override/data.json.gz
-        const simpleRule = getRuleForAlertTestingWithTimestampOverride(['myfa*']);
-        const { body } = await supertest
+      it('generates two signals with a "partial failure" status', async () => {
+        const {
+          body: { id },
+        } = await supertest
           .post(DETECTION_ENGINE_RULES_URL)
           .set('kbn-xsrf', 'true')
           .set('elastic-api-version', '2023-10-31')
-          .send(simpleRule)
+          .send(
+            getCustomQueryRuleParams({
+              index: ['myfa*'],
+              timestamp_override: 'event.ingested',
+              enabled: true,
+            })
+          )
           .expect(200);
-        const bodyId = body.id;
 
         await waitForRulePartialFailure({
           supertest,
           log,
-          id: bodyId,
+          id,
         });
-        await waitForAlertsToBePresent(supertest, log, 2, [bodyId]);
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
 
-        const { body: rule } = await supertest
-          .get(DETECTION_ENGINE_RULES_URL)
-          .set('kbn-xsrf', 'true')
-          .set('elastic-api-version', '2023-10-31')
-          .query({ id: bodyId })
-          .expect(200);
+        const rule = await fetchRule(supertest, { id });
 
-        // TODO: https://github.com/elastic/kibana/pull/121644 clean up, make type-safe
-        expect(rule?.execution_summary?.last_execution.status).to.eql('partial failure');
+        expect(rule?.execution_summary?.last_execution.status).toEqual('partial failure');
       });
     });
 
     describe('@brokenInServerless per-action frequencies', () => {
-      const createSingleRule = async (rule: RuleCreateProps) => {
-        const createdRule = await createRule(supertest, log, rule);
-        createdRule.actions = removeUUIDFromActions(createdRule.actions);
-        return createdRule;
-      };
+      beforeEach(async () => {
+        await deleteAllAlerts(supertest, log, es);
+        await deleteAllRules(supertest, log);
+      });
 
       describe('actions without frequencies', () => {
         [undefined, NOTIFICATION_THROTTLE_NO_ACTIONS, NOTIFICATION_THROTTLE_RULE].forEach(
           (throttle) => {
-            it(`it sets each action's frequency attribute to default value when 'throttle' is ${throttle}`, async () => {
-              const actionsWithoutFrequencies = await getActionsWithoutFrequencies(supertest);
-
-              const simpleRule = getSimpleRule();
-              simpleRule.throttle = throttle;
-              simpleRule.actions = actionsWithoutFrequencies;
-
-              const createdRule = await createSingleRule(simpleRule);
-              const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-              expectedRule.actions = actionsWithoutFrequencies.map((action) => ({
-                ...action,
-                frequency: NOTIFICATION_DEFAULT_FREQUENCY,
-              }));
-
-              const rule = removeServerGeneratedProperties(createdRule);
-              expect(rule).to.eql(expectedRule);
+            it(`sets each action's frequency attribute to default value when 'throttle' is ${throttle}`, async () => {
+              const { body } = await supertest
+                .post(DETECTION_ENGINE_RULES_URL)
+                .set('kbn-xsrf', 'true')
+                .set('elastic-api-version', '2023-10-31')
+                .send(
+                  getCustomQueryRuleParams({
+                    throttle,
+                    actions: await getActionsWithoutFrequencies(supertest),
+                  })
+                )
+                .expect(200);
+
+              for (const action of body.actions) {
+                expect(action.frequency).toEqual(NOTIFICATION_DEFAULT_FREQUENCY);
+              }
             });
           }
         );
 
-        // Action throttle cannot be shorter than the schedule interval which is by default is 5m
         ['300s', '5m', '3h', '4d'].forEach((throttle) => {
-          it(`it correctly transforms 'throttle = ${throttle}' and sets it as a frequency of each action`, async () => {
-            const actionsWithoutFrequencies = await getActionsWithoutFrequencies(supertest);
-
-            const simpleRule = getSimpleRule();
-            simpleRule.throttle = throttle;
-            simpleRule.actions = actionsWithoutFrequencies;
-
-            const createdRule = await createSingleRule(simpleRule);
-            const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-            expectedRule.actions = actionsWithoutFrequencies.map((action) => ({
-              ...action,
-              frequency: { summary: true, throttle, notifyWhen: 'onThrottleInterval' },
-            }));
-
-            const rule = removeServerGeneratedProperties(createdRule);
-            expect(rule).to.eql(expectedRule);
+          it(`transforms correctly 'throttle = ${throttle}' and sets it as a frequency of each action`, async () => {
+            const { body } = await supertest
+              .post(DETECTION_ENGINE_RULES_URL)
+              .set('kbn-xsrf', 'true')
+              .set('elastic-api-version', '2023-10-31')
+              .send(
+                getCustomQueryRuleParams({
+                  // Action throttle cannot be shorter than the schedule interval
+                  interval: '5m',
+                  throttle,
+                  actions: await getActionsWithoutFrequencies(supertest),
+                })
+              )
+              .expect(200);
+
+            for (const action of body.actions) {
+              expect(action.frequency).toEqual({
+                summary: true,
+                throttle,
+                notifyWhen: 'onThrottleInterval',
+              });
+            }
           });
         });
       });
@@ -727,19 +698,23 @@ export default ({ getService }: FtrProviderContext) => {
           '10h',
           '2d',
         ].forEach((throttle) => {
-          it(`it does not change actions frequency attributes when 'throttle' is '${throttle}'`, async () => {
+          it(`does NOT change action frequency when 'throttle' is '${throttle}'`, async () => {
             const actionsWithFrequencies = await getActionsWithFrequencies(supertest);
-
-            const simpleRule = getSimpleRule();
-            simpleRule.throttle = throttle;
-            simpleRule.actions = actionsWithFrequencies;
-
-            const createdRule = await createSingleRule(simpleRule);
-            const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-            expectedRule.actions = actionsWithFrequencies;
-
-            const rule = removeServerGeneratedProperties(createdRule);
-            expect(rule).to.eql(expectedRule);
+            const { body } = await supertest
+              .post(DETECTION_ENGINE_RULES_URL)
+              .set('kbn-xsrf', 'true')
+              .set('elastic-api-version', '2023-10-31')
+              .send(
+                getCustomQueryRuleParams({
+                  throttle,
+                  actions: actionsWithFrequencies,
+                })
+              )
+              .expect(200);
+
+            expect(body.actions).toEqual(
+              actionsWithFrequencies.map((x) => expect.objectContaining(x))
+            );
           });
         });
       });
@@ -747,48 +722,57 @@ export default ({ getService }: FtrProviderContext) => {
       describe('some actions with frequencies', () => {
         [undefined, NOTIFICATION_THROTTLE_NO_ACTIONS, NOTIFICATION_THROTTLE_RULE].forEach(
           (throttle) => {
-            it(`it overrides each action's frequency attribute to default value when 'throttle' is ${throttle}`, async () => {
+            it(`overrides each action's frequency attribute to default value when 'throttle' is ${throttle}`, async () => {
               const someActionsWithFrequencies = await getSomeActionsWithFrequencies(supertest);
-
-              const simpleRule = getSimpleRule();
-              simpleRule.throttle = throttle;
-              simpleRule.actions = someActionsWithFrequencies;
-
-              const createdRule = await createSingleRule(simpleRule);
-              const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-              expectedRule.actions = someActionsWithFrequencies.map((action) => ({
-                ...action,
-                frequency: action.frequency ?? NOTIFICATION_DEFAULT_FREQUENCY,
-              }));
-
-              const rule = removeServerGeneratedProperties(createdRule);
-              expect(rule).to.eql(expectedRule);
+              const { body } = await supertest
+                .post(DETECTION_ENGINE_RULES_URL)
+                .set('kbn-xsrf', 'true')
+                .set('elastic-api-version', '2023-10-31')
+                .send(
+                  getCustomQueryRuleParams({
+                    throttle,
+                    actions: someActionsWithFrequencies,
+                  })
+                )
+                .expect(200);
+
+              expect(body.actions).toEqual(
+                someActionsWithFrequencies.map((x) =>
+                  expect.objectContaining(x ?? NOTIFICATION_DEFAULT_FREQUENCY)
+                )
+              );
             });
           }
         );
 
-        // Action throttle cannot be shorter than the schedule interval which is by default is 5m
         ['430s', '7m', '1h', '8d'].forEach((throttle) => {
-          it(`it correctly transforms 'throttle = ${throttle}' and overrides frequency attribute of each action`, async () => {
+          it(`transforms correctly 'throttle = ${throttle}' and overrides frequency attribute of each action`, async () => {
             const someActionsWithFrequencies = await getSomeActionsWithFrequencies(supertest);
-
-            const simpleRule = getSimpleRule();
-            simpleRule.throttle = throttle;
-            simpleRule.actions = someActionsWithFrequencies;
-
-            const createdRule = await createSingleRule(simpleRule);
-            const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
-            expectedRule.actions = someActionsWithFrequencies.map((action) => ({
-              ...action,
-              frequency: action.frequency ?? {
-                summary: true,
-                throttle,
-                notifyWhen: 'onThrottleInterval',
-              },
-            }));
-
-            const rule = removeServerGeneratedProperties(createdRule);
-            expect(rule).to.eql(expectedRule);
+            const { body } = await supertest
+              .post(DETECTION_ENGINE_RULES_URL)
+              .set('kbn-xsrf', 'true')
+              .set('elastic-api-version', '2023-10-31')
+              .send(
+                getCustomQueryRuleParams({
+                  // Action throttle cannot be shorter than the schedule interval
+                  interval: '5m',
+                  throttle,
+                  actions: someActionsWithFrequencies,
+                })
+              )
+              .expect(200);
+
+            expect(body.actions).toEqual(
+              someActionsWithFrequencies.map((x) =>
+                expect.objectContaining({
+                  frequency: x.frequency ?? {
+                    summary: true,
+                    throttle,
+                    notifyWhen: 'onThrottleInterval',
+                  },
+                })
+              )
+            );
           });
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/ess.config.ts
similarity index 62%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/ess.config.ts
index 2430b8f2148d9a..bbf6c6c0e3f7b4 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/ess.config.ts
@@ -7,12 +7,16 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Detection Engine API Integration Tests - ESS - Rule Execution Logic',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/serverless.config.ts
new file mode 100644
index 00000000000000..7bcb663699d68f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/serverless.config.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName: 'Detection Engine API Integration Tests - Serverless - Rule Execution Logic',
+  },
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.alertIgnoreFields=${JSON.stringify([
+      'testing_ignored.constant',
+      '/testing_regex*/',
+    ])}`, // See tests within the file "ignore_fields.ts" which use these values in "alertIgnoreFields"
+  ],
+});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/README.md b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/README.md
similarity index 100%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/README.md
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/README.md
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/eql.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/eql.ts
similarity index 79%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/eql.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/eql.ts
index b0469c90d8e4d1..9cb85e3366ceec 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/eql.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/eql.ts
@@ -27,35 +27,40 @@ import {
   ALERT_ORIGINAL_EVENT_CATEGORY,
   ALERT_GROUP_ID,
 } from '@kbn/security-solution-plugin/common/field_maps/field_names';
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import {
   createRule,
   deleteAllRules,
   deleteAllAlerts,
-  getEqlRuleForSignalTesting,
-  getOpenSignals,
+  getEqlRuleForAlertTesting,
+  getOpenAlerts,
   getPreviewAlerts,
   previewRule,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const auditPath = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('EQL type rules', () => {
+  describe('@ess @serverless EQL type rules', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(auditPath);
       await esArchiver.load(
         'x-pack/test/functional/es_archives/security_solution/timestamp_override_6'
       );
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(auditPath);
       await esArchiver.unload(
         'x-pack/test/functional/es_archives/security_solution/timestamp_override_6'
       );
@@ -64,21 +69,21 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     // First test creates a real rule - remaining tests use preview API
-    it('generates a correctly formatted signal from EQL non-sequence queries', async () => {
+    it('generates a correctly formatted alert from EQL non-sequence queries', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
       };
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
       expect(alerts.hits.hits.length).eql(1);
-      const fullSignal = alerts.hits.hits[0]._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = alerts.hits.hits[0]._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
 
-      expect(fullSignal).eql({
-        ...fullSignal,
+      expect(fullAlert).eql({
+        ...fullAlert,
         agent: {
           ephemeral_id: '0010d67a-14f7-41da-be30-489fea735967',
           hostname: 'suricata-zeek-sensor-toronto',
@@ -145,9 +150,9 @@ export default ({ getService }: FtrProviderContext) => {
           },
         },
         [ALERT_REASON]:
-          'configuration event on suricata-zeek-sensor-toronto created high alert Signal Testing Query.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+          'configuration event on suricata-zeek-sensor-toronto created high alert Alert Testing Query.',
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_WORKFLOW_STATUS]: 'open',
         [ALERT_WORKFLOW_TAGS]: [],
         [ALERT_DEPTH]: 1,
@@ -167,41 +172,41 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('generates up to max_signals for non-sequence EQL queries', async () => {
-      const maxSignals = 200;
+    it('generates up to max_alerts for non-sequence EQL queries', async () => {
+      const maxAlerts = 200;
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
-        max_signals: maxSignals,
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
+        max_signals: maxAlerts,
       };
       const { previewId } = await previewRule({ supertest, rule });
-      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxSignals * 2 });
-      expect(previewAlerts.length).eql(maxSignals);
+      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxAlerts * 2 });
+      expect(previewAlerts.length).eql(maxAlerts);
     });
 
-    it('generates max signals warning when circuit breaker is hit', async () => {
+    it('generates max alerts warning when circuit breaker is hit', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
       };
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).contain(getMaxAlertsWarning());
     });
 
     it('uses the provided event_category_override', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'config_change where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
         event_category_override: 'auditd.message_type',
       };
       const { previewId } = await previewRule({ supertest, rule });
       const previewAlerts = await getPreviewAlerts({ es, previewId });
       expect(previewAlerts.length).eql(1);
-      const fullSignal = previewAlerts[0]._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = previewAlerts[0]._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
 
-      expect(fullSignal).eql({
-        ...fullSignal,
+      expect(fullAlert).eql({
+        ...fullAlert,
         auditd: {
           data: {
             audit_enabled: '1',
@@ -236,9 +241,9 @@ export default ({ getService }: FtrProviderContext) => {
           },
         },
         [ALERT_REASON]:
-          'configuration event on suricata-zeek-sensor-toronto created high alert Signal Testing Query.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+          'configuration event on suricata-zeek-sensor-toronto created high alert Alert Testing Query.',
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_WORKFLOW_STATUS]: 'open',
         [ALERT_DEPTH]: 1,
         [ALERT_ANCESTORS]: [
@@ -259,7 +264,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('uses the provided timestamp_field', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['fake.index.1']),
+        ...getEqlRuleForAlertTesting(['fake.index.1']),
         query: 'any where true',
         timestamp_field: 'created_at',
       };
@@ -273,7 +278,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('uses the provided tiebreaker_field', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['fake.index.1']),
+        ...getEqlRuleForAlertTesting(['fake.index.1']),
         query: 'any where true',
         tiebreaker_field: 'locale',
       };
@@ -285,9 +290,9 @@ export default ({ getService }: FtrProviderContext) => {
       expect(createdAtHits).to.eql(['es', 'pt', 'ua']);
     });
 
-    it('generates building block signals from EQL sequences in the expected form', async () => {
+    it('generates building block alerts from EQL sequences in the expected form', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'sequence by host.name [anomoly where true] [any where true]', // TODO: spelling
       };
       const { previewId } = await previewRule({ supertest, rule });
@@ -298,13 +303,13 @@ export default ({ getService }: FtrProviderContext) => {
           get(alert._source, ALERT_ORIGINAL_EVENT_CATEGORY) === 'anomoly'
       );
       expect(buildingBlock).not.eql(undefined);
-      const fullSignal = buildingBlock?._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = buildingBlock?._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
 
-      expect(fullSignal).eql({
-        ...fullSignal,
+      expect(fullAlert).eql({
+        ...fullAlert,
         agent: {
           ephemeral_id: '1b4978a0-48be-49b1-ac96-323425b389ab',
           hostname: 'zeek-sensor-amsterdam',
@@ -409,10 +414,10 @@ export default ({ getService }: FtrProviderContext) => {
           },
         },
         [ALERT_REASON]:
-          'anomoly event with process bro, by root on zeek-sensor-amsterdam created high alert Signal Testing Query.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_GROUP_ID]: fullSignal[ALERT_GROUP_ID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+          'anomoly event with process bro, by root on zeek-sensor-amsterdam created high alert Alert Testing Query.',
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_GROUP_ID]: fullAlert[ALERT_GROUP_ID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_WORKFLOW_STATUS]: 'open',
         [ALERT_DEPTH]: 1,
         [ALERT_ANCESTORS]: [
@@ -431,9 +436,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('generates shell signals from EQL sequences in the expected form', async () => {
+    it('generates shell alerts from EQL sequences in the expected form', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'sequence by host.name [anomoly where true] [any where true]',
       };
       const { previewId } = await previewRule({ supertest, rule });
@@ -480,7 +485,7 @@ export default ({ getService }: FtrProviderContext) => {
         [ALERT_DEPTH]: 2,
         [ALERT_GROUP_ID]: source[ALERT_GROUP_ID],
         [ALERT_REASON]:
-          'event by root on zeek-sensor-amsterdam created high alert Signal Testing Query.',
+          'event by root on zeek-sensor-amsterdam created high alert Alert Testing Query.',
         [ALERT_RULE_UUID]: source[ALERT_RULE_UUID],
         [ALERT_ANCESTORS]: [
           {
@@ -513,28 +518,28 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('generates up to max_signals with an EQL rule', async () => {
-      const maxSignals = 200;
+    it('generates up to max_alerts with an EQL rule', async () => {
+      const maxAlerts = 200;
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'sequence by host.name [any where true] [any where true]',
-        max_signals: maxSignals,
+        max_signals: maxAlerts,
       };
       const { previewId } = await previewRule({ supertest, rule });
-      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxSignals * 5 });
-      // For EQL rules, max_signals is the maximum number of detected sequences: each sequence has a building block
-      // alert for each event in the sequence, so max_signals=200 results in 400 building blocks in addition to
+      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxAlerts * 5 });
+      // For EQL rules, max_alerts is the maximum number of detected sequences: each sequence has a building block
+      // alert for each event in the sequence, so max_alerts=200 results in 400 building blocks in addition to
       // 200 regular alerts
-      expect(previewAlerts.length).eql(maxSignals * 3);
-      const shellSignals = previewAlerts.filter((alert) => alert._source?.[ALERT_DEPTH] === 2);
+      expect(previewAlerts.length).eql(maxAlerts * 3);
+      const shellAlerts = previewAlerts.filter((alert) => alert._source?.[ALERT_DEPTH] === 2);
       const buildingBlocks = previewAlerts.filter((alert) => alert._source?.[ALERT_DEPTH] === 1);
-      expect(shellSignals.length).eql(maxSignals);
-      expect(buildingBlocks.length).eql(maxSignals * 2);
+      expect(shellAlerts.length).eql(maxAlerts);
+      expect(buildingBlocks.length).eql(maxAlerts * 2);
     });
 
-    it('generates signals when an index name contains special characters to encode', async () => {
+    it('generates alerts when an index name contains special characters to encode', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*', '<my-index-{now/d}*>']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*', '<my-index-{now/d}*>']),
         query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
       };
       const { previewId } = await previewRule({ supertest, rule });
@@ -544,7 +549,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('uses the provided filters', async () => {
       const rule: EqlRuleCreateProps = {
-        ...getEqlRuleForSignalTesting(['auditbeat-*']),
+        ...getEqlRuleForAlertTesting(['auditbeat-*']),
         query: 'any where true',
         filters: [
           {
@@ -599,18 +604,18 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be enriched with host risk score', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['auditbeat-*']),
+          ...getEqlRuleForAlertTesting(['auditbeat-*']),
           query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
         };
         const { previewId } = await previewRule({ supertest, rule });
         const previewAlerts = await getPreviewAlerts({ es, previewId });
         expect(previewAlerts.length).eql(1);
-        const fullSignal = previewAlerts[0]._source;
-        if (!fullSignal) {
-          return expect(fullSignal).to.be.ok();
+        const fullAlert = previewAlerts[0]._source;
+        if (!fullAlert) {
+          return expect(fullAlert).to.be.ok();
         }
-        expect(fullSignal?.host?.risk?.calculated_level).to.eql('Critical');
-        expect(fullSignal?.host?.risk?.calculated_score_norm).to.eql(96);
+        expect(fullAlert?.host?.risk?.calculated_level).to.eql('Critical');
+        expect(fullAlert?.host?.risk?.calculated_score_norm).to.eql(96);
       });
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/esql.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/esql.ts
similarity index 91%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/esql.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/esql.ts
index 9ae0bf9773de6a..e869854f0f44ac 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/esql.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/esql.ts
@@ -11,23 +11,24 @@ import { orderBy } from 'lodash';
 
 import { EsqlRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine/model/rule_schema';
 import { getCreateEsqlRulesSchemaMock } from '@kbn/security-solution-plugin/common/api/detection_engine/model/rule_schema/mocks';
+import { RuleExecutionStatusEnum } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_monitoring';
 
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import {
   deleteAllRules,
   deleteAllAlerts,
   getPreviewAlerts,
   previewRule,
   createRule,
-  getOpenSignals as getOpenAlerts,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-import { previewRuleWithExceptionEntries } from '../../utils/preview_rule_with_exception_entries';
-import { deleteAllExceptions } from '../../../lists_api_integration/utils';
-import { dataGeneratorFactory } from '../../utils/data_generator';
-import { removeRandomValuedProperties } from './utils';
-
-// eslint-disable-next-line import/no-default-export
+  getOpenAlerts,
+  dataGeneratorFactory,
+  previewRuleWithExceptionEntries,
+  removeRandomValuedPropertiesFromAlert,
+  patchRule,
+} from '../../../utils';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -45,7 +46,7 @@ export default ({ getService }: FtrProviderContext) => {
    */
   const internalIdPipe = (id: string) => `| where id=="${id}"`;
 
-  describe('ES|QL rule type', () => {
+  describe('@ess ES|QL rule type', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/ecs_compliant');
     });
@@ -82,7 +83,7 @@ export default ({ getService }: FtrProviderContext) => {
       const alerts = await getOpenAlerts(supertest, log, es, createdRule);
 
       expect(alerts.hits.hits.length).toBe(1);
-      expect(removeRandomValuedProperties(alerts.hits.hits[0]._source)).toEqual({
+      expect(removeRandomValuedPropertiesFromAlert(alerts.hits.hits[0]._source)).toEqual({
         'kibana.alert.rule.parameters': {
           description: 'Detecting root and admin users',
           risk_score: 55,
@@ -600,8 +601,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    describe('max signals', () => {
-      it('generates max signals warning when circuit breaker is exceeded', async () => {
+    describe('max alerts', () => {
+      it('generates max alerts warning when circuit breaker is exceeded', async () => {
         const id = uuidv4();
         const rule: EsqlRuleCreateProps = {
           ...getCreateEsqlRulesSchemaMock('rule-1', true),
@@ -627,7 +628,7 @@ export default ({ getService }: FtrProviderContext) => {
           timeframeEnd: new Date('2020-10-28T06:30:00.000Z'),
         });
 
-        expect(logs[0].warnings).toEqual(expect.arrayContaining([getMaxSignalsWarning()]));
+        expect(logs[0].warnings).toEqual(expect.arrayContaining([getMaxAlertsWarning()]));
 
         const previewAlerts = await getPreviewAlerts({
           es,
@@ -638,7 +639,7 @@ export default ({ getService }: FtrProviderContext) => {
         expect(previewAlerts.length).toBe(100);
       });
 
-      it("doesn't generate max signals warning when circuit breaker is met but not exceeded", async () => {
+      it("doesn't generate max alerts warning when circuit breaker is met but not exceeded", async () => {
         const id = uuidv4();
         const rule: EsqlRuleCreateProps = {
           ...getCreateEsqlRulesSchemaMock('rule-1', true),
@@ -663,7 +664,7 @@ export default ({ getService }: FtrProviderContext) => {
           rule,
           timeframeEnd: new Date('2020-10-28T06:30:00.000Z'),
         });
-        expect(logs[0].warnings).not.toEqual(expect.arrayContaining([getMaxSignalsWarning()]));
+        expect(logs[0].warnings).not.toEqual(expect.arrayContaining([getMaxAlertsWarning()]));
 
         const previewAlerts = await getPreviewAlerts({
           es,
@@ -674,7 +675,7 @@ export default ({ getService }: FtrProviderContext) => {
         expect(previewAlerts.length).toBe(100);
       });
 
-      it('should work for max signals > 100', async () => {
+      it('should work for max alerts > 100', async () => {
         const id = uuidv4();
         const rule: EsqlRuleCreateProps = {
           ...getCreateEsqlRulesSchemaMock('rule-1', true),
@@ -710,18 +711,22 @@ export default ({ getService }: FtrProviderContext) => {
         expect(previewAlerts.length).toBe(150);
       });
 
-      // as per https://github.com/elastic/kibana/pull/170034, test is failing on CI and flaky locally
-      // skipping it for now for further investigation
-      it.skip('should generate alerts when docs overlap execution intervals and alerts number reached max_signals in one of the executions', async () => {
+      // we use actual rule executions, not preview, because for preview API alerts index refresh=false for non suppressed alerts
+      // first rule execution catches 130 documents and generates 100 alerts
+      // second rule execution catches 150 docs, 120 of which were captured during the first execution and generates only 60 alerts. Because rest are deduplicated
+      // so in total 160 alerts should be generated
+      it('should generate alerts when docs overlap execution intervals and alerts number reached max_signals in one of the real executions', async () => {
         const id = uuidv4();
         const rule: EsqlRuleCreateProps = {
-          ...getCreateEsqlRulesSchemaMock('rule-1', true),
+          ...getCreateEsqlRulesSchemaMock(`rule-${id}`, true),
           query: `from ecs_compliant [metadata _id] ${internalIdPipe(
             id
           )} | keep _id, agent.name | sort agent.name`,
-          from: 'now-45m',
-          interval: '30m',
+          from: '2020-10-28T05:15:00.000Z',
+          to: '2020-10-28T06:00:00.000Z',
+          interval: '45m',
           max_signals: 100,
+          enabled: true,
         };
 
         // docs fall in first rule executions
@@ -772,20 +777,46 @@ export default ({ getService }: FtrProviderContext) => {
           }),
         });
 
-        const { previewId } = await previewRule({
+        const createdRule = await createRule(supertest, log, rule);
+
+        // first rule run should generate 100 alerts from first 3 batches of index documents
+        const alertsResponseFromFirstRuleExecution = await getOpenAlerts(
           supertest,
-          rule,
-          timeframeEnd: new Date('2020-10-28T06:30:00.000Z'),
-          invocationCount: 2,
-        });
-        const previewAlerts = await getPreviewAlerts({
+          log,
           es,
-          previewId,
-          size: 200,
+          createdRule,
+          // rule has warning, alerts were truncated, thus "partial failure" status
+          RuleExecutionStatusEnum['partial failure'],
+          200
+        );
+
+        // should return 100 alerts
+        expect(alertsResponseFromFirstRuleExecution.hits.hits.length).toBe(100);
+
+        // re-trigger rule execution with new interval
+        await patchRule(supertest, log, {
+          id: createdRule.id,
+          enabled: false,
+        });
+        await patchRule(supertest, log, {
+          id: createdRule.id,
+          from: '2020-10-28T05:45:00.000Z',
+          to: '2020-10-28T06:30:00.000Z',
+          enabled: true,
         });
 
-        // should generate 160 alerts
-        expect(previewAlerts.length).toBe(160);
+        const alertsResponse = await getOpenAlerts(
+          supertest,
+          log,
+          es,
+          createdRule,
+          RuleExecutionStatusEnum.succeeded,
+          200,
+          new Date()
+        );
+
+        // should return 160 alerts
+        expect(alertsResponse.hits.hits.length).toBe(160);
       });
     });
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/index.ts
similarity index 77%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/index.ts
index e6cb1328c29b35..36a249304c7e67 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/index.ts
@@ -5,11 +5,10 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - rule execution logic', function () {
+  describe('Execution logic', function () {
     loadTestFile(require.resolve('./eql'));
     loadTestFile(require.resolve('./esql'));
     loadTestFile(require.resolve('./machine_learning'));
@@ -18,7 +17,6 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./threat_match'));
     loadTestFile(require.resolve('./threshold'));
     loadTestFile(require.resolve('./non_ecs_fields'));
-
     loadTestFile(require.resolve('./query'));
   });
 };
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/machine_learning.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/machine_learning.ts
similarity index 81%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/machine_learning.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/machine_learning.ts
index 792fcb30b6645c..3fd33d4ee8c903 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/machine_learning.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/machine_learning.ts
@@ -24,33 +24,38 @@ import {
   ALERT_DEPTH,
   ALERT_ORIGINAL_TIME,
 } from '@kbn/security-solution-plugin/common/field_maps/field_names';
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import { expect } from 'expect';
 import {
   createListsIndex,
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+} from '../../../../../../lists_api_integration/utils';
 import {
   createRule,
   deleteAllRules,
   deleteAllAlerts,
   executeSetupModuleRequest,
   forceStartDatafeeds,
-  getOpenSignals,
+  getOpenAlerts,
   getPreviewAlerts,
   previewRule,
   previewRuleWithExceptionEntries,
-} from '../../utils';
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const auditPath = dataPathBuilder.getPath('auditbeat/hosts');
 
   const siemModule = 'security_linux_v3';
   const mlJobId = 'v3_linux_anomalous_network_activity';
@@ -66,17 +71,17 @@ export default ({ getService }: FtrProviderContext) => {
     rule_id: 'ml-rule-id',
   };
 
-  describe('Machine learning type rules', () => {
+  describe('@ess @serverless Machine learning type rules', () => {
     before(async () => {
       // Order is critical here: auditbeat data must be loaded before attempting to start the ML job,
       // as the job looks for certain indices on start
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(auditPath);
       await executeSetupModuleRequest({ module: siemModule, rspCode: 200, supertest });
       await forceStartDatafeeds({ jobId: mlJobId, rspCode: 200, supertest });
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/anomalies');
     });
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(auditPath);
       await esArchiver.unload('x-pack/test/functional/es_archives/security_solution/anomalies');
       await deleteAllAlerts(supertest, log, es);
       await deleteAllRules(supertest, log);
@@ -85,11 +90,11 @@ export default ({ getService }: FtrProviderContext) => {
     // First test creates a real rule - remaining tests use preview API
     it('should create 1 alert from ML rule when record meets anomaly_threshold', async () => {
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
       expect(alerts.hits.hits.length).toBe(1);
-      const signal = alerts.hits.hits[0];
+      const alert = alerts.hits.hits[0];
 
-      expect(signal._source).toEqual(
+      expect(alert._source).toEqual(
         expect.objectContaining({
           '@timestamp': expect.any(String),
           [ALERT_RULE_EXECUTION_UUID]: expect.any(String),
@@ -160,23 +165,23 @@ export default ({ getService }: FtrProviderContext) => {
       );
     });
 
-    it('generates max signals warning when circuit breaker is exceeded', async () => {
+    it('@skipInQA generates max alerts warning when circuit breaker is exceeded', async () => {
       const { logs } = await previewRule({
         supertest,
         rule: { ...rule, anomaly_threshold: 1, max_signals: 5 }, // This threshold generates 10 alerts with the current esArchive
       });
-      expect(logs[0].warnings).toContain(getMaxSignalsWarning());
+      expect(logs[0].warnings).toContain(getMaxAlertsWarning());
     });
 
-    it("doesn't generate max signals warning when circuit breaker is met, but not exceeded", async () => {
+    it("doesn't generate max alerts warning when circuit breaker is met, but not exceeded", async () => {
       const { logs } = await previewRule({
         supertest,
         rule: { ...rule, anomaly_threshold: 1, max_signals: 10 },
       });
-      expect(logs[0].warnings).not.toContain(getMaxSignalsWarning());
+      expect(logs[0].warnings).not.toContain(getMaxAlertsWarning());
     });
 
-    it('should create 7 alerts from ML rule when records meet anomaly_threshold', async () => {
+    it('@skipInQA should create 7 alerts from ML rule when records meet anomaly_threshold', async () => {
       const { previewId } = await previewRule({
         supertest,
         rule: { ...rule, anomaly_threshold: 20 },
@@ -189,7 +194,7 @@ export default ({ getService }: FtrProviderContext) => {
       afterEach(async () => {
         await deleteAllExceptions(supertest, log);
       });
-      it('generates no signals when an exception is added for an ML rule', async () => {
+      it('generates no alerts when an exception is added for an ML rule', async () => {
         const { previewId } = await previewRuleWithExceptionEntries({
           supertest,
           log,
@@ -220,7 +225,7 @@ export default ({ getService }: FtrProviderContext) => {
         await deleteAllExceptions(supertest, log);
       });
 
-      it('generates no signals when a value list exception is added for an ML rule', async () => {
+      it('generates no alerts when a value list exception is added for an ML rule', async () => {
         const valueListId = 'value-list-id';
         await importFile(supertest, log, 'keyword', ['mothra'], valueListId);
         const { previewId } = await previewRuleWithExceptionEntries({
@@ -255,14 +260,14 @@ export default ({ getService }: FtrProviderContext) => {
         await esArchiver.unload('x-pack/test/functional/es_archives/entity/risks');
       });
 
-      it('should be enriched with host risk score', async () => {
+      it('@skipInQA should be enriched with host risk score', async () => {
         const { previewId } = await previewRule({ supertest, rule });
         const previewAlerts = await getPreviewAlerts({ es, previewId });
         expect(previewAlerts.length).toBe(1);
-        const fullSignal = previewAlerts[0]._source;
+        const fullAlert = previewAlerts[0]._source;
 
-        expect(fullSignal?.host?.risk?.calculated_level).toBe('Low');
-        expect(fullSignal?.host?.risk?.calculated_score_norm).toBe(1);
+        expect(fullAlert?.host?.risk?.calculated_level).toBe('Low');
+        expect(fullAlert?.host?.risk?.calculated_score_norm).toBe(1);
       });
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/new_terms.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/new_terms.ts
similarity index 95%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/new_terms.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/new_terms.ts
index 144d5e9bf51bd2..0aedb19748cf47 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/new_terms.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/new_terms.ts
@@ -12,26 +12,25 @@ import { NewTermsRuleCreateProps } from '@kbn/security-solution-plugin/common/ap
 import { orderBy } from 'lodash';
 import { getCreateNewTermsRulesSchemaMock } from '@kbn/security-solution-plugin/common/api/detection_engine/model/rule_schema/mocks';
 
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import {
   createRule,
   deleteAllRules,
   deleteAllAlerts,
-  getOpenSignals,
+  getOpenAlerts,
   getPreviewAlerts,
   previewRule,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-import { previewRuleWithExceptionEntries } from '../../utils/preview_rule_with_exception_entries';
-import { deleteAllExceptions } from '../../../lists_api_integration/utils';
-import { dataGeneratorFactory } from '../../utils/data_generator';
-
-import { removeRandomValuedProperties } from './utils';
+  dataGeneratorFactory,
+  previewRuleWithExceptionEntries,
+  removeRandomValuedPropertiesFromAlert,
+} from '../../../utils';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
 const historicalWindowStart = '2022-10-13T05:00:04.000Z';
 const ruleExecutionStart = '2022-10-19T05:00:04.000Z';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -42,7 +41,12 @@ export default ({ getService }: FtrProviderContext) => {
     index: 'new_terms',
     log,
   });
-
+  // TODO: add a new service
+  const config = getService('config');
+  const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
   /**
    * indexes 2 sets of documents:
    * - documents in historical window
@@ -72,14 +76,14 @@ export default ({ getService }: FtrProviderContext) => {
     return testId;
   };
 
-  describe('New terms type rules', () => {
+  describe('@ess @serverless New terms type rules', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(path);
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/new_terms');
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(path);
       await esArchiver.unload('x-pack/test/functional/es_archives/security_solution/new_terms');
       await deleteAllAlerts(supertest, log, es);
       await deleteAllRules(supertest, log);
@@ -99,10 +103,10 @@ export default ({ getService }: FtrProviderContext) => {
       };
 
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
 
       expect(alerts.hits.hits.length).eql(1);
-      expect(removeRandomValuedProperties(alerts.hits.hits[0]._source)).eql({
+      expect(removeRandomValuedPropertiesFromAlert(alerts.hits.hits[0]._source)).eql({
         'kibana.alert.new_terms': ['zeek-newyork-sha-aa8df15'],
         'kibana.alert.rule.category': 'New Terms Rule',
         'kibana.alert.rule.consumer': 'siem',
@@ -196,7 +200,7 @@ export default ({ getService }: FtrProviderContext) => {
         },
         'kibana.alert.rule.actions': [],
         'kibana.alert.rule.author': [],
-        'kibana.alert.rule.created_by': 'elastic',
+        'kibana.alert.rule.created_by': ELASTICSEARCH_USERNAME,
         'kibana.alert.rule.description': 'Detecting root and admin users',
         'kibana.alert.rule.enabled': true,
         'kibana.alert.rule.exceptions_list': [],
@@ -214,7 +218,7 @@ export default ({ getService }: FtrProviderContext) => {
         'kibana.alert.rule.threat': [],
         'kibana.alert.rule.to': 'now',
         'kibana.alert.rule.type': 'new_terms',
-        'kibana.alert.rule.updated_by': 'elastic',
+        'kibana.alert.rule.updated_by': ELASTICSEARCH_USERNAME,
         'kibana.alert.rule.version': 1,
         'kibana.alert.rule.risk_score': 55,
         'kibana.alert.rule.severity': 'high',
@@ -229,7 +233,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('generates max signals warning when circuit breaker is exceeded', async () => {
+    it('generates max alerts warning when circuit breaker is exceeded', async () => {
       const rule: NewTermsRuleCreateProps = {
         ...getCreateNewTermsRulesSchemaMock('rule-1', true),
         new_terms_fields: ['process.pid'],
@@ -239,10 +243,10 @@ export default ({ getService }: FtrProviderContext) => {
       };
       const { logs } = await previewRule({ supertest, rule });
 
-      expect(logs[0].warnings).contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).contain(getMaxAlertsWarning());
     });
 
-    it("doesn't generate max signals warning when circuit breaker is met but not exceeded", async () => {
+    it("doesn't generate max alerts warning when circuit breaker is met but not exceeded", async () => {
       const rule: NewTermsRuleCreateProps = {
         ...getCreateNewTermsRulesSchemaMock('rule-1', true),
         new_terms_fields: ['host.ip'],
@@ -252,7 +256,7 @@ export default ({ getService }: FtrProviderContext) => {
       };
       const { logs } = await previewRule({ supertest, rule });
 
-      expect(logs[0].warnings).not.contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).not.contain(getMaxAlertsWarning());
     });
 
     it('should generate 3 alerts when 1 document has 3 new values', async () => {
@@ -990,21 +994,21 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('should work for max signals > 100', async () => {
-      const maxSignals = 200;
+    it('should work for max alerts > 100', async () => {
+      const maxAlerts = 200;
       const rule: NewTermsRuleCreateProps = {
         ...getCreateNewTermsRulesSchemaMock('rule-1', true),
         new_terms_fields: ['process.pid'],
         from: '2018-02-19T20:42:00.000Z',
         // Set the history_window_start close to 'from' so we should alert on all terms in the time range
         history_window_start: '2018-02-19T20:41:59.000Z',
-        max_signals: maxSignals,
+        max_signals: maxAlerts,
       };
 
       const { previewId } = await previewRule({ supertest, rule });
-      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxSignals * 2 });
+      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxAlerts * 2 });
 
-      expect(previewAlerts.length).eql(maxSignals);
+      expect(previewAlerts.length).eql(maxAlerts);
       const processPids = previewAlerts
         .map((signal) => signal._source?.['kibana.alert.new_terms'])
         .sort();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/non_ecs_fields.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/non_ecs_fields.ts
similarity index 96%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/non_ecs_fields.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/non_ecs_fields.ts
index 20d2f8e1dc5713..e452ffcfaf34e9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/non_ecs_fields.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/non_ecs_fields.ts
@@ -10,18 +10,18 @@ import {
   deleteAllRules,
   deleteAllAlerts,
   getPreviewAlerts,
-  getRuleForSignalTesting,
+  getRuleForAlertTesting,
   previewRule,
-} from '../../utils';
-import { dataGeneratorFactory, enhanceDocument } from '../../utils/data_generator';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+  dataGeneratorFactory,
+  enhanceDocument,
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
 const getQueryRule = (docIdToQuery: string) => ({
-  ...getRuleForSignalTesting(['ecs_non_compliant']),
+  ...getRuleForAlertTesting(['ecs_non_compliant']),
   query: `id: "${docIdToQuery}"`,
 });
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -56,7 +56,7 @@ export default ({ getService }: FtrProviderContext) => {
     };
   };
 
-  describe('Non ECS fields in alert document source', () => {
+  describe('@ess @serverless Non ECS fields in alert document source', () => {
     before(async () => {
       await esArchiver.load(
         'x-pack/test/functional/es_archives/security_solution/ecs_non_compliant'
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/query.ts
similarity index 92%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/query.ts
index 4c38edaf0cd281..a1241c60f5ccf4 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/query.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/query.ts
@@ -42,29 +42,32 @@ import {
 import {
   DETECTION_ENGINE_RULES_BULK_ACTION,
   DETECTION_ENGINE_RULES_URL,
-  DETECTION_ENGINE_SIGNALS_STATUS_URL,
+  DETECTION_ENGINE_SIGNALS_STATUS_URL as DETECTION_ENGINE_ALERTS_STATUS_URL,
 } from '@kbn/security-solution-plugin/common/constants';
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
-import { deleteAllExceptions } from '../../../lists_api_integration/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import moment from 'moment';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
 import {
   createExceptionList,
   createExceptionListItem,
   createRule,
   deleteAllRules,
   deleteAllAlerts,
-  getOpenSignals,
+  getOpenAlerts,
   getPreviewAlerts,
-  getRuleForSignalTesting,
+  getRuleForAlertTesting,
   getSimpleRule,
   previewRule,
-  setSignalStatus,
+  setAlertStatus,
   getRuleSOById,
+  patchRule,
   createRuleThroughAlertingEndpoint,
   getRuleSavedObjectWithLegacyInvestigationFields,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-import { dataGeneratorFactory } from '../../utils/data_generator';
-import { patchRule } from '../../utils/patch_rule';
+  dataGeneratorFactory,
+} from '../../../utils';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
 /**
  * Specific _id to use for some of the tests. If the archiver changes and you see errors
@@ -75,22 +78,29 @@ const ID = 'BhbXBmkBR346wHgn4PeZ';
 /**
  * Test coverage:
  * [x] - Happy path generating 1 alert
- * [x] - Rule type respects max signals
+ * [x] - Rule type respects max alerts
  * [x] - Alerts on alerts
  */
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
   const esDeleteAllIndices = getService('esDeleteAllIndices');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const auditbeatPath = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('Query type rules', () => {
+  describe('@ess @serverless Query type rules', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
-      await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alerts/8.1.0');
+      await esArchiver.load(auditbeatPath);
+      await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alerts/8.8.0', {
+        useCreate: true,
+        docsOnly: true,
+      });
       await esArchiver.load('x-pack/test/functional/es_archives/signals/severity_risk_overrides');
     });
 
@@ -99,8 +109,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
-      await esArchiver.unload('x-pack/test/functional/es_archives/security_solution/alerts/8.1.0');
+      await esArchiver.unload(auditbeatPath);
       await esArchiver.unload('x-pack/test/functional/es_archives/signals/severity_risk_overrides');
       await deleteAllAlerts(supertest, log, es, ['.preview.alerts-security.alerts-*']);
       await deleteAllRules(supertest, log);
@@ -109,48 +118,48 @@ export default ({ getService }: FtrProviderContext) => {
     // First test creates a real rule - most remaining tests use preview API
     it('should have the specific audit record for _id or none of these tests below will pass', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `_id:${ID}`,
       };
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
       expect(alerts.hits.hits.length).greaterThan(0);
       expect(alerts.hits.hits[0]._source?.['kibana.alert.ancestors'][0].id).eql(ID);
     });
 
-    it('generates max signals warning when circuit breaker is hit', async () => {
+    it('generates max alerts warning when circuit breaker is hit', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
       };
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).contain(getMaxAlertsWarning());
     });
 
-    it("doesn't generate max signals warning when circuit breaker is met but not exceeded", async () => {
+    it("doesn't generate max alerts warning when circuit breaker is met but not exceeded", async () => {
       const rule = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: 'process.executable: "/usr/bin/sudo"',
         max_signals: 10,
       };
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).not.contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).not.contain(getMaxAlertsWarning());
     });
 
     it('should abide by max_signals > 100', async () => {
-      const maxSignals = 200;
+      const maxAlerts = 200;
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
-        max_signals: maxSignals,
+        ...getRuleForAlertTesting(['auditbeat-*']),
+        max_signals: maxAlerts,
       };
       const { previewId } = await previewRule({ supertest, rule });
       // Search for 2x max_signals to make sure we aren't making more than max_signals
-      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxSignals * 2 });
-      expect(previewAlerts.length).equal(maxSignals);
+      const previewAlerts = await getPreviewAlerts({ es, previewId, size: maxAlerts * 2 });
+      expect(previewAlerts.length).equal(maxAlerts);
     });
 
-    it('should have recorded the rule_id within the signal', async () => {
+    it('should have recorded the rule_id within the alert', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `_id:${ID}`,
       };
       const { previewId } = await previewRule({ supertest, rule });
@@ -158,17 +167,17 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts[0]._source?.[ALERT_RULE_RULE_ID]).eql(getSimpleRule().rule_id);
     });
 
-    it('should query and get back expected signal structure using a basic KQL query', async () => {
+    it('should query and get back expected alert structure using a basic KQL query', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `_id:${ID}`,
       };
       const { previewId } = await previewRule({ supertest, rule });
       const previewAlerts = await getPreviewAlerts({ es, previewId });
-      const signal = previewAlerts[0]._source;
+      const alert = previewAlerts[0]._source;
 
-      expect(signal).eql({
-        ...signal,
+      expect(alert).eql({
+        ...alert,
         [ALERT_ANCESTORS]: [
           {
             id: 'BhbXBmkBR346wHgn4PeZ',
@@ -189,11 +198,11 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('should query and get back expected signal structure when it is a signal on a signal', async () => {
-      const alertId = '30a75fe46d3dbdfab55982036f77a8d60e2d1112e96f277c3b8c22f9bb57817a';
+    it('should query and get back expected alert structure when it is a alert on a alert', async () => {
+      const alertId = 'eabbdefc23da981f2b74ab58b82622a97bb9878caa11bc914e2adfacc94780f1';
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting([`.alerts-security.alerts-default*`]),
-        rule_id: 'signal-on-signal',
+        ...getRuleForAlertTesting([`.alerts-security.alerts-default*`]),
+        rule_id: 'alert-on-alert',
         query: `_id:${alertId}`,
       };
 
@@ -202,43 +211,44 @@ export default ({ getService }: FtrProviderContext) => {
 
       expect(previewAlerts.length).to.eql(1);
 
-      const signal = previewAlerts[0]._source;
+      const alert = previewAlerts[0]._source;
 
-      if (!signal) {
-        return expect(signal).to.be.ok();
+      if (!alert) {
+        return expect(alert).to.be.ok();
       }
-
-      expect(signal).eql({
-        ...signal,
-        [ALERT_ANCESTORS]: [
-          {
-            id: 'ahEToH8BK09aFtXZFVMq',
-            type: 'event',
-            index: 'events-index-000001',
-            depth: 0,
-          },
-          {
-            rule: '031d5c00-a72f-11ec-a8a3-7b1c8077fc3e',
-            id: '30a75fe46d3dbdfab55982036f77a8d60e2d1112e96f277c3b8c22f9bb57817a',
-            type: 'signal',
-            index: '.internal.alerts-security.alerts-default-000001',
-            depth: 1,
-          },
-        ],
-        [ALERT_WORKFLOW_STATUS]: 'open',
-        [ALERT_DEPTH]: 2,
-        [ALERT_ORIGINAL_TIME]: '2022-03-19T02:48:12.634Z',
-        ...flattenWithPrefix(ALERT_ORIGINAL_EVENT, {
-          agent_id_status: 'verified',
-          ingested: '2022-03-19T02:47:57.376Z',
-          dataset: 'elastic_agent.filebeat',
-        }),
-      });
+      const date = moment();
+      const formattedDate = date.format('YYYY.MM.DD');
+      const alertAncestorIndex = isServerless
+        ? `.ds-.alerts-security.alerts-default-${formattedDate}-000001`
+        : '.internal.alerts-security.alerts-default-000001';
+      expect(alert[ALERT_ANCESTORS]).eql([
+        {
+          id: 'vT9cwocBh3b8EMpD8lsi',
+          type: 'event',
+          index: '.ds-logs-endpoint.alerts-default-2023.04.27-000001',
+          depth: 0,
+        },
+        {
+          rule: '7015a3e2-e4ea-11ed-8c11-49608884878f',
+          id: alertId,
+          type: 'signal',
+          index: alertAncestorIndex,
+          depth: 1,
+        },
+      ]);
+      expect(alert[ALERT_WORKFLOW_STATUS]).eql('open');
+      expect(alert[ALERT_DEPTH]).eql(2);
+
+      expect(alert[ALERT_ORIGINAL_TIME]).eql('2023-04-27T11:03:57.906Z');
+      expect(alert[`${ALERT_ORIGINAL_EVENT}.agent_id_status`]).eql('auth_metadata_missing');
+      expect(alert[`${ALERT_ORIGINAL_EVENT}.ingested`]).eql('2023-04-27T10:58:03Z');
+      expect(alert[`${ALERT_ORIGINAL_EVENT}.dataset`]).eql('endpoint');
+      expect(alert[`${ALERT_ORIGINAL_EVENT}.ingested`]).eql('2023-04-27T10:58:03Z');
     });
 
     it('should not have risk score fields without risk indices', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `_id:${ID}`,
       };
       const { previewId } = await previewRule({ supertest, rule });
@@ -258,7 +268,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should have host and user risk score fields', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['auditbeat-*']),
+          ...getRuleForAlertTesting(['auditbeat-*']),
           query: `_id:${ID}`,
         };
         const { previewId } = await previewRule({ supertest, rule });
@@ -273,11 +283,11 @@ export default ({ getService }: FtrProviderContext) => {
     /**
      * Here we test the functionality of Severity and Risk Score overrides (also called "mappings"
      * in the code). If the rule specifies a mapping, then the final Severity or Risk Score
-     * value of the signal will be taken from the mapped field of the source event.
+     * value of the alert will be taken from the mapped field of the source event.
      */
     it('should get default severity and risk score if there is no mapping', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['signal_overrides']),
+        ...getRuleForAlertTesting(['signal_overrides']),
         severity: 'medium',
         risk_score: 75,
       };
@@ -297,7 +307,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('should get overridden severity if the rule has a mapping for it', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['signal_overrides']),
+        ...getRuleForAlertTesting(['signal_overrides']),
         severity: 'medium',
         severity_mapping: [
           { field: 'my_severity', operator: 'equals', value: 'sev_900', severity: 'high' },
@@ -334,7 +344,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('should get overridden risk score if the rule has a mapping for it', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['signal_overrides']),
+        ...getRuleForAlertTesting(['signal_overrides']),
         severity: 'medium',
         risk_score: 75,
         risk_score_mapping: [
@@ -369,7 +379,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('should get overridden severity and risk score if the rule has both mappings', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['signal_overrides']),
+        ...getRuleForAlertTesting(['signal_overrides']),
         severity: 'medium',
         severity_mapping: [
           { field: 'my_severity', operator: 'equals', value: 'sev_900', severity: 'high' },
@@ -409,26 +419,26 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('should generate signals with name_override field', async () => {
+    it('should generate alerts with name_override field', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `event.action:boot`,
         rule_name_override: 'event.action',
       };
 
       const { previewId } = await previewRule({ supertest, rule });
       const previewAlerts = await getPreviewAlerts({ es, previewId });
-      const fullSignal = previewAlerts[0];
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = previewAlerts[0];
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
 
       expect(previewAlerts[0]._source?.['kibana.alert.rule.name']).to.eql('boot');
     });
 
-    it('should not generate duplicate signals', async () => {
+    it('should not generate duplicate alerts', async () => {
       const rule: QueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         query: `_id:${ID}`,
       };
 
@@ -448,7 +458,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should generate only 1 alert per host name when grouping by host name', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `host.name: "host-0"`,
           alert_suppression: {
             group_by: ['host.name'],
@@ -481,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should generate multiple alerts when multiple host names are found', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `host.name: *`,
           alert_suppression: {
             group_by: ['host.name'],
@@ -521,7 +531,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should generate alerts when using multiple group by fields', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `host.name: *`,
           alert_suppression: {
             group_by: ['host.name', 'source.ip'],
@@ -564,7 +574,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should not count documents that were covered by previous alerts', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `host.name: *`,
           alert_suppression: {
             group_by: ['host.name', 'source.ip'],
@@ -632,7 +642,7 @@ export default ({ getService }: FtrProviderContext) => {
       // so we expect 2 groups to be created from the single document
       it('should generate multiple alerts for a single doc in multiple groups', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `*:*`,
           alert_suppression: {
             group_by: ['destination.ip'],
@@ -689,7 +699,7 @@ export default ({ getService }: FtrProviderContext) => {
         // The last alert, with null for destination.ip, should be found by the first rule run but not duplicated
         // by the second run.
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['suppression-data']),
+          ...getRuleForAlertTesting(['suppression-data']),
           query: `*:*`,
           alert_suppression: {
             group_by: ['destination.ip'],
@@ -760,7 +770,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([firstDocument, firstDocument]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             rule_id: 'rule-2',
             query: `id:${id}`,
             alert_suppression: {
@@ -772,7 +782,7 @@ export default ({ getService }: FtrProviderContext) => {
             },
           };
           const createdRule = await createRule(supertest, log, rule);
-          const alerts = await getOpenSignals(supertest, log, es, createdRule);
+          const alerts = await getOpenAlerts(supertest, log, es, createdRule);
           expect(alerts.hits.hits.length).eql(1);
           expect(alerts.hits.hits[0]._source).to.eql({
             ...alerts.hits.hits[0]._source,
@@ -802,7 +812,7 @@ export default ({ getService }: FtrProviderContext) => {
           await patchRule(supertest, log, { id: createdRule.id, enabled: false });
           await patchRule(supertest, log, { id: createdRule.id, enabled: true });
           const afterTimestamp = new Date();
-          const secondAlerts = await getOpenSignals(
+          const secondAlerts = await getOpenAlerts(
             supertest,
             log,
             es,
@@ -841,7 +851,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([firstDocument, firstDocument]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             rule_id: 'rule-2',
             query: `id:${id}`,
             alert_suppression: {
@@ -853,15 +863,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           };
           const createdRule = await createRule(supertest, log, rule);
-          const alerts = await getOpenSignals(supertest, log, es, createdRule);
+          const alerts = await getOpenAlerts(supertest, log, es, createdRule);
 
           // Close the alert. Subsequent rule executions should ignore this closed alert
           // for suppression purposes.
           const alertIds = alerts.hits.hits.map((alert) => alert._id);
           await supertest
-            .post(DETECTION_ENGINE_SIGNALS_STATUS_URL)
+            .post(DETECTION_ENGINE_ALERTS_STATUS_URL)
             .set('kbn-xsrf', 'true')
-            .send(setSignalStatus({ signalIds: alertIds, status: 'closed' }))
+            .send(setAlertStatus({ alertIds, status: 'closed' }))
             .expect(200);
 
           const secondTimestamp = new Date().toISOString();
@@ -878,7 +888,7 @@ export default ({ getService }: FtrProviderContext) => {
           await patchRule(supertest, log, { id: createdRule.id, enabled: false });
           await patchRule(supertest, log, { id: createdRule.id, enabled: true });
           const afterTimestamp = new Date();
-          const secondAlerts = await getOpenSignals(
+          const secondAlerts = await getOpenAlerts(
             supertest,
             log,
             es,
@@ -922,7 +932,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should generate an alert per rule run when duration is less than rule interval', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['suppression-data']),
+            ...getRuleForAlertTesting(['suppression-data']),
             query: `host.name: "host-0"`,
             alert_suppression: {
               group_by: ['host.name'],
@@ -981,7 +991,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should update an existing alert in the time window', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['suppression-data']),
+            ...getRuleForAlertTesting(['suppression-data']),
             query: `host.name: "host-0"`,
             alert_suppression: {
               group_by: ['host.name'],
@@ -1025,7 +1035,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should update the correct alerts based on group_by field-value pair', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['suppression-data']),
+            ...getRuleForAlertTesting(['suppression-data']),
             query: `host.name: *`,
             alert_suppression: {
               group_by: ['host.name'],
@@ -1099,7 +1109,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should update the correct alerts based on group_by field-value pair even when value is null', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['suppression-data']),
+            ...getRuleForAlertTesting(['suppression-data']),
             query: `host.name: *`,
             alert_suppression: {
               group_by: ['destination.ip'], // Only 1 document populates destination.ip
@@ -1162,7 +1172,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([docWithoutOverride, docWithOverride]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1226,7 +1236,7 @@ export default ({ getService }: FtrProviderContext) => {
           );
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1313,7 +1323,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([firstDoc, secondDoc, thirdDoc]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1383,7 +1393,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           it('should be enriched with host risk score', async () => {
             const rule: QueryRuleCreateProps = {
-              ...getRuleForSignalTesting(['suppression-data']),
+              ...getRuleForAlertTesting(['suppression-data']),
               query: `host.name: "host-0"`,
               alert_suppression: {
                 group_by: ['host.name'],
@@ -1474,7 +1484,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1545,7 +1555,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1600,7 +1610,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([firstDoc, firstDoc]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1654,7 +1664,7 @@ export default ({ getService }: FtrProviderContext) => {
           await indexListOfDocuments([firstDoc, firstDoc]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name'],
@@ -1752,7 +1762,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name', 'agent.version'],
@@ -1831,7 +1841,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
 
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['ecs_compliant']),
+            ...getRuleForAlertTesting(['ecs_compliant']),
             query: `id:${id}`,
             alert_suppression: {
               group_by: ['agent.name', 'agent.version'],
@@ -1898,7 +1908,7 @@ export default ({ getService }: FtrProviderContext) => {
           });
           it('should create suppressed alerts for single host.name when rule configure with suppress', async () => {
             const rule: QueryRuleCreateProps = {
-              ...getRuleForSignalTesting(['ecs_compliant']),
+              ...getRuleForAlertTesting(['ecs_compliant']),
               query: `id:${id}`,
               alert_suppression: {
                 group_by: ['agent.name'],
@@ -1965,7 +1975,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           it('should create unsuppressed alerts for single host.name', async () => {
             const rule: QueryRuleCreateProps = {
-              ...getRuleForSignalTesting(['ecs_compliant']),
+              ...getRuleForAlertTesting(['ecs_compliant']),
               query: `id:${id}`,
               alert_suppression: {
                 group_by: ['agent.name'],
@@ -2076,7 +2086,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['auditbeat-*']),
+          ...getRuleForAlertTesting(['auditbeat-*']),
           query: `_id:${ID} or _id:GBbXBmkBR346wHgn5_eR or _id:x10zJ2oE9v5HJNSHhyxi`,
           exceptions_list: [{ id, list_id: listId, type, namespace_type: namespaceType }],
         };
@@ -2119,7 +2129,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['auditbeat-*']),
+          ...getRuleForAlertTesting(['auditbeat-*']),
           query: `_id:${ID} or _id:GBbXBmkBR346wHgn5_eR or _id:x10zJ2oE9v5HJNSHhyxi`,
           exceptions_list: [{ id, list_id: listId, type, namespace_type: namespaceType }],
         };
@@ -2157,7 +2167,7 @@ export default ({ getService }: FtrProviderContext) => {
         await indexEnhancedDocuments({ documents: [firstDoc, firstDoc, secondDoc], id });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['ecs_compliant']),
+          ...getRuleForAlertTesting(['ecs_compliant']),
           query: `id:${id} AND agent.n*: test-1`,
           from: 'now-1h',
           interval: '1h',
@@ -2188,7 +2198,7 @@ export default ({ getService }: FtrProviderContext) => {
         await indexEnhancedDocuments({ documents: [firstDoc, firstDoc, secondDoc], id });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['ecs_compliant']),
+          ...getRuleForAlertTesting(['ecs_compliant']),
           query: `id:${id} AND NOT agent.na*: "test-1"`,
           from: 'now-1h',
           interval: '1h',
@@ -2215,7 +2225,7 @@ export default ({ getService }: FtrProviderContext) => {
         await indexEnhancedDocuments({ documents: [firstDoc, secondDoc, thirdDoc], id });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['ecs_compliant']),
+          ...getRuleForAlertTesting(['ecs_compliant']),
           query: `id:${id} AND agent*: "test-1"`,
           from: 'now-1h',
           interval: '1h',
@@ -2249,7 +2259,7 @@ export default ({ getService }: FtrProviderContext) => {
         await indexEnhancedDocuments({ documents: [firstDoc, secondDoc, thirdDoc], id });
 
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['ecs_compliant']),
+          ...getRuleForAlertTesting(['ecs_compliant']),
           query: `id:${id} AND agent.\\*: test-1`,
           from: 'now-1h',
           interval: '1h',
@@ -2276,7 +2286,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    describe('legacy investigation_fields', () => {
+    // TODO: Ask YARA
+    describe('@brokenInServerless legacy investigation_fields', () => {
       let ruleWithLegacyInvestigationField: Rule<BaseRuleParams>;
 
       beforeEach(async () => {
@@ -2317,7 +2328,7 @@ export default ({ getService }: FtrProviderContext) => {
           .set('elastic-api-version', '2023-10-31')
           .expect(200);
 
-        const alertsAfterEnable = await getOpenSignals(supertest, log, es, ruleBody, 'succeeded');
+        const alertsAfterEnable = await getOpenAlerts(supertest, log, es, ruleBody, 'succeeded');
         expect(alertsAfterEnable.hits.hits.length > 0).eql(true);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/saved_query.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/saved_query.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/saved_query.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/saved_query.ts
index ed7173133f9f38..e387a2f840c41c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/saved_query.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/saved_query.ts
@@ -20,10 +20,11 @@ import {
   createRule,
   deleteAllRules,
   deleteAllAlerts,
-  getOpenSignals,
-  getRuleForSignalTesting,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+  getOpenAlerts,
+  getRuleForAlertTesting,
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
 /**
  * Specific _id to use for some of the tests. If the archiver changes and you see errors
@@ -31,37 +32,41 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
  */
 const ID = 'BhbXBmkBR346wHgn4PeZ';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('Saved query type rules', () => {
+  describe('@ess @serverless Saved query type rules', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(path);
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(path);
       await deleteAllAlerts(supertest, log, es);
       await deleteAllRules(supertest, log);
     });
 
     // First test creates a real rule - remaining tests use preview API
-    it('should query and get back expected signal structure using a saved query rule', async () => {
+    it('should query and get back expected alert structure using a saved query rule', async () => {
       const rule: SavedQueryRuleCreateProps = {
-        ...getRuleForSignalTesting(['auditbeat-*']),
+        ...getRuleForAlertTesting(['auditbeat-*']),
         type: 'saved_query',
         query: `_id:${ID}`,
         saved_id: 'doesnt-exist',
       };
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
-      const signal = alerts.hits.hits[0]._source;
-      expect(signal).eql({
-        ...signal,
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
+      const alert = alerts.hits.hits[0]._source;
+      expect(alert).eql({
+        ...alert,
         [ALERT_ANCESTORS]: [
           {
             id: 'BhbXBmkBR346wHgn4PeZ',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threat_match.ts
similarity index 91%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threat_match.ts
index efed9c26375e2a..8d7cf8fd9f89b0 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threat_match.ts
@@ -35,16 +35,18 @@ import {
   ALERT_ORIGINAL_TIME,
 } from '@kbn/security-solution-plugin/common/field_maps/field_names';
 import { RuleExecutionStatusEnum } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_monitoring';
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import {
   previewRule,
-  getOpenSignals,
+  getOpenAlerts,
   getPreviewAlerts,
   deleteAllAlerts,
   deleteAllRules,
   createRule,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
+
 const format = (value: unknown): string => JSON.stringify(value, null, 2);
 
 // Asserts that each expected value is included in the subject, independent of
@@ -108,8 +110,8 @@ const createThreatMatchRule = ({
   threat_index,
   threat_mapping,
   threat_filters: [],
-  threat_indicator_path,
   ...override,
+  threat_indicator_path,
 });
 
 function alertsAreTheSame(alertsA: any[], alertsB: any[]): void {
@@ -130,6 +132,7 @@ function alertsAreTheSame(alertsA: any[], alertsB: any[]): void {
       'kibana.alert.start',
       'kibana.alert.reason',
       'kibana.alert.uuid',
+      'kibana.alert.url',
     ]);
   };
 
@@ -138,37 +141,40 @@ function alertsAreTheSame(alertsA: any[], alertsB: any[]): void {
 
   expect(sort(alertsA.map(mapAlert))).to.eql(sort(alertsB.map(mapAlert)));
 }
-
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const es = getService('es');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const audibeatHostsPath = dataPathBuilder.getPath('auditbeat/hosts');
+  const threatIntelPath = dataPathBuilder.getPath('filebeat/threat_intel');
 
   /**
    * Specific api integration tests for threat matching rule type
    */
   // FLAKY: https://github.com/elastic/kibana/issues/155304
-  describe('Threat match type rules', () => {
+  describe('@ess @serverless Threat match type rules', () => {
     before(async () => {
-      // await deleteSignalsIndex(supertest, log);
-      // await deleteAllAlerts(supertest, log);
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(audibeatHostsPath);
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(audibeatHostsPath);
       await deleteAllAlerts(supertest, log, es);
       await deleteAllRules(supertest, log);
     });
 
     // First 2 test creates a real rule - remaining tests use preview API
-    it('should be able to execute and get all signals when doing a specific query (terms query)', async () => {
+    it('should be able to execute and get all alerts when doing a specific query (terms query)', async () => {
       const rule: ThreatMatchRuleCreateProps = createThreatMatchRule();
 
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(
+      const alerts = await getOpenAlerts(
         supertest,
         log,
         es,
@@ -178,16 +184,15 @@ export default ({ getService }: FtrProviderContext) => {
       );
       expect(alerts.hits.hits.length).equal(88);
       const fullSource = alerts.hits.hits.find(
-        (signal) =>
-          (signal._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
+        (alert) => (alert._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
       );
-      const fullSignal = fullSource?._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = fullSource?._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
-      expect(fullSignal).eql({
-        ...fullSignal,
-        '@timestamp': fullSignal['@timestamp'],
+      expect(fullAlert).eql({
+        ...fullAlert,
+        '@timestamp': fullAlert['@timestamp'],
         agent: {
           ephemeral_id: '1b4978a0-48be-49b1-ac96-323425b389ab',
           hostname: 'zeek-sensor-amsterdam',
@@ -281,25 +286,25 @@ export default ({ getService }: FtrProviderContext) => {
         [ALERT_ORIGINAL_EVENT_ACTION]: 'error',
         [ALERT_ORIGINAL_EVENT_CATEGORY]: 'user-login',
         [ALERT_ORIGINAL_EVENT_MODULE]: 'auditd',
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_REASON]:
           'user-login event with source 46.101.47.213 by root on zeek-sensor-amsterdam created high alert Query with a rule id.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
         [ALERT_STATUS]: 'active',
-        [ALERT_UUID]: fullSignal[ALERT_UUID],
+        [ALERT_UUID]: fullAlert[ALERT_UUID],
         [ALERT_WORKFLOW_STATUS]: 'open',
         [ALERT_WORKFLOW_TAGS]: [],
         [SPACE_IDS]: ['default'],
-        [VERSION]: fullSignal[VERSION],
+        [VERSION]: fullAlert[VERSION],
         threat: {
-          enrichments: get(fullSignal, 'threat.enrichments'),
+          enrichments: get(fullAlert, 'threat.enrichments'),
         },
         ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
           actions: [],
           author: [],
           category: 'Indicator Match Rule',
           consumer: 'siem',
-          created_by: 'elastic',
+          created_by: ELASTICSEARCH_USERNAME,
           description: 'Detecting root and admin users',
           enabled: true,
           exceptions_list: [],
@@ -320,14 +325,14 @@ export default ({ getService }: FtrProviderContext) => {
           threat: [],
           to: 'now',
           type: 'threat_match',
-          updated_at: fullSignal[ALERT_RULE_UPDATED_AT],
-          updated_by: 'elastic',
-          uuid: fullSignal[ALERT_RULE_UUID],
+          updated_at: fullAlert[ALERT_RULE_UPDATED_AT],
+          updated_by: ELASTICSEARCH_USERNAME,
+          uuid: fullAlert[ALERT_RULE_UUID],
           version: 1,
         }),
       });
     });
-    it('should be able to execute and get all signals when doing a specific query (match query)', async () => {
+    it('should be able to execute and get all alerts when doing a specific query (match query)', async () => {
       const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
         threat_mapping: [
           // We match host.name against host.name
@@ -349,7 +354,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(
+      const alerts = await getOpenAlerts(
         supertest,
         log,
         es,
@@ -359,16 +364,15 @@ export default ({ getService }: FtrProviderContext) => {
       );
       expect(alerts.hits.hits.length).equal(88);
       const fullSource = alerts.hits.hits.find(
-        (signal) =>
-          (signal._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
+        (alert) => (alert._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
       );
-      const fullSignal = fullSource?._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = fullSource?._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
-      expect(fullSignal).eql({
-        ...fullSignal,
-        '@timestamp': fullSignal['@timestamp'],
+      expect(fullAlert).eql({
+        ...fullAlert,
+        '@timestamp': fullAlert['@timestamp'],
         agent: {
           ephemeral_id: '1b4978a0-48be-49b1-ac96-323425b389ab',
           hostname: 'zeek-sensor-amsterdam',
@@ -462,24 +466,24 @@ export default ({ getService }: FtrProviderContext) => {
         [ALERT_ORIGINAL_EVENT_ACTION]: 'error',
         [ALERT_ORIGINAL_EVENT_CATEGORY]: 'user-login',
         [ALERT_ORIGINAL_EVENT_MODULE]: 'auditd',
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_REASON]:
           'user-login event with source 46.101.47.213 by root on zeek-sensor-amsterdam created high alert Query with a rule id.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
         [ALERT_STATUS]: 'active',
-        [ALERT_UUID]: fullSignal[ALERT_UUID],
+        [ALERT_UUID]: fullAlert[ALERT_UUID],
         [ALERT_WORKFLOW_STATUS]: 'open',
         [SPACE_IDS]: ['default'],
-        [VERSION]: fullSignal[VERSION],
+        [VERSION]: fullAlert[VERSION],
         threat: {
-          enrichments: get(fullSignal, 'threat.enrichments'),
+          enrichments: get(fullAlert, 'threat.enrichments'),
         },
         ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
           actions: [],
           author: [],
           category: 'Indicator Match Rule',
           consumer: 'siem',
-          created_by: 'elastic',
+          created_by: ELASTICSEARCH_USERNAME,
           description: 'Detecting root and admin users',
           enabled: true,
           exceptions_list: [],
@@ -500,18 +504,18 @@ export default ({ getService }: FtrProviderContext) => {
           threat: [],
           to: 'now',
           type: 'threat_match',
-          updated_at: fullSignal[ALERT_RULE_UPDATED_AT],
-          updated_by: 'elastic',
-          uuid: fullSignal[ALERT_RULE_UUID],
+          updated_at: fullAlert[ALERT_RULE_UPDATED_AT],
+          updated_by: ELASTICSEARCH_USERNAME,
+          uuid: fullAlert[ALERT_RULE_UUID],
           version: 1,
         }),
       });
     });
 
-    it('generates max signals warning when circuit breaker is hit', async () => {
+    it('generates max alerts warning when circuit breaker is hit', async () => {
       const rule: ThreatMatchRuleCreateProps = { ...createThreatMatchRule(), max_signals: 87 }; // Query generates 88 alerts with current esArchive
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).contain(getMaxAlertsWarning());
     });
 
     it('terms and match should have the same alerts with pagination', async () => {
@@ -552,7 +556,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       const createdRuleTerm = await createRule(supertest, log, termRule);
       const createdRuleMatch = await createRule(supertest, log, matchRule);
-      const alertsTerm = await getOpenSignals(
+      const alertsTerm = await getOpenAlerts(
         supertest,
         log,
         es,
@@ -560,7 +564,7 @@ export default ({ getService }: FtrProviderContext) => {
         RuleExecutionStatusEnum.succeeded,
         100
       );
-      const alertsMatch = await getOpenSignals(
+      const alertsMatch = await getOpenAlerts(
         supertest,
         log,
         es,
@@ -593,7 +597,7 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).equal(0);
     });
 
-    it('should return 0 signals when using an AND and one of the clauses does not have data', async () => {
+    it('should return 0 alerts when using an AND and one of the clauses does not have data', async () => {
       const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
         threat_mapping: [
           {
@@ -618,7 +622,7 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).equal(0);
     });
 
-    it('should return 0 signals when using an AND and one of the clauses has a made up value that does not exist', async () => {
+    it('should return 0 alerts when using an AND and one of the clauses has a made up value that does not exist', async () => {
       const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
         threat_mapping: [
           {
@@ -661,14 +665,14 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('indicator enrichment: threat-first search', () => {
       before(async () => {
-        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/threat_intel');
+        await esArchiver.load(threatIntelPath);
       });
 
       after(async () => {
-        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/threat_intel');
+        await esArchiver.unload(threatIntelPath);
       });
 
-      it('enriches signals with the single indicator that matched', async () => {
+      it('enriches alerts with the single indicator that matched', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           threat_mapping: [
             {
@@ -744,9 +748,9 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
       });
 
-      it('enriches signals with multiple indicators if several matched', async () => {
+      it('enriches alerts with multiple indicators if several matched', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
-          query: 'NOT source.port:35326', // specify query to have signals more than treat indicators, but only 1 will match
+          query: 'NOT source.port:35326', // specify query to have alerts more than treat indicators, but only 1 will match
           threat_query: 'threat.indicator.ip: *',
           threat_index: ['filebeat-*'], // Mimics indicators from the filebeat MISP module
           threat_mapping: [
@@ -811,7 +815,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('adds a single indicator that matched multiple fields', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
-          query: 'NOT source.port:35326', // specify query to have signals more than treat indicators, but only 1 will match
+          query: 'NOT source.port:35326', // specify query to have alerts more than treat indicators, but only 1 will match
           threat_query: 'threat.indicator.port: 57324 or threat.indicator.ip:45.115.45.3', // narrow our query to a single indicator
           threat_index: ['filebeat-*'], // Mimics indicators from the filebeat MISP module
           threat_mapping: [
@@ -907,7 +911,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
       });
 
-      it('generates multiple signals with multiple matches', async () => {
+      it('generates multiple alerts with multiple matches', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           threat_query: '*:*',
           threat_index: ['filebeat-*'], // Mimics indicators from the filebeat MISP module
@@ -1032,7 +1036,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       // https://github.com/elastic/kibana/issues/149920
-      // generates same number of alerts similarly to "enriches signals with the single indicator that matches" test
+      // generates same number of alerts similarly to "enriches alerts with the single indicator that matches" test
       it('generates alerts with single match if queries contain field path wildcards', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           // still matches all documents as default *:*
@@ -1060,14 +1064,14 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('indicator enrichment: event-first search', () => {
       before(async () => {
-        await esArchiver.load('x-pack/test/functional/es_archives/filebeat/threat_intel');
+        await esArchiver.load(threatIntelPath);
       });
 
       after(async () => {
-        await esArchiver.unload('x-pack/test/functional/es_archives/filebeat/threat_intel');
+        await esArchiver.unload(threatIntelPath);
       });
 
-      it('enriches signals with the single indicator that matched', async () => {
+      it('enriches alerts with the single indicator that matched', async () => {
         const termRule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           query: 'destination.ip:159.89.119.67',
           threat_query: 'threat.indicator.domain: *', // narrow things down to indicators with a domain
@@ -1168,7 +1172,7 @@ export default ({ getService }: FtrProviderContext) => {
         alertsAreTheSame(termPreviewAlerts, matchPrevieAlerts);
       });
 
-      it('enriches signals with multiple indicators if several matched', async () => {
+      it('enriches alerts with multiple indicators if several matched', async () => {
         const termRule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           query: 'source.port: 57324', // narrow our query to a single record that matches two indicatorsthreat_query: 'threat.indicator.ip: *',
           threat_query: 'threat.indicator.ip: *',
@@ -1408,7 +1412,7 @@ export default ({ getService }: FtrProviderContext) => {
         );
       });
 
-      it('generates multiple signals with multiple matches', async () => {
+      it('generates multiple alerts with multiple matches', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           query: '(source.port:57324 and source.ip:45.115.45.3) or destination.ip:159.89.119.67', // narrow our query to a single record that matches two indicators
           threat_query: '*:*',
@@ -1534,7 +1538,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       // https://github.com/elastic/kibana/issues/149920
-      // creates same number of alerts similarly to "generates multiple signals with multiple matches" test
+      // creates same number of alerts similarly to "generates multiple alerts with multiple matches" test
       it('generates alerts with multiple matches if queries contain field path wildcards', async () => {
         const rule: ThreatMatchRuleCreateProps = createThreatMatchRule({
           // source.po* matches port source.port field
@@ -1605,16 +1609,16 @@ export default ({ getService }: FtrProviderContext) => {
         const previewAlerts = await getPreviewAlerts({ es, previewId, size: 100 });
         expect(previewAlerts.length).equal(88);
         const fullSource = previewAlerts.find(
-          (signal) =>
-            (signal._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
+          (alert) =>
+            (alert._source?.[ALERT_ANCESTORS] as Ancestor[])[0].id === '7yJ-B2kBR346wHgnhlMn'
         );
-        const fullSignal = fullSource?._source;
-        if (!fullSignal) {
-          return expect(fullSignal).to.be.ok();
+        const fullAlert = fullSource?._source;
+        if (!fullAlert) {
+          return expect(fullAlert).to.be.ok();
         }
 
-        expect(fullSignal?.host?.risk?.calculated_level).to.eql('Critical');
-        expect(fullSignal?.host?.risk?.calculated_score_norm).to.eql(70);
+        expect(fullAlert?.host?.risk?.calculated_level).to.eql('Critical');
+        expect(fullAlert?.host?.risk?.calculated_score_norm).to.eql(70);
       });
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threshold.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threshold.ts
similarity index 73%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threshold.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threshold.ts
index 36f41da15e1eea..81203c3d48a28a 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threshold.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/threshold.ts
@@ -21,51 +21,56 @@ import {
   ALERT_ORIGINAL_TIME,
   ALERT_THRESHOLD_RESULT,
 } from '@kbn/security-solution-plugin/common/field_maps/field_names';
-import { getMaxSignalsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
+import { getMaxSignalsWarning as getMaxAlertsWarning } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/utils';
 import {
   createRule,
-  getOpenSignals,
+  getOpenAlerts,
   getPreviewAlerts,
-  getThresholdRuleForSignalTesting,
+  getThresholdRuleForAlertTesting,
   previewRule,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+} from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('Threshold type rules', () => {
+  describe('@ess @serverless Threshold type rules', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(path);
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(path);
     });
 
     // First test creates a real rule - remaining tests use preview API
-    it('generates 1 signal from Threshold rules when threshold is met', async () => {
+    it('generates 1 alert from Threshold rules when threshold is met', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: ['host.id'],
           value: 700,
         },
       };
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
       expect(alerts.hits.hits.length).eql(1);
-      const fullSignal = alerts.hits.hits[0]._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = alerts.hits.hits[0]._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
-      const eventIds = (fullSignal?.[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
-      expect(fullSignal).eql({
-        ...fullSignal,
+      const eventIds = (fullAlert?.[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
+      expect(fullAlert).eql({
+        ...fullAlert,
         'host.id': '8cc95778cce5407c809480e8e32ad76b',
         [EVENT_KIND]: 'signal',
         [ALERT_ANCESTORS]: [
@@ -77,9 +82,9 @@ export default ({ getService }: FtrProviderContext) => {
           },
         ],
         [ALERT_WORKFLOW_STATUS]: 'open',
-        [ALERT_REASON]: 'event created high alert Signal Testing Query.',
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+        [ALERT_REASON]: 'event created high alert Alert Testing Query.',
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_DEPTH]: 1,
         [ALERT_THRESHOLD_RESULT]: {
           terms: [
@@ -94,9 +99,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('generates max signals warning when circuit breaker is exceeded', async () => {
+    it('generates max alerts warning when circuit breaker is exceeded', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 1, // This value generates 7 alerts with the current esArchive
@@ -104,12 +109,12 @@ export default ({ getService }: FtrProviderContext) => {
         max_signals: 5,
       };
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).contain(getMaxAlertsWarning());
     });
 
-    it("doesn't generate max signals warning when circuit breaker is met but not exceeded", async () => {
+    it("doesn't generate max alerts warning when circuit breaker is met but not exceeded", async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 1, // This value generates 7 alerts with the current esArchive
@@ -117,12 +122,12 @@ export default ({ getService }: FtrProviderContext) => {
         max_signals: 7,
       };
       const { logs } = await previewRule({ supertest, rule });
-      expect(logs[0].warnings).not.contain(getMaxSignalsWarning());
+      expect(logs[0].warnings).not.contain(getMaxAlertsWarning());
     });
 
-    it('generates 2 signals from Threshold rules when threshold is met', async () => {
+    it('generates 2 alerts from Threshold rules when threshold is met', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 100,
@@ -135,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('applies the provided query before bucketing ', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         query: 'host.id:"2ab45fc1c41e4c84bbd02202a7e5761f"',
         threshold: {
           field: 'process.name',
@@ -147,9 +152,9 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).eql(1);
     });
 
-    it('generates no signals from Threshold rules when threshold is met and cardinality is not met', async () => {
+    it('generates no alerts from Threshold rules when threshold is met and cardinality is not met', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 100,
@@ -166,9 +171,9 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).eql(0);
     });
 
-    it('generates no signals from Threshold rules when cardinality is met and threshold is not met', async () => {
+    it('generates no alerts from Threshold rules when cardinality is met and threshold is not met', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 1000,
@@ -185,9 +190,9 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).eql(0);
     });
 
-    it('generates signals from Threshold rules when threshold and cardinality are both met', async () => {
+    it('generates alerts from Threshold rules when threshold and cardinality are both met', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: 'host.id',
           value: 100,
@@ -202,13 +207,13 @@ export default ({ getService }: FtrProviderContext) => {
       const { previewId } = await previewRule({ supertest, rule });
       const previewAlerts = await getPreviewAlerts({ es, previewId });
       expect(previewAlerts.length).eql(1);
-      const fullSignal = previewAlerts[0]._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = previewAlerts[0]._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
-      const eventIds = (fullSignal?.[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
-      expect(fullSignal).eql({
-        ...fullSignal,
+      const eventIds = (fullAlert?.[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
+      expect(fullAlert).eql({
+        ...fullAlert,
         'host.id': '8cc95778cce5407c809480e8e32ad76b',
         [EVENT_KIND]: 'signal',
         [ALERT_ANCESTORS]: [
@@ -220,9 +225,9 @@ export default ({ getService }: FtrProviderContext) => {
           },
         ],
         [ALERT_WORKFLOW_STATUS]: 'open',
-        [ALERT_REASON]: `event created high alert Signal Testing Query.`,
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+        [ALERT_REASON]: `event created high alert Alert Testing Query.`,
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_DEPTH]: 1,
         [ALERT_THRESHOLD_RESULT]: {
           terms: [
@@ -243,9 +248,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
     });
 
-    it('should not generate signals if only one field meets the threshold requirement', async () => {
+    it('should not generate alerts if only one field meets the threshold requirement', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: ['host.id', 'process.name'],
           value: 22,
@@ -256,9 +261,9 @@ export default ({ getService }: FtrProviderContext) => {
       expect(previewAlerts.length).eql(0);
     });
 
-    it('generates signals from Threshold rules when bucketing by multiple fields', async () => {
+    it('generates alerts from Threshold rules when bucketing by multiple fields', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
         threshold: {
           field: ['host.id', 'process.name', 'event.module'],
           value: 21,
@@ -267,13 +272,13 @@ export default ({ getService }: FtrProviderContext) => {
       const { previewId } = await previewRule({ supertest, rule });
       const previewAlerts = await getPreviewAlerts({ es, previewId });
       expect(previewAlerts.length).eql(1);
-      const fullSignal = previewAlerts[0]._source;
-      if (!fullSignal) {
-        return expect(fullSignal).to.be.ok();
+      const fullAlert = previewAlerts[0]._source;
+      if (!fullAlert) {
+        return expect(fullAlert).to.be.ok();
       }
-      const eventIds = (fullSignal[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
-      expect(fullSignal).eql({
-        ...fullSignal,
+      const eventIds = (fullAlert[ALERT_ANCESTORS] as Ancestor[]).map((event) => event.id);
+      expect(fullAlert).eql({
+        ...fullAlert,
         'event.module': 'system',
         'host.id': '2ab45fc1c41e4c84bbd02202a7e5761f',
         'process.name': 'sshd',
@@ -287,9 +292,9 @@ export default ({ getService }: FtrProviderContext) => {
           },
         ],
         [ALERT_WORKFLOW_STATUS]: 'open',
-        [ALERT_REASON]: `event with process sshd, created high alert Signal Testing Query.`,
-        [ALERT_RULE_UUID]: fullSignal[ALERT_RULE_UUID],
-        [ALERT_ORIGINAL_TIME]: fullSignal[ALERT_ORIGINAL_TIME],
+        [ALERT_REASON]: `event with process sshd, created high alert Alert Testing Query.`,
+        [ALERT_RULE_UUID]: fullAlert[ALERT_RULE_UUID],
+        [ALERT_ORIGINAL_TIME]: fullAlert[ALERT_ORIGINAL_TIME],
         [ALERT_DEPTH]: 1,
         [ALERT_THRESHOLD_RESULT]: {
           terms: [
@@ -315,15 +320,15 @@ export default ({ getService }: FtrProviderContext) => {
     // https://github.com/elastic/kibana/issues/149920
     it('generates 1 alert when threshold is met and rule query has wildcard in field name', async () => {
       const rule: ThresholdRuleCreateProps = {
-        ...getThresholdRuleForSignalTesting(['auditbeat-*']),
-        query: 'agent.ty*:auditbeat', // this query should match all documents from index and we will receive 1 alert, similarly to "generates 1 signal from Threshold rules when threshold is met" test case
+        ...getThresholdRuleForAlertTesting(['auditbeat-*']),
+        query: 'agent.ty*:auditbeat', // this query should match all documents from index and we will receive 1 alert, similarly to "generates 1 alert from Threshold rules when threshold is met" test case
         threshold: {
           field: ['host.id'],
           value: 700,
         },
       };
       const createdRule = await createRule(supertest, log, rule);
-      const alerts = await getOpenSignals(supertest, log, es, createdRule);
+      const alerts = await getOpenAlerts(supertest, log, es, createdRule);
       expect(alerts.hits.hits.length).eql(1);
     });
 
@@ -342,7 +347,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('applies timestamp override when using single field', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getThresholdRuleForSignalTesting(['timestamp-fallback-test']),
+          ...getThresholdRuleForAlertTesting(['timestamp-fallback-test']),
           threshold: {
             field: 'host.name',
             value: 1,
@@ -370,7 +375,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('applies timestamp override when using multiple fields', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getThresholdRuleForSignalTesting(['timestamp-fallback-test']),
+          ...getThresholdRuleForAlertTesting(['timestamp-fallback-test']),
           threshold: {
             field: ['host.name', 'source.ip'],
             value: 1,
@@ -408,7 +413,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be enriched with host risk score', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+          ...getThresholdRuleForAlertTesting(['auditbeat-*']),
           threshold: {
             field: 'host.name',
             value: 100,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/ignore_fields.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/ignore_fields.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group10/ignore_fields.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/ignore_fields.ts
index 829224b9c60894..6ddee1846067d9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/ignore_fields.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/ignore_fields.ts
@@ -7,16 +7,15 @@
 
 import expect from '@kbn/expect';
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
   createRule,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getEqlRuleForSignalTesting,
-  getSignalsById,
+  getEqlRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
+  waitForAlertsToBePresent,
 } from '../../utils';
 
 interface Ignore {
@@ -26,10 +25,10 @@ interface Ignore {
   testing_regex?: string;
 }
 
-// eslint-disable-next-line import/no-default-export
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 export default ({ getService }: FtrProviderContext): void => {
   /**
-   * See the config file (detection_engine_api_integration/common/config.ts) for which field values were added to be ignored
+   * See the config file (config.ts) for which field values were added to be ignored
    * for testing. The values should be in the config around the area of:
    * --xpack.securitySolution.alertIgnoreFields=[testing.ignore_1,/[testingRegex]
    * meaning that the ignore fields values should be the array: ["testing.ignore_1", "/[testingRegex]/"]
@@ -47,7 +46,7 @@ export default ({ getService }: FtrProviderContext): void => {
    * server/lib/detection_engine/signals/source_fields_merging/utils/is_ignored.ts
    * server/lib/detection_engine/signals/source_fields_merging/utils/is_eql_bug_77152.ts
    */
-  describe('ignore_fields', () => {
+  describe('@ess @serverless ignore_fields', () => {
     const supertest = getService('supertest');
     const esArchiver = getService('esArchiver');
     const log = getService('log');
@@ -62,7 +61,7 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -70,14 +69,14 @@ export default ({ getService }: FtrProviderContext): void => {
       await deleteAllRules(supertest, log);
     });
 
-    it('should ignore the field of "testing_ignored"', async () => {
-      const rule = getEqlRuleForSignalTesting(['ignore_fields']);
+    it('@skipInQA should ignore the field of "testing_ignored"', async () => {
+      const rule = getEqlRuleForAlertTesting(['ignore_fields']);
 
       const { id } = await createRule(supertest, log, rule);
       await waitForRuleSuccess({ supertest, log, id });
-      await waitForSignalsToBePresent(supertest, log, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, log, id);
-      const hits = signalsOpen.hits.hits
+      await waitForAlertsToBePresent(supertest, log, 4, [id]);
+      const alertsOpen = await getAlertsById(supertest, log, id);
+      const hits = alertsOpen.hits.hits
         .map((hit) => (hit._source as Ignore).testing_ignored)
         .sort();
 
@@ -85,27 +84,27 @@ export default ({ getService }: FtrProviderContext): void => {
       expect(hits).to.eql([undefined, undefined, undefined, undefined]);
     });
 
-    it('should ignore the field of "testing_regex"', async () => {
-      const rule = getEqlRuleForSignalTesting(['ignore_fields']);
+    it('@skipInQA should ignore the field of "testing_regex"', async () => {
+      const rule = getEqlRuleForAlertTesting(['ignore_fields']);
 
       const { id } = await createRule(supertest, log, rule);
       await waitForRuleSuccess({ supertest, log, id });
-      await waitForSignalsToBePresent(supertest, log, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, log, id);
-      const hits = signalsOpen.hits.hits.map((hit) => (hit._source as Ignore).testing_regex).sort();
+      await waitForAlertsToBePresent(supertest, log, 4, [id]);
+      const alertsOpen = await getAlertsById(supertest, log, id);
+      const hits = alertsOpen.hits.hits.map((hit) => (hit._source as Ignore).testing_regex).sort();
 
       // Value should be "undefined for all records"
       expect(hits).to.eql([undefined, undefined, undefined, undefined]);
     });
 
     it('should have the field of "normal_constant"', async () => {
-      const rule = getEqlRuleForSignalTesting(['ignore_fields']);
+      const rule = getEqlRuleForAlertTesting(['ignore_fields']);
 
       const { id } = await createRule(supertest, log, rule);
       await waitForRuleSuccess({ supertest, log, id });
-      await waitForSignalsToBePresent(supertest, log, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, log, id);
-      const hits = signalsOpen.hits.hits
+      await waitForAlertsToBePresent(supertest, log, 4, [id]);
+      const alertsOpen = await getAlertsById(supertest, log, id);
+      const hits = alertsOpen.hits.hits
         .map((hit) => (hit._source as Ignore).normal_constant)
         .sort();
 
@@ -115,13 +114,13 @@ export default ({ getService }: FtrProviderContext): void => {
 
     // TODO: Remove this test once https://github.com/elastic/elasticsearch/issues/77152 is fixed
     it('should ignore the field of "_ignored" when using EQL and index the data', async () => {
-      const rule = getEqlRuleForSignalTesting(['ignore_fields']);
+      const rule = getEqlRuleForAlertTesting(['ignore_fields']);
 
       const { id } = await createRule(supertest, log, rule);
       await waitForRuleSuccess({ supertest, log, id });
-      await waitForSignalsToBePresent(supertest, log, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, log, id);
-      const hits = signalsOpen.hits.hits.map((hit) => (hit._source as Ignore).small_field).sort();
+      await waitForAlertsToBePresent(supertest, log, 4, [id]);
+      const alertsOpen = await getAlertsById(supertest, log, id);
+      const hits = alertsOpen.hits.hits.map((hit) => (hit._source as Ignore).small_field).sort();
 
       // We just test a constant value to ensure this did not blow up on us and did index data.
       expect(hits).to.eql([
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/index.ts
new file mode 100644
index 00000000000000..b497472e0b5744
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Rule execution logic API', function () {
+    loadTestFile(require.resolve('./keyword_family'));
+    loadTestFile(require.resolve('./ignore_fields'));
+    loadTestFile(require.resolve('./runtime'));
+    loadTestFile(require.resolve('./execution_logic'));
+    loadTestFile(require.resolve('./timestamps'));
+  });
+}
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/README.md b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/README.md
similarity index 100%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/README.md
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/README.md
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/const_keyword.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/const_keyword.ts
similarity index 66%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/const_keyword.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/const_keyword.ts
index 44c25e51ba11fb..0e3d01dc1ca228 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/const_keyword.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/const_keyword.ts
@@ -12,28 +12,27 @@ import {
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ALERT_THRESHOLD_RESULT } from '@kbn/security-solution-plugin/common/field_maps/field_names';
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
   createRule,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getEqlRuleForSignalTesting,
-  getRuleForSignalTesting,
-  getSignalsById,
-  getThresholdRuleForSignalTesting,
+  getEqlRuleForAlertTesting,
+  getRuleForAlertTesting,
+  getAlertsById,
+  getThresholdRuleForAlertTesting,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
+  waitForAlertsToBePresent,
 } from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule detects against a keyword of event.dataset', () => {
+  describe('@ess @serverless Rule detects against a keyword of event.dataset', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_keyword_family/const_keyword');
     });
@@ -45,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -54,28 +53,28 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     describe('"kql" rule type', () => {
-      it('should detect the "dataset_name_1" from "event.dataset" and have 4 signals', async () => {
+      it('should detect the "dataset_name_1" from "event.dataset" and have 4 alerts', async () => {
         const rule = {
-          ...getRuleForSignalTesting(['const_keyword']),
+          ...getRuleForAlertTesting(['const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        expect(signalsOpen.hits.hits.length).to.eql(4);
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        expect(alertsOpen.hits.hits.length).to.eql(4);
       });
 
-      it('should copy the dataset_name_1 from the index into the signal', async () => {
+      it('should copy the dataset_name_1 from the index into the alert', async () => {
         const rule = {
-          ...getRuleForSignalTesting(['const_keyword']),
+          ...getRuleForAlertTesting(['const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -86,30 +85,30 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     describe('"eql" rule type', () => {
-      it('should detect the "dataset_name_1" from "event.dataset" and have 4 signals', async () => {
+      it('should detect the "dataset_name_1" from "event.dataset" and have 4 alerts', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['const_keyword']),
+          ...getEqlRuleForAlertTesting(['const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        expect(signalsOpen.hits.hits.length).to.eql(4);
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        expect(alertsOpen.hits.hits.length).to.eql(4);
       });
 
       it('should copy the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['const_keyword']),
+          ...getEqlRuleForAlertTesting(['const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -122,7 +121,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"threshold" rule type', async () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getThresholdRuleForSignalTesting(['const_keyword']),
+          ...getThresholdRuleForAlertTesting(['const_keyword']),
           threshold: {
             field: 'event.dataset',
             value: 1,
@@ -130,9 +129,9 @@ export default ({ getService }: FtrProviderContext) => {
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
           .map((hit) => hit._source?.[ALERT_THRESHOLD_RESULT] ?? null)
           .sort();
         expect(hits).to.eql([
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/index.ts
similarity index 81%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/index.ts
index 1ecb06fbed4e51..7244085b6eff2c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/index.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection keyword family data types', function () {
     loadTestFile(require.resolve('./keyword'));
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword.ts
similarity index 72%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword.ts
index 39d62da77a1a87..5a4dbf09294254 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword.ts
@@ -13,21 +13,20 @@ import {
   ThresholdRuleCreateProps,
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ALERT_THRESHOLD_RESULT } from '@kbn/security-solution-plugin/common/field_maps/field_names';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
   createRule,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getEqlRuleForSignalTesting,
-  getRuleForSignalTesting,
-  getSignalsById,
-  getThresholdRuleForSignalTesting,
+  getEqlRuleForAlertTesting,
+  getRuleForAlertTesting,
+  getAlertsById,
+  getThresholdRuleForAlertTesting,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
+  waitForAlertsToBePresent,
 } from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -44,7 +43,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -52,17 +51,17 @@ export default ({ getService }: FtrProviderContext) => {
       await deleteAllRules(supertest, log);
     });
 
-    describe('"kql" rule type', () => {
+    describe('@ess @serverless "kql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: QueryRuleCreateProps = {
-          ...getRuleForSignalTesting(['keyword']),
+          ...getRuleForAlertTesting(['keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -75,15 +74,15 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"eql" rule type', () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['keyword']),
+          ...getEqlRuleForAlertTesting(['keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -96,7 +95,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"threshold" rule type', async () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getThresholdRuleForSignalTesting(['keyword']),
+          ...getThresholdRuleForAlertTesting(['keyword']),
           threshold: {
             field: 'event.dataset',
             value: 1,
@@ -104,9 +103,9 @@ export default ({ getService }: FtrProviderContext) => {
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
           .map((hit) => hit._source?.[ALERT_THRESHOLD_RESULT] ?? null)
           .sort();
         expect(hits).to.eql([
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword_mixed_with_const.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword_mixed_with_const.ts
similarity index 69%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword_mixed_with_const.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword_mixed_with_const.ts
index 50bbd7efde9f26..1353c0b6ca5ed7 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group5/keyword_family/keyword_mixed_with_const.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/keyword_family/keyword_mixed_with_const.ts
@@ -12,27 +12,26 @@ import {
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ALERT_THRESHOLD_RESULT } from '@kbn/security-solution-plugin/common/field_maps/field_names';
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
   createRule,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getEqlRuleForSignalTesting,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getEqlRuleForAlertTesting,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
+  waitForAlertsToBePresent,
 } from '../../../utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule detects against a keyword and constant_keyword of event.dataset', () => {
+  describe('@ess @serverless Rule detects against a keyword and constant_keyword of event.dataset', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_keyword_family/const_keyword');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_keyword_family/keyword');
@@ -46,7 +45,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -55,28 +54,28 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     describe('"kql" rule type', () => {
-      it('should detect the "dataset_name_1" from "event.dataset" and have 8 signals, 4 from each index', async () => {
+      it('should detect the "dataset_name_1" from "event.dataset" and have 8 alerts, 4 from each index', async () => {
         const rule = {
-          ...getRuleForSignalTesting(['keyword', 'const_keyword']),
+          ...getRuleForAlertTesting(['keyword', 'const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        expect(signalsOpen.hits.hits.length).to.eql(8);
+        await waitForAlertsToBePresent(supertest, log, 8, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        expect(alertsOpen.hits.hits.length).to.eql(8);
       });
 
-      it('should copy the dataset_name_1 from the index into the signal', async () => {
+      it('should copy the dataset_name_1 from the index into the alert', async () => {
         const rule = {
-          ...getRuleForSignalTesting(['keyword', 'const_keyword']),
+          ...getRuleForAlertTesting(['keyword', 'const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 8, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -91,30 +90,30 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     describe('"eql" rule type', () => {
-      it('should detect the "dataset_name_1" from "event.dataset" and have 8 signals, 4 from each index', async () => {
+      it('should detect the "dataset_name_1" from "event.dataset" and have 8 alerts, 4 from each index', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['keyword', 'const_keyword']),
+          ...getEqlRuleForAlertTesting(['keyword', 'const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        expect(signalsOpen.hits.hits.length).to.eql(8);
+        await waitForAlertsToBePresent(supertest, log, 8, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        expect(alertsOpen.hits.hits.length).to.eql(8);
       });
 
       it('should copy the "dataset_name_1" from "event.dataset"', async () => {
         const rule: EqlRuleCreateProps = {
-          ...getEqlRuleForSignalTesting(['keyword', 'const_keyword']),
+          ...getEqlRuleForAlertTesting(['keyword', 'const_keyword']),
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
+        await waitForAlertsToBePresent(supertest, log, 8, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
           'dataset_name_1',
@@ -131,7 +130,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"threshold" rule type', async () => {
       it('should detect the "dataset_name_1" from "event.dataset"', async () => {
         const rule: ThresholdRuleCreateProps = {
-          ...getRuleForSignalTesting(['keyword', 'const_keyword']),
+          ...getRuleForAlertTesting(['keyword', 'const_keyword']),
           rule_id: 'threshold-rule',
           type: 'threshold',
           language: 'kuery',
@@ -143,9 +142,9 @@ export default ({ getService }: FtrProviderContext) => {
         };
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
           .map((hit) => hit._source?.[ALERT_THRESHOLD_RESULT] ?? null)
           .sort();
         expect(hits).to.eql([
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/runtime.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/runtime.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group10/runtime.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/runtime.ts
index 83c988c5ff9fd1..030f2eafd6a1e9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/runtime.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/runtime.ts
@@ -8,19 +8,18 @@
 import expect from '@kbn/expect';
 import { performance } from 'perf_hooks';
 
-import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
   createRule,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
+  waitForAlertsToBePresent,
 } from '../../utils';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
@@ -33,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   }
 
   // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/138923
-  describe('Tests involving runtime fields of source indexes and the signals index', () => {
+  describe('@ess @serverless Tests involving runtime fields of source indexes and the alerts index', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/runtime');
     });
@@ -44,7 +43,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('Regular runtime field mappings', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
       });
 
       afterEach(async () => {
@@ -53,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should execute a rule to completion and not timeout when there are a lot of runtime fields', async () => {
-        const rule = getRuleForSignalTesting(['runtime']);
+        const rule = getRuleForAlertTesting(['runtime']);
         const { id } = await createRule(supertest, log, rule);
         const start = performance.now();
         await waitForRuleSuccess({ supertest, log, id });
@@ -61,26 +60,26 @@ export default ({ getService }: FtrProviderContext) => {
         expect(end - start).to.be.lessThan(10000);
       });
 
-      it('should copy normal non-runtime data set from the source index into the signals index in the same position when the target is ECS compatible', async () => {
-        const rule = getRuleForSignalTesting(['runtime']);
+      it('should copy normal non-runtime data set from the source index into the alerts index in the same position when the target is ECS compatible', async () => {
+        const rule = getRuleForAlertTesting(['runtime']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
-          .map((signal) => (signal._source?.host as Runtime).name)
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
+          .map((alert) => (alert._source?.host as Runtime).name)
           .sort();
         expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
       });
 
-      it('should copy "runtime mapping" data from a source index into the signals index in the same position when the target is ECS compatible', async () => {
-        const rule = getRuleForSignalTesting(['runtime']);
+      it('should copy "runtime mapping" data from a source index into the alerts index in the same position when the target is ECS compatible', async () => {
+        const rule = getRuleForAlertTesting(['runtime']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
-          .map((signal) => (signal._source?.host as Runtime).hostname)
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
+          .map((alert) => (alert._source?.host as Runtime).hostname)
           .sort();
         expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
       });
@@ -88,7 +87,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('Runtime field mappings that have conflicts within them', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields'
         );
@@ -107,14 +106,14 @@ export default ({ getService }: FtrProviderContext) => {
        * risk with overwriting fields in the strategy we are currently using in detection engine. If you swap, change the strategies
        * because we decide to overwrite "_source" values with "fields", then expect to change this test.
        */
-      it('should NOT copy normal non-runtime data set from the source index into the signals index in the same position when the target is ECS compatible', async () => {
-        const rule = getRuleForSignalTesting(['runtime_conflicting_fields']);
+      it('should NOT copy normal non-runtime data set from the source index into the alerts index in the same position when the target is ECS compatible', async () => {
+        const rule = getRuleForAlertTesting(['runtime_conflicting_fields']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits
-          .map((signal) => signal._source?.host as Array<{ name: string }>)
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits
+          .map((alert) => alert._source?.host as Array<{ name: string }>)
           .map((host) => {
             // sort the inner array elements first
             return host.sort((a, b) => a.name.localeCompare(b.name));
@@ -164,15 +163,13 @@ export default ({ getService }: FtrProviderContext) => {
        * fields as arrays of objects since the objects are flattened in "fields" and we detect something already there so we skip
        * this shadowed runtime data as it is ambiguous of where we would put it in the array.
        */
-      it('should NOT copy "runtime mapping" data from a source index into the signals index in the same position when the target is ECS compatible', async () => {
-        const rule = getRuleForSignalTesting(['runtime_conflicting_fields']);
+      it('should NOT copy "runtime mapping" data from a source index into the alerts index in the same position when the target is ECS compatible', async () => {
+        const rule = getRuleForAlertTesting(['runtime_conflicting_fields']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map(
-          (signal) => (signal._source?.host as Runtime).hostname
-        );
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((alert) => (alert._source?.host as Runtime).hostname);
         expect(hits).to.eql([undefined, undefined, undefined, undefined]);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/timestamps.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/timestamps.ts
similarity index 58%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group10/timestamps.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/timestamps.ts
index ef27b7c7ff4bd4..d7c645c115082e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/timestamps.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/timestamps.ts
@@ -14,37 +14,41 @@ import {
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ALERT_ORIGINAL_TIME } from '@kbn/security-solution-plugin/common/field_maps/field_names';
 
-import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
   createRule,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-  getOpenSignals,
-  getRuleForSignalTesting,
-  getSignalsByIds,
-  getEqlRuleForSignalTesting,
+  waitForAlertsToBePresent,
+  getOpenAlerts,
+  getRuleForAlertTesting,
+  getAlertsByIds,
+  getEqlRuleForAlertTesting,
   waitForRulePartialFailure,
 } from '../../utils';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
   const log = getService('log');
-
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
   /**
-   * Tests around timestamps within signals such as the copying of timestamps correctly into
+   * Tests around timestamps within alerts such as the copying of timestamps correctly into
    * the "signal.original_time" field, ensuring that timestamp overrides operate, and ensuring that
    * partial errors happen correctly
    */
-  describe('timestamp tests', () => {
-    describe('Signals generated from events with a timestamp in seconds is converted correctly into the forced ISO8601 format when copying', () => {
+  describe('@ess @serverless timestamp tests', () => {
+    describe('alerts generated from events with a timestamp in seconds is converted correctly into the forced ISO8601 format when copying', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds'
         );
@@ -66,58 +70,50 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('KQL query', () => {
         it('should convert the @timestamp which is epoch_seconds into the correct ISO format', async () => {
-          const rule = getRuleForSignalTesting(['timestamp_in_seconds']);
+          const rule = getRuleForAlertTesting(['timestamp_in_seconds']);
           const { id } = await createRule(supertest, log, rule);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
-          const hits = signalsOpen.hits.hits
-            .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
-            .sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsByIds(supertest, log, [id]);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.[ALERT_ORIGINAL_TIME]).sort();
           expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
         });
 
         it('should still use the @timestamp field even with an override field. It should never use the override field', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfakeindex-5']),
+            ...getRuleForAlertTesting(['myfakeindex-5']),
             timestamp_override: 'event.ingested',
           };
           const { id } = await createRule(supertest, log, rule);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
-          const hits = signalsOpen.hits.hits
-            .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
-            .sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsByIds(supertest, log, [id]);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.[ALERT_ORIGINAL_TIME]).sort();
           expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
         });
       });
 
       describe('EQL query', () => {
         it('should convert the @timestamp which is epoch_seconds into the correct ISO format for EQL', async () => {
-          const rule = getEqlRuleForSignalTesting(['timestamp_in_seconds']);
+          const rule = getEqlRuleForAlertTesting(['timestamp_in_seconds']);
           const { id } = await createRule(supertest, log, rule);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
-          const hits = signalsOpen.hits.hits
-            .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
-            .sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsByIds(supertest, log, [id]);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.[ALERT_ORIGINAL_TIME]).sort();
           expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
         });
 
         it('should still use the @timestamp field even with an override field. It should never use the override field', async () => {
           const rule: EqlRuleCreateProps = {
-            ...getEqlRuleForSignalTesting(['myfakeindex-5']),
+            ...getEqlRuleForAlertTesting(['myfakeindex-5']),
             timestamp_override: 'event.ingested',
           };
           const { id } = await createRule(supertest, log, rule);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
-          const hits = signalsOpen.hits.hits
-            .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
-            .sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsByIds(supertest, log, [id]);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.[ALERT_ORIGINAL_TIME]).sort();
           expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
         });
       });
@@ -129,10 +125,10 @@ export default ({ getService }: FtrProviderContext) => {
      * If no timestamp override field exists in the indices but one was provided to the rule,
      * the rule's query will additionally search for events using the `@timestamp` field
      */
-    describe('Signals generated from events with timestamp override field', async () => {
+    describe('alerts generated from events with timestamp override field', async () => {
       beforeEach(async () => {
         await deleteAllAlerts(supertest, log, es);
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/timestamp_override_1'
         );
@@ -165,9 +161,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       describe('KQL', () => {
-        it('should generate signals with event.ingested, @timestamp and (event.ingested + timestamp)', async () => {
+        it('should generate alerts with event.ingested, @timestamp and (event.ingested + timestamp)', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfa*']),
+            ...getRuleForAlertTesting(['myfa*']),
             timestamp_override: 'event.ingested',
           };
 
@@ -178,17 +174,17 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id], 3);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id], 3);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(3);
+          expect(alertsOrderedByEventId.length).equal(3);
         });
 
-        it('should generate 2 signals with event.ingested when timestamp fallback is disabled', async () => {
+        it('should generate 2 alerts with event.ingested when timestamp fallback is disabled', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfa*']),
+            ...getRuleForAlertTesting(['myfa*']),
             rule_id: 'rule-without-timestamp-fallback',
             timestamp_override: 'event.ingested',
             timestamp_override_fallback_disabled: true,
@@ -201,16 +197,16 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id], 2);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id], 2);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(2);
+          expect(alertsOrderedByEventId.length).equal(2);
         });
 
-        it('should generate 2 signals with @timestamp', async () => {
-          const rule: QueryRuleCreateProps = getRuleForSignalTesting(['myfa*']);
+        it('should generate 2 alerts with @timestamp', async () => {
+          const rule: QueryRuleCreateProps = getRuleForAlertTesting(['myfa*']);
 
           const { id } = await createRule(supertest, log, rule);
 
@@ -219,17 +215,17 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id]);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id]);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(2);
+          expect(alertsOrderedByEventId.length).equal(2);
         });
 
-        it('should generate 2 signals when timestamp override does not exist', async () => {
+        it('should generate 2 alerts when timestamp override does not exist', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfa*']),
+            ...getRuleForAlertTesting(['myfa*']),
             timestamp_override: 'event.fakeingestfield',
           };
           const { id } = await createRule(supertest, log, rule);
@@ -239,50 +235,50 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id, id]);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id, id]);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(2);
+          expect(alertsOrderedByEventId.length).equal(2);
         });
 
-        it('should not generate any signals when timestamp override does not exist and timestamp fallback is disabled', async () => {
+        it('should not generate any alerts when timestamp override does not exist and timestamp fallback is disabled', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfa*']),
+            ...getRuleForAlertTesting(['myfa*']),
             rule_id: 'rule-without-timestamp-fallback',
             timestamp_override: 'event.fakeingestfield',
             timestamp_override_fallback_disabled: true,
           };
 
           const createdRule = await createRule(supertest, log, rule);
-          const signalsOpen = await getOpenSignals(
+          const alertsOpen = await getOpenAlerts(
             supertest,
             log,
             es,
             createdRule,
             RuleExecutionStatusEnum['partial failure']
           );
-          expect(signalsOpen.hits.hits.length).eql(0);
+          expect(alertsOpen.hits.hits.length).eql(0);
         });
 
         /**
          * We should not use the timestamp override as the "original_time" as that can cause
          * confusion if you have both a timestamp and an override in the source event. Instead the "original_time"
-         * field should only be overridden by the "timestamp" since when we generate a signal
-         * and we add a new timestamp to the signal.
+         * field should only be overridden by the "timestamp" since when we generate a alert
+         * and we add a new timestamp to the alert.
          */
         it('should NOT use the timestamp override as the "original_time"', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['myfakeindex-2']),
+            ...getRuleForAlertTesting(['myfakeindex-2']),
             timestamp_override: 'event.ingested',
           };
           const { id } = await createRule(supertest, log, rule);
 
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id, id]);
-          const hits = signalsResponse.hits.hits
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id, id]);
+          const hits = alertsResponse.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
           expect(hits).to.eql([undefined]);
@@ -290,8 +286,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       describe('EQL', () => {
-        it('should generate 2 signals with @timestamp', async () => {
-          const rule: EqlRuleCreateProps = getEqlRuleForSignalTesting(['myfa*']);
+        it('should generate 2 alerts with @timestamp', async () => {
+          const rule: EqlRuleCreateProps = getEqlRuleForAlertTesting(['myfa*']);
 
           const { id } = await createRule(supertest, log, rule);
 
@@ -300,17 +296,17 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id]);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id]);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(2);
+          expect(alertsOrderedByEventId.length).equal(2);
         });
 
-        it('should generate 2 signals when timestamp override does not exist', async () => {
+        it('should generate 2 alerts when timestamp override does not exist', async () => {
           const rule: EqlRuleCreateProps = {
-            ...getEqlRuleForSignalTesting(['myfa*']),
+            ...getEqlRuleForAlertTesting(['myfa*']),
             timestamp_override: 'event.fakeingestfield',
           };
           const { id } = await createRule(supertest, log, rule);
@@ -320,44 +316,44 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id, id]);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
-          const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id, id]);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
+          const alertsOrderedByEventId = orderBy(alerts, 'alert.parent.id', 'asc');
 
-          expect(signalsOrderedByEventId.length).equal(2);
+          expect(alertsOrderedByEventId.length).equal(2);
         });
 
-        it('should not generate any signals when timestamp override does not exist and timestamp fallback is disabled', async () => {
+        it('should not generate any alerts when timestamp override does not exist and timestamp fallback is disabled', async () => {
           const rule: EqlRuleCreateProps = {
-            ...getEqlRuleForSignalTesting(['myfa*']),
+            ...getEqlRuleForAlertTesting(['myfa*']),
             timestamp_override: 'event.fakeingestfield',
             timestamp_override_fallback_disabled: true,
           };
           const createdRule = await createRule(supertest, log, rule);
-          const signalsOpen = await getOpenSignals(
+          const alertsOpen = await getOpenAlerts(
             supertest,
             log,
             es,
             createdRule,
             RuleExecutionStatusEnum['partial failure']
           );
-          expect(signalsOpen.hits.hits.length).eql(0);
+          expect(alertsOpen.hits.hits.length).eql(0);
         });
       });
     });
 
-    describe('Signals generated from events with timestamp override field and ensures search_after continues to work when documents are missing timestamp override field', () => {
+    describe('alerts generated from events with timestamp override field and ensures search_after continues to work when documents are missing timestamp override field', () => {
       before(async () => {
-        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+        await esArchiver.load(path);
       });
 
       after(async () => {
-        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+        await esArchiver.unload(path);
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
       });
 
       afterEach(async () => {
@@ -377,9 +373,9 @@ export default ({ getService }: FtrProviderContext) => {
          *
          * ref: https://github.com/elastic/elasticsearch/issues/28806#issuecomment-369303620
          */
-        it('should generate 200 signals when timestamp override does not exist', async () => {
+        it('should generate 200 alerts when timestamp override does not exist', async () => {
           const rule: QueryRuleCreateProps = {
-            ...getRuleForSignalTesting(['auditbeat-*']),
+            ...getRuleForAlertTesting(['auditbeat-*']),
             timestamp_override: 'event.fakeingested',
             max_signals: 200,
           };
@@ -390,11 +386,11 @@ export default ({ getService }: FtrProviderContext) => {
             log,
             id,
           });
-          await waitForSignalsToBePresent(supertest, log, 200, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, log, [id], 200);
-          const signals = signalsResponse.hits.hits.map((hit) => hit._source);
+          await waitForAlertsToBePresent(supertest, log, 200, [id]);
+          const alertsResponse = await getAlertsByIds(supertest, log, [id], 200);
+          const alerts = alertsResponse.hits.hits.map((hit) => hit._source);
 
-          expect(signals.length).equal(200);
+          expect(alerts.length).equal(200);
         });
       });
     });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/create_new_action.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/create_new_action.ts
index 7cbe8e858a043e..1ddce1f07114c8 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/create_new_action.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/create_new_action.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { ToolingLog } from '@kbn/tooling-log';
+import { RuleAction } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import type SuperTest from 'supertest';
 
 import { getWebHookAction } from './get_web_hook_action';
@@ -13,23 +13,18 @@ import { getWebHookAction } from './get_web_hook_action';
 /**
  * Helper to cut down on the noise in some of the tests. This
  * creates a new action and expects a 200 and does not do any retries.
+ *
  * @param supertest The supertest deps
  */
-export const createNewAction = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>,
-  log: ToolingLog
-) => {
-  const response = await supertest
-    .post('/api/actions/action')
-    .set('kbn-xsrf', 'true')
-    .set('x-elastic-internal-origin', 'foo')
-    .send(getWebHookAction());
-  if (response.status !== 200) {
-    log.error(
-      `Did not get an expected 200 "ok" when creating a new action. CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
-        response.body
-      )}, status: ${JSON.stringify(response.status)}`
-    );
-  }
-  return response.body;
+export const createWebHookRuleAction = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+): Promise<RuleAction> => {
+  return (
+    await supertest
+      .post('/api/actions/action')
+      .set('kbn-xsrf', 'true')
+      .set('x-elastic-internal-origin', 'foo')
+      .send(getWebHookAction())
+      .expect(200)
+  ).body;
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts
index af7e564d1c6633..f91323f94de59f 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts
@@ -6,6 +6,5 @@
  */
 export * from './get_slack_action';
 export * from './get_web_hook_action';
-export * from './remove_uuid_from_actions';
 export * from './create_new_action';
 export * from './legacy_actions';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/remove_uuid_from_actions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/remove_uuid_from_actions.ts
deleted file mode 100644
index 7f49c65ff8a253..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/remove_uuid_from_actions.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { RuleAction } from '@kbn/security-solution-plugin/common/api/detection_engine';
-
-export const removeUUIDFromActions = (actions: RuleAction[]): RuleAction[] => {
-  return actions.map(({ uuid, ...restOfAction }) => ({
-    ...restOfAction,
-  }));
-};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_preview_alerts.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_preview_alerts.ts
new file mode 100644
index 00000000000000..744027c3fd4eb5
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_preview_alerts.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Client } from '@elastic/elasticsearch';
+import { ALERT_RULE_UUID } from '@kbn/rule-data-utils';
+import { DetectionAlert } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { RiskEnrichmentFields } from '@kbn/security-solution-plugin/server/lib/detection_engine/rule_types/utils/enrichments/types';
+import { refreshIndex } from '../refresh_index';
+
+/**
+ * Refresh an index, making changes available to search.
+ * Useful for tests where we want to ensure that a rule does NOT create alerts, e.g. testing exceptions.
+ * @param es The ElasticSearch handle
+ */
+export const getPreviewAlerts = async ({
+  es,
+  previewId,
+  size,
+  sort,
+}: {
+  es: Client;
+  previewId: string;
+  size?: number;
+  sort?: string[];
+}) => {
+  const index = '.preview.alerts-security.alerts-*';
+  await refreshIndex(es, index);
+  const query = {
+    bool: {
+      filter: {
+        term: {
+          [ALERT_RULE_UUID]: previewId,
+        },
+      },
+    },
+  };
+  const result = await es.search<DetectionAlert & RiskEnrichmentFields>({
+    index,
+    size,
+    query,
+    sort,
+  });
+  return result.hits.hits;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts
index ce29837b34f6e3..975c6ffa509cc6 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts
@@ -14,9 +14,10 @@ export * from './get_open_alerts';
 export * from './get_alerts_by_ids';
 export * from './get_query_alerts_ids';
 export * from './get_alerts_by_id';
-export * from './remove_random_valued_properties';
+export * from './remove_random_valued_properties_from_alert';
 export * from './set_alert_status';
 export * from './get_alert_status_empty_response';
 export * from './get_query_alert_ids';
 export * from './set_alert_tags';
+export * from './get_preview_alerts';
 export * from './migrations';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties.ts
deleted file mode 100644
index 8530c085e1a5dc..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { DetectionAlert } from '@kbn/security-solution-plugin/common/api/detection_engine';
-import { ALERT_LAST_DETECTED, ALERT_START } from '@kbn/rule-data-utils';
-
-export const removeRandomValuedProperties = (alert: DetectionAlert | undefined) => {
-  if (!alert) {
-    return undefined;
-  }
-  const {
-    'kibana.version': version,
-    'kibana.alert.rule.execution.uuid': execUuid,
-    'kibana.alert.rule.uuid': uuid,
-    '@timestamp': timestamp,
-    'kibana.alert.rule.created_at': createdAt,
-    'kibana.alert.rule.updated_at': updatedAt,
-    'kibana.alert.uuid': alertUuid,
-    [ALERT_START]: alertStart,
-    [ALERT_LAST_DETECTED]: lastDetected,
-    ...restOfAlert
-  } = alert;
-  return restOfAlert;
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/utils.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties_from_alert.ts
similarity index 87%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/utils.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties_from_alert.ts
index 8530c085e1a5dc..3161fe1a61a6ea 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/utils.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/remove_random_valued_properties_from_alert.ts
@@ -8,7 +8,7 @@
 import { DetectionAlert } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { ALERT_LAST_DETECTED, ALERT_START } from '@kbn/rule-data-utils';
 
-export const removeRandomValuedProperties = (alert: DetectionAlert | undefined) => {
+export const removeRandomValuedPropertiesFromAlert = (alert: DetectionAlert | undefined) => {
   if (!alert) {
     return undefined;
   }
@@ -20,6 +20,7 @@ export const removeRandomValuedProperties = (alert: DetectionAlert | undefined)
     'kibana.alert.rule.created_at': createdAt,
     'kibana.alert.rule.updated_at': updatedAt,
     'kibana.alert.uuid': alertUuid,
+    'kibana.alert.url': alertURL,
     [ALERT_START]: alertStart,
     [ALERT_LAST_DETECTED]: lastDetected,
     ...restOfAlert
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
index 9af5821d08ac37..87fd3c61d54e7f 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
@@ -9,6 +9,7 @@ export * from './exception_list_and_item';
 export * from './alerts';
 export * from './actions';
 export * from './data_generator';
+export * from './machine_learning';
 
 export * from './rules/get_rule_so_by_id';
 export * from './rules/create_rule_saved_object';
diff --git a/x-pack/plugins/reporting/server/export_types/csv_v2/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/index.ts
similarity index 84%
rename from x-pack/plugins/reporting/server/export_types/csv_v2/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/index.ts
index e54b2e3a5b33c3..6d6870b7ac92ae 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_v2/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/index.ts
@@ -4,5 +4,4 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
-export { CsvV2ExportType } from './csv_v2';
+export * from './machine_learning_setup';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/machine_learning_setup.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/machine_learning_setup.ts
new file mode 100644
index 00000000000000..d7c7e6387c7392
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/machine_learning/machine_learning_setup.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type SuperTest from 'supertest';
+import { getCommonRequestHeader } from '../../../../../functional/services/ml/common_api';
+
+export const executeSetupModuleRequest = async ({
+  module,
+  rspCode,
+  supertest,
+}: {
+  module: string;
+  rspCode: number;
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+}) => {
+  const { body } = await supertest
+    .post(`/internal/ml/modules/setup/${module}`)
+    .set(getCommonRequestHeader('1'))
+    .send({
+      prefix: '',
+      groups: ['auditbeat'],
+      indexPatternName: 'auditbeat-*',
+      startDatafeed: false,
+      useDedicatedIndex: true,
+      applyToAllSpaces: true,
+    })
+    .expect(rspCode);
+
+  return body;
+};
+
+export const forceStartDatafeeds = async ({
+  jobId,
+  rspCode,
+  supertest,
+}: {
+  jobId: string;
+  rspCode: number;
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+}) => {
+  const { body } = await supertest
+    .post(`/internal/ml/jobs/force_start_datafeeds`)
+    .set(getCommonRequestHeader('1'))
+    .send({
+      datafeedIds: [`datafeed-${jobId}`],
+      start: new Date().getUTCMilliseconds(),
+    })
+    .expect(rspCode);
+
+  return body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/fetch_rule.ts
similarity index 52%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/fetch_rule.ts
index 32b2c0b1d5df66..8e9e1008ff4042 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/fetch_rule.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import type { ToolingLog } from '@kbn/tooling-log';
 import type SuperTest from 'supertest';
 import type { RuleResponse } from '@kbn/security-solution-plugin/common/api/detection_engine';
 
@@ -14,25 +13,19 @@ import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common
 /**
  * Helper to cut down on the noise in some of the tests. This gets
  * a particular rule.
+ *
  * @param supertest The supertest deps
  * @param rule The rule to create
  */
-export const getRule = async (
+export const fetchRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
-  log: ToolingLog,
-  ruleId: string
-): Promise<RuleResponse> => {
-  const response = await supertest
-    .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=${ruleId}`)
-    .set('kbn-xsrf', 'true')
-    .set('elastic-api-version', '2023-10-31');
-
-  if (response.status !== 200) {
-    log.error(
-      `Did not get an expected 200 "ok" when getting a rule (getRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
-        response.body
-      )}, status: ${JSON.stringify(response.status)}`
-    );
-  }
-  return response.body;
-};
+  idOrRuleId: { id: string; ruleId?: never } | { id?: never; ruleId: string }
+): Promise<RuleResponse> =>
+  (
+    await supertest
+      .get(DETECTION_ENGINE_RULES_URL)
+      .set('kbn-xsrf', 'true')
+      .set('elastic-api-version', '2023-10-31')
+      .query({ id: idOrRuleId.id, rule_id: idOrRuleId.ruleId })
+      .expect(200)
+  ).body;
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/generate_event.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/generate_event.ts
new file mode 100644
index 00000000000000..ea7a61f222eec7
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/generate_event.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SecurityEvent } from './types';
+
+export function generateEvent(extra: Record<string, unknown> = {}): SecurityEvent {
+  return {
+    '@timestamp': Date.now(),
+    ecs: { version: '1.4.0' },
+    event: { kind: 'event', category: 'process', type: 'start' },
+    ...extra,
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts
index d6d51ebb52d00e..5649031185febb 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts
@@ -19,7 +19,7 @@ export const getRuleForAlertTesting = (
   ruleId = 'rule-1',
   enabled = true
 ): QueryRuleCreateProps => ({
-  name: 'Signal Testing Query',
+  name: 'Alert Testing Query',
   description: 'Tests a simple query',
   enabled,
   risk_score: 1,
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts
index e8201ce517cff4..86fc55bd296520 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts
@@ -13,7 +13,7 @@ export const getRuleForAlertTestingWithTimestampOverride = (
   enabled = true,
   timestampOverride = 'event.ingested'
 ): QueryRuleCreateProps => ({
-  name: 'Signal Testing Query',
+  name: 'Alert Testing Query',
   description: 'Tests a simple query',
   enabled,
   risk_score: 1,
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_custom_query_rule_params.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_custom_query_rule_params.ts
new file mode 100644
index 00000000000000..b561d3e8dc0239
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_custom_query_rule_params.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { QueryRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { CreateRulePropsRewrites } from './types';
+
+/**
+ * Returns custom query rule params that is easy for most basic testing of output of alerts.
+ * It starts out in an disabled state. The 'from' is set very far back to test the basics of signal
+ * creation and testing by getting all the signals at once.
+ *
+ * @param rewrites rule params rewrites, see QueryRuleCreateProps for possible fields
+ */
+export function getCustomQueryRuleParams(
+  rewrites?: CreateRulePropsRewrites<QueryRuleCreateProps>
+): QueryRuleCreateProps {
+  return {
+    type: 'query',
+    query: '*:*',
+    name: 'Custom query rule',
+    description: 'Custom query rule description',
+    risk_score: 1,
+    rule_id: 'rule-1',
+    severity: 'high',
+    index: ['logs-*'],
+    interval: '100m',
+    from: 'now-6m',
+    enabled: false,
+    ...rewrites,
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_ml_rule_params.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_ml_rule_params.ts
new file mode 100644
index 00000000000000..da8de0ad997864
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_ml_rule_params.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { MachineLearningRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { CreateRulePropsRewrites } from './types';
+
+export function getMLRuleParams(
+  rewrites?: CreateRulePropsRewrites<MachineLearningRuleCreateProps>
+): MachineLearningRuleCreateProps {
+  return {
+    type: 'machine_learning',
+    machine_learning_job_id: ['some_job_id'],
+    name: 'ML Rule',
+    description: 'Machine Learning Rule',
+    anomaly_threshold: 44,
+    risk_score: 1,
+    rule_id: 'ml-rule-1',
+    severity: 'high',
+    enabled: false,
+    ...rewrites,
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_saved_query_rule_params.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_saved_query_rule_params.ts
new file mode 100644
index 00000000000000..20720964b5b34f
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_saved_query_rule_params.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedQueryRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { CreateRulePropsRewrites } from './types';
+
+export function getSavedQueryRuleParams(
+  rewrites?: CreateRulePropsRewrites<SavedQueryRuleCreateProps>
+): SavedQueryRuleCreateProps {
+  return {
+    type: 'saved_query',
+    saved_id: 'some-id',
+    query: 'host.name: *',
+    name: 'Saved query rule',
+    description: 'Saved query rule description',
+    index: ['logs-*'],
+    interval: '100m',
+    from: 'now-50000h',
+    severity: 'low',
+    risk_score: 21,
+    ...rewrites,
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_threshold_rule_params.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_threshold_rule_params.ts
new file mode 100644
index 00000000000000..c3b10a587aa7a0
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/get_threshold_rule_params.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ThresholdRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { CreateRulePropsRewrites } from './types';
+
+export function getThresholdRuleParams(
+  rewrites?: CreateRulePropsRewrites<ThresholdRuleCreateProps>
+): ThresholdRuleCreateProps {
+  return {
+    type: 'threshold',
+    query: '*:*',
+    threshold: {
+      field: [],
+      value: 1,
+    },
+    name: 'Threshold Rule',
+    description: 'Threshold Rule description',
+    severity: 'high',
+    risk_score: 17,
+    index: ['logs-*'],
+    interval: '100m',
+    from: 'now-50000h',
+    ...rewrites,
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/index.ts
new file mode 100644
index 00000000000000..8e589798b109f1
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './get_custom_query_rule_params';
+export * from './get_saved_query_rule_params';
+export * from './get_ml_rule_params';
+export * from './get_threshold_rule_params';
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/types.ts
similarity index 72%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/types.ts
index e17fa75f8e7f94..f8acb18aa9930d 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_params/types.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { CsvSearchSourceImmediateExportType } from './csv_searchsource_immediate';
+export type CreateRulePropsRewrites<CreateRuleProps> = Partial<Exclude<CreateRuleProps, 'type'>>;
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule.ts
deleted file mode 100644
index a8fe28d54f24e7..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
-
-/**
- * This is a representative ML rule payload as expected by the server
- * @param ruleId The rule id
- * @param enabled Set to tru to enable it, by default it is off
- */
-export const getSimpleMlRule = (ruleId = 'rule-1', enabled = false): RuleCreateProps => ({
-  name: 'Simple ML Rule',
-  description: 'Simple Machine Learning Rule',
-  enabled,
-  anomaly_threshold: 44,
-  risk_score: 1,
-  rule_id: ruleId,
-  severity: 'high',
-  machine_learning_job_id: ['some_job_id'],
-  type: 'machine_learning',
-});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule_output.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule_output.ts
deleted file mode 100644
index f65c458baa71e8..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule_output.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { MachineLearningRule } from '@kbn/security-solution-plugin/common/api/detection_engine';
-import { getMockSharedResponseSchema } from './get_simple_rule_output';
-import { removeServerGeneratedProperties } from './remove_server_generated_properties';
-
-const getBaseMlRuleOutput = (ruleId = 'rule-1'): MachineLearningRule => {
-  return {
-    ...getMockSharedResponseSchema(ruleId),
-    name: 'Simple ML Rule',
-    description: 'Simple Machine Learning Rule',
-    anomaly_threshold: 44,
-    machine_learning_job_id: ['some_job_id'],
-    type: 'machine_learning',
-  };
-};
-
-export const getSimpleMlRuleOutput = (ruleId = 'rule-1') => {
-  return removeServerGeneratedProperties(getBaseMlRuleOutput(ruleId));
-};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts
index f5e88e34bd62cf..c14a6ad8cd2aa1 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts
@@ -8,7 +8,10 @@
 import type { QueryRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
 
 /**
+ * @deprecated use `getCustomQueryRuleParams()` instead
+ *
  * This is a typical simple rule for testing that is easy for most basic testing
+ *
  * @param ruleId
  * @param enabled Enables the rule on creation or not. Defaulted to true.
  */
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output_without_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output_without_rule_id.ts
deleted file mode 100644
index 56b5ab66773bba..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output_without_rule_id.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { getSimpleRuleOutput } from './get_simple_rule_output';
-import { RuleWithoutServerGeneratedProperties } from './remove_server_generated_properties';
-
-/**
- * This is the typical output of a simple rule that Kibana will output with all the defaults except
- * for all the server generated properties such as created_by. Useful for testing end to end tests.
- */
-export const getSimpleRuleOutputWithoutRuleId = (
-  ruleId = 'rule-1'
-): Omit<RuleWithoutServerGeneratedProperties, 'rule_id'> => {
-  const rule = getSimpleRuleOutput(ruleId);
-  const { rule_id: rId, ...ruleWithoutRuleId } = rule;
-  return ruleWithoutRuleId;
-};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_without_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_without_rule_id.ts
deleted file mode 100644
index ad6ab7803ec213..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_without_rule_id.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
-import { getSimpleRule } from './get_simple_rule';
-
-/**
- * This is a typical simple rule for testing that is easy for most basic testing
- */
-export const getSimpleRuleWithoutRuleId = (): RuleCreateProps => {
-  const simpleRule = getSimpleRule();
-  // eslint-disable-next-line @typescript-eslint/naming-convention
-  const { rule_id, ...ruleWithoutId } = simpleRule;
-  return ruleWithoutId;
-};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts
index c1810ca6d6560e..193d1a4090dc21 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts
@@ -4,21 +4,15 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-export * from './get_rule';
+export * from './fetch_rule';
 export * from './get_simple_rule';
 export * from './create_rule';
 export * from './delete_all_rules';
 export * from './delete_rule';
+export * from './get_rule_params';
 export * from './get_simple_rule_output';
-export * from './get_simple_rule_output_without_rule_id';
-export * from './get_simple_rule_without_rule_id';
-export * from './get_simple_rule_without_rule_id';
 export * from './remove_server_generated_properties';
-export * from './remove_server_generated_properties_including_rule_id';
-export * from './get_simple_ml_rule';
-export * from './get_simple_ml_rule_output';
 export * from './wait_for_rule_status';
-export * from './get_rule_for_alert_testing_with_timestamp_override';
 export * from './get_rule_for_alert_testing';
 export * from './get_threshold_rule_for_alert_testing';
 export * from './get_rule_actions';
@@ -37,5 +31,8 @@ export * from './get_saved_query_rule_for_alert_testing';
 export * from './get_rule_so_by_id';
 export * from './create_rule_saved_object';
 export * from './get_rule_with_legacy_investigation_fields';
-
+export * from './preview_rule';
+export * from './preview_rule_with_exception_entries';
+export * from './patch_rule';
+export * from './generate_event';
 export * from './prebuilt_rules';
diff --git a/x-pack/test/detection_engine_api_integration/utils/patch_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/patch_rule.ts
similarity index 100%
rename from x-pack/test/detection_engine_api_integration/utils/patch_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/patch_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule.ts
new file mode 100644
index 00000000000000..ec060c40764048
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type SuperTest from 'supertest';
+import type {
+  RuleCreateProps,
+  PreviewRulesSchema,
+  RulePreviewLogs,
+} from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import { DETECTION_ENGINE_RULES_PREVIEW } from '@kbn/security-solution-plugin/common/constants';
+
+/**
+ * Runs the preview for a rule. Any generated alerts will be written to .preview.alerts.
+ * This is much faster than actually running the rule, and can also quickly simulate multiple
+ * consecutive rule runs, e.g. for ensuring that rule state is properly handled across runs.
+ * @param supertest The supertest deps
+ * @param rule The rule to create
+ */
+export const previewRule = async ({
+  supertest,
+  rule,
+  invocationCount = 1,
+  timeframeEnd = new Date(),
+}: {
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+  rule: RuleCreateProps;
+  invocationCount?: number;
+  timeframeEnd?: Date;
+}): Promise<{
+  previewId: string;
+  logs: RulePreviewLogs[];
+  isAborted: boolean;
+}> => {
+  const previewRequest: PreviewRulesSchema = {
+    ...rule,
+    invocationCount,
+    timeframeEnd: timeframeEnd.toISOString(),
+  };
+  const response = await supertest
+    .post(DETECTION_ENGINE_RULES_PREVIEW)
+    .set('kbn-xsrf', 'true')
+    .set('elastic-api-version', '2023-10-31')
+    .send(previewRequest)
+    .expect(200);
+  return response.body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule_with_exception_entries.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule_with_exception_entries.ts
new file mode 100644
index 00000000000000..fb5d480bbbffca
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/preview_rule_with_exception_entries.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type { NonEmptyEntriesArray, OsTypeArray } from '@kbn/securitysolution-io-ts-list-types';
+import type { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import {
+  createContainerWithEntries,
+  createContainerWithEndpointEntries,
+} from '../exception_list_and_item';
+import { previewRule } from './preview_rule';
+
+/**
+ * Convenience testing function where you can pass in just the entries and you will
+ * get a rule created with the entries added to an exception list and exception list item
+ * all auto-created at once.
+ * @param supertest super test agent
+ * @param rule The rule to create and attach an exception list to
+ * @param entries The entries to create the rule and exception list from
+ * @param endpointEntries The endpoint entries to create the rule and exception list from
+ * @param osTypes The os types to optionally add or not to add to the container
+ */
+export const previewRuleWithExceptionEntries = async ({
+  supertest,
+  log,
+  rule,
+  entries,
+  endpointEntries,
+  invocationCount,
+  timeframeEnd,
+}: {
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+  log: ToolingLog;
+  rule: RuleCreateProps;
+  entries: NonEmptyEntriesArray[];
+  endpointEntries?: Array<{
+    entries: NonEmptyEntriesArray;
+    osTypes: OsTypeArray | undefined;
+  }>;
+  invocationCount?: number;
+  timeframeEnd?: Date;
+}) => {
+  const maybeExceptionList = await createContainerWithEntries(supertest, log, entries);
+  const maybeEndpointList = await createContainerWithEndpointEntries(
+    supertest,
+    log,
+    endpointEntries ?? []
+  );
+
+  return previewRule({
+    supertest,
+    rule: {
+      ...rule,
+      exceptions_list: [...maybeExceptionList, ...maybeEndpointList],
+    },
+    invocationCount,
+    timeframeEnd,
+  });
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties_including_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties_including_rule_id.ts
deleted file mode 100644
index 1b57b5663ec235..00000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties_including_rule_id.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import type { RuleResponse } from '@kbn/security-solution-plugin/common/api/detection_engine';
-
-import { removeServerGeneratedProperties } from './remove_server_generated_properties';
-
-/**
- * This will remove server generated properties such as date times, etc... including the rule_id
- * @param rule Rule to pass in to remove typical server generated properties
- */
-export const removeServerGeneratedPropertiesIncludingRuleId = (
-  rule: RuleResponse
-): Partial<RuleResponse> => {
-  const ruleWithRemovedProperties = removeServerGeneratedProperties(rule);
-  // eslint-disable-next-line @typescript-eslint/naming-convention
-  const { rule_id, ...additionalRuledIdRemoved } = ruleWithRemovedProperties;
-  return additionalRuledIdRemoved;
-};
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/types.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/types.ts
similarity index 56%
rename from x-pack/plugins/reporting/server/export_types/png_v2/types.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/types.ts
index ae5c80e32894a3..3052ee26e259b5 100644
--- a/x-pack/plugins/reporting/server/export_types/png_v2/types.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/types.ts
@@ -5,4 +5,15 @@
  * 2.0.
  */
 
-export type { JobParamsPNGV2, TaskPayloadPNGV2 } from '../../../common/types/export_types/png_v2';
+export interface SecurityEvent {
+  [field: string]: unknown;
+  '@timestamp': number;
+  ecs: {
+    version: string;
+  };
+  event: {
+    kind: 'event';
+    category: string;
+    type: string;
+  };
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/update_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/update_rule.ts
index 53c1beb2727643..5c6c69a2304654 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/update_rule.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/update_rule.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import type { ToolingLog } from '@kbn/tooling-log';
 import type SuperTest from 'supertest';
 
 import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
@@ -17,25 +16,19 @@ import {
 /**
  * Helper to cut down on the noise in some of the tests. This checks for
  * an expected 200 still and does not do any retries.
+ *
  * @param supertest The supertest deps
  * @param rule The rule to create
  */
 export const updateRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
-  log: ToolingLog,
   updatedRule: RuleUpdateProps
-): Promise<RuleResponse> => {
-  const response = await supertest
-    .put(DETECTION_ENGINE_RULES_URL)
-    .set('kbn-xsrf', 'true')
-    .set('elastic-api-version', '2023-10-31')
-    .send(updatedRule);
-  if (response.status !== 200) {
-    log.error(
-      `Did not get an expected 200 "ok" when updating a rule (updateRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
-        response.body
-      )}, status: ${JSON.stringify(response.status)}`
-    );
-  }
-  return response.body;
-};
+): Promise<RuleResponse> =>
+  (
+    await supertest
+      .put(DETECTION_ENGINE_RULES_URL)
+      .set('kbn-xsrf', 'true')
+      .set('elastic-api-version', '2023-10-31')
+      .send(updatedRule)
+      .expect(200)
+  ).body;
diff --git a/x-pack/test/security_solution_api_integration/tsconfig.json b/x-pack/test/security_solution_api_integration/tsconfig.json
index 4dfd3ef6ba30d9..782bc4fd46b325 100644
--- a/x-pack/test/security_solution_api_integration/tsconfig.json
+++ b/x-pack/test/security_solution_api_integration/tsconfig.json
@@ -30,6 +30,8 @@
     "@kbn/core-saved-objects-server",
     "@kbn/core",
     "@kbn/alerting-plugin",
+    "@kbn/securitysolution-ecs",
+    "@kbn/securitysolution-rules",
     "@kbn/core-http-common",
     "@kbn/securitysolution-ecs",
     "@kbn/fleet-plugin",
diff --git a/x-pack/test/security_solution_cypress/cypress/README.md b/x-pack/test/security_solution_cypress/cypress/README.md
index c85ba1bea305f5..8940d6c86e73e3 100644
--- a/x-pack/test/security_solution_cypress/cypress/README.md
+++ b/x-pack/test/security_solution_cypress/cypress/README.md
@@ -42,11 +42,10 @@ Please, before opening a PR with the new test, please make sure that the test fa
 
 Note that we use tags in order to select which tests we want to execute:
 
-- `@serverless` includes a test in the Serverless test suite for PRs (the so-called first quality gate). You need to explicitly add this tag to any test you want to run in CI for open PRs. These tests will run against a local, "simulated" serverless environment.
-- `@serverlessQA` includes a test in the Serverless test suite for QA (the so-called second quality gate). You need to explicitly add this tag to any test you want to run in the CD pipeline against real serverless projects deployed in the Serverless QA environment.
-  - **NOTE:** We are adding this tag temporarily until we check the behavior of our tests in the second quality gate.
+- `@serverless` includes a test in the Serverless test suite for PRs (the so-called first quality gate) and QA environemnt (the so-called second quality gate). You need to explicitly add this tag to any test you want to run in CI for serverless. 
 - `@ess` includes a test in the normal, non-Serverless test suite. You need to explicitly add this tag to any test you want to run against a non-Serverless environment.
 - `@brokenInServerless` excludes a test from the Serverless test suite (even if it's tagged as `@serverless`). Indicates that a test should run in Serverless, but currently is broken.
+- `@brokenInServerlessQA` excludes a test form the Serverless QA enviornment (second quality gate). Indicates that a test should run on it, but currently is broken.
 - `@skipInServerless` excludes a test from the Serverless test suite (even if it's tagged as `@serverless`). Could indicate many things, e.g. "the test is flaky in Serverless", "the test is Flaky in any type of environemnt", "the test has been temporarily excluded, see the comment above why".
 
 Please, before opening a PR with a new test, make sure that the test fails. If you never see your test fail you don’t know if your test is actually testing the right thing, or testing anything at all.
@@ -72,6 +71,10 @@ Run the tests with the following yarn scripts from `x-pack/test/security_solutio
 | cypress:explore:run:ess | Runs all tests tagged as ESS in the `e2e/explore` directory in headless mode |
 | cypress:investigations:run:serverless | Runs all tests tagged as SERVERLESS in the `e2e/investigations` directory in headless mode |
 | cypress:explore:run:serverless | Runs all tests tagged as SERVERLESS in the `e2e/explore` directory in headless mode |
+| cypress:open:qa:serverless | Opens the Cypress UI with all tests in the `e2e` directory tagged as SERVERLESS. This also creates an MKI project in console.qa enviornment. The kibana instance will reload when you make code changes. This is the recommended way to debug tests in QA. Follow the readme in order to learn about the known limitations. |
+| cypress:run:qa:serverless | Runs all tests tagged as SERVERLESS placed in the `e2e` directory excluding `investigations` and `explore` directories in headless mode using the QA environment and real MKI projects.|
+| cypress:run:qa:serverless:explore | Runs all tests tagged as SERVERLESS in the `e2e/explore` directory in headless mode using the QA environment and real MKI prorjects. |
+| cypress:run:qa:serverless:investigations | Runs all tests tagged as SERVERLESS in the `e2e/investigations` directory in headless mode using the QA environment and reak MKI projects. |
 | junit:merge | Merges individual test reports into a single report and moves the report to the `junit` directory |
 
 Please note that all the headless mode commands do not open the Cypress UI and are typically used in CI/CD environments. The scripts that open the Cypress UI are useful for development and debugging.
@@ -190,7 +193,7 @@ Task [cypress/support/es_archiver.ts](https://github.com/elastic/kibana/blob/mai
 Note that we use tags in order to select which tests we want to execute, if you want a test to be executed on serverless you need to add @serverless tag to it.
 
 
-### Running the serverless tests locally
+### Running serverless tests locally pointing to FTR serverless (First Quality Gate) 
 
 Run the tests with the following yarn scripts from `x-pack/test/security_solution_cypress`:
 
@@ -203,7 +206,7 @@ Run the tests with the following yarn scripts from `x-pack/test/security_solutio
 
 Please note that all the headless mode commands do not open the Cypress UI and are typically used in CI/CD environments. The scripts that open the Cypress UI are useful for development and debugging.
 
-### PLIs
+#### PLIs
 When running serverless Cypress tests, the following PLIs are set by default:
 
 ```
@@ -234,6 +237,97 @@ Per the way we set the environment during the execution process on CI, the above
 
 For test developing or test debugging purposes, you need to modify the configuration but without committing and pushing the changes in `x-pack/test/security_solution_cypress/serverless_config.ts`.
 
+
+### Running serverless tests locally pointing to a MKI project created in QA environment (Second Quality Gate)
+
+Run the tests with the following yarn scripts from `x-pack/test/security_solution_cypress`:
+
+| Script Name | Description |
+| ----------- | ----------- |
+| cypress:open:qa:serverless | Opens the Cypress UI with all tests in the `e2e` directory tagged as SERVERLESS. This also creates an MKI project in console.qa enviornment. The kibana instance will reload when you make code changes. This is the recommended way to debug tests in QA. Follow the readme in order to learn about the known limitations. |
+| cypress:run:qa:serverless | Runs all tests tagged as SERVERLESS placed in the `e2e` directory excluding `investigations` and `explore` directories in headless mode using the QA environment and real MKI projects.|
+| cypress:run:qa:serverless:explore | Runs all tests tagged as SERVERLESS in the `e2e/explore` directory in headless mode using the QA environment and real MKI prorjects. |
+| cypress:run:qa:serverless:investigations | Runs all tests tagged as SERVERLESS in the `e2e/investigations` directory in headless mode using the QA environment and reak MKI projects. |
+
+Please note that all the headless mode commands do not open the Cypress UI and are typically used in CI/CD environments. The scripts that open the Cypress UI are useful for development and debugging.
+
+
+#### Setup required
+
+Setup a valid Elastic Cloud API key for QA environment:
+
+1. Navigate to QA environment.
+2. Click on the `User menu button` located on the top right of the header.
+3. Click on `Organization`.
+4. Click on the `API keys` tab.
+5. Click on `Create API key` button.
+6. Add a name, set an expiration date, assign an organization owner role.
+7. Click on `Create API key`
+8. Save the value of the key
+
+Store the saved key on `~/.elastic/cloud.json` using the following format:
+
+```json
+{
+  "api_key": {
+    "qa": "<API_KEY>"
+  }
+}
+```
+
+#### Known limitations 
+- Currently RBAC cannot be tested.
+
+#### PLIs
+
+When running serverless Cypress tests on QA environment, the following PLIs are set by default:
+```
+      { product_line: 'security', product_tier: 'complete' },
+      { product_line: 'endpoint', product_tier: 'complete' },
+      { product_line: 'cloud', product_tier: 'complete' },
+```
+
+With the above configuration we'll be able to cover most of the scenarios, but there are some cases were we might want to use a different configuration. In that case, we just need to pass to the header of the test, which is the configuration we want for it.
+
+```typescript
+describe(
+  'Entity Analytics Dashboard in Serverless',
+  {
+    tags: '@serverless',
+    env: {
+      ftrConfig: {
+        productTypes: [
+          { product_line: 'security', product_tier: 'essentials' },
+          { product_line: 'endpoint', product_tier: 'essentials' },
+        ],
+      },
+    },
+  },
+```
+
+For test developing or test debugging purposes on QA, you have avaialable the following options:
+
+```
+yarn cypress:open:qa:serverless --tier <essentials|complete>
+```
+
+The above command will open the Cypress UI with all tests in the `e2e` directory tagged as SERVERLESS. This also creates an MKI project in console.qa enviornment with the passed tier essentials or complete. If no flag is passed, the project will be cretaed as complete.
+
+```
+yarn cypress:open:qa:serverless --no-endpoint-addon
+```
+
+The above command will open the Cypress UI with all tests in the `e2e` directory tagged as SERVERLESS. This also creates an MKI project in console.qa enviornment without the endpoint add-on.
+
+```
+yarn cypress:open:qa:serverless --no-cloud-addon
+```
+
+The above command will open the Cypress UI with all tests in the `e2e` directory tagged as SERVERLESS. This also creates an MKI project in console.qa enviornment without the cloud add-on.
+
+Note that all the above flags can be combined.
+
+
 ## Development Best Practices
 
 Below you will a set of best practices that should be followed when writing Cypress tests.
diff --git a/x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts b/x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts
index 4688cbe343e1c3..342c3da34bef6e 100644
--- a/x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts
+++ b/x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts
@@ -41,6 +41,7 @@ export default defineCypressConfig({
     specPattern: './cypress/e2e/**/*.cy.ts',
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);
       return config;
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/entry/use_value_list.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/entry/use_value_list.cy.ts
index 530114585fa1cc..39c19bdf39f3ee 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/entry/use_value_list.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/entry/use_value_list.cy.ts
@@ -47,7 +47,8 @@ const goToRulesAndOpenValueListModal = () => {
   openValueListsModal();
 };
 
-describe('Use Value list in exception entry', { tags: ['@ess', '@serverless'] }, () => {
+// FLAKY: https://github.com/elastic/kibana/issues/171252
+describe.skip('Use Value list in exception entry', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
     cy.task('esArchiverLoad', { archiveName: 'exceptions' });
   });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/shared_exception_lists_management/manage_exceptions.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/shared_exception_lists_management/manage_exceptions.cy.ts
index 023140d420f2a7..9f64fac5f1512d 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/shared_exception_lists_management/manage_exceptions.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/exceptions/shared_exception_lists_management/manage_exceptions.cy.ts
@@ -42,7 +42,9 @@ import {
 import { visitRuleDetailsPage } from '../../../tasks/rule_details';
 import { deleteEndpointExceptionList, deleteExceptionLists } from '../../../tasks/common';
 
-describe('Add, edit and delete exception', { tags: ['@ess', '@serverless'] }, () => {
+// https://github.com/elastic/kibana/issues/171235
+// FLAKY: https://github.com/elastic/kibana/issues/171242
+describe.skip('Add, edit and delete exception', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
     deleteExceptionLists();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/overview/overview.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/overview/overview.cy.ts
index 1205d2420b7ab8..f8578054628772 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/overview/overview.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/overview/overview.cy.ts
@@ -16,7 +16,7 @@ import { OVERVIEW_URL } from '../../../urls/navigation';
 import { createTimeline, favoriteTimeline } from '../../../tasks/api_calls/timelines';
 import { getTimeline } from '../../../objects/timeline';
 
-describe('Overview Page', { tags: ['@ess', '@serverless', '@serverlessQA'] }, () => {
+describe('Overview Page', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
     cy.task('esArchiverLoad', { archiveName: 'overview' });
   });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
index ed4476bcfe4509..d89cc4ad4eb50b 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
@@ -57,158 +57,166 @@ import { getNewRule } from '../../../../objects/rule';
 import { ALERTS_URL } from '../../../../urls/navigation';
 import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
 
-describe('Alert details expandable flyout right panel', { tags: ['@ess', '@serverless'] }, () => {
-  const rule = getNewRule();
-
-  beforeEach(() => {
-    deleteAlertsAndRules();
-    login();
-    createRule(rule);
-    visit(ALERTS_URL);
-    waitForAlertsToPopulate();
-  });
-
-  it('should display header and footer basics', () => {
-    expandFirstAlertExpandableFlyout();
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_TITLE).should('have.text', rule.name);
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_STATUS).should('have.text', 'open');
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE).should('have.text', 'Risk score:');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE_VALUE)
-      .should('be.visible')
-      .and('have.text', rule.risk_score);
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_SEVERITY_VALUE)
-      .should('be.visible')
-      .and('have.text', upperFirst(rule.severity));
-
-    cy.log('Verify all 3 tabs are visible');
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB)
-      .should('have.text', 'Overview')
-      .and('have.class', 'euiTab-isSelected');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB)
-      .should('have.text', 'Table')
-      .and('not.have.class', 'euiTab-isSelected');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB)
-      .should('have.text', 'JSON')
-      .and('not.have.class', 'euiTab-isSelected');
-
-    cy.log('Verify the expand/collapse button is visible and functionality works');
-
-    expandDocumentDetailsExpandableFlyoutLeftSection();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_COLLAPSE_DETAILS_BUTTON).should('have.text', 'Collapse details');
-
-    collapseDocumentDetailsExpandableFlyoutLeftSection();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_EXPAND_DETAILS_BUTTON).should('have.text', 'Expand details');
-
-    cy.log('Verify the take action button is visible on all tabs');
-
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
-
-    openTableTab();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB).should('have.class', 'euiTab-isSelected');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
-
-    openJsonTab();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB).should('have.class', 'euiTab-isSelected');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
-  });
-
-  // TODO this will change when add to existing case is improved
-  //  https://github.com/elastic/security-team/issues/6298
-  it('should add to existing case', () => {
-    expandFirstAlertExpandableFlyout();
-    openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE);
-    fillOutFormToCreateNewCase();
-    openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_EXISTING_CASE);
-
-    cy.get(EXISTING_CASE_SELECT_BUTTON).should('be.visible').contains('Select').click();
-
-    cy.get(VIEW_CASE_TOASTER_LINK).should('be.visible').and('contain.text', 'View case');
-  });
-
-  // TODO this will change when add to new case is improved
-  //  https://github.com/elastic/security-team/issues/6298
-  it('should add to new case', () => {
-    expandFirstAlertExpandableFlyout();
-    openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE);
-    fillOutFormToCreateNewCase();
-
-    cy.get(VIEW_CASE_TOASTER_LINK).should('be.visible').and('contain.text', 'View case');
-  });
-
-  it('should mark as acknowledged', () => {
-    cy.get(ALERT_CHECKBOX).should('have.length', 1);
-
-    expandFirstAlertExpandableFlyout();
-    openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_MARK_AS_ACKNOWLEDGED);
-
-    // TODO figure out how to verify the toasts pops up
-    // cy.get(KIBANA_TOAST)
-    //   .should('be.visible')
-    //   .and('have.text', 'Successfully marked 1 alert as acknowledged.');
-    cy.get(EMPTY_ALERT_TABLE).should('exist');
-  });
-
-  it('should mark as closed', () => {
-    cy.get(ALERT_CHECKBOX).should('have.length', 1);
-
-    expandFirstAlertExpandableFlyout();
-    openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_MARK_AS_CLOSED);
-
-    // TODO figure out how to verify the toasts pops up
-    // cy.get(KIBANA_TOAST).should('be.visible').and('have.text', 'Successfully closed 1 alert.');
-    cy.get(EMPTY_ALERT_TABLE).should('exist');
-  });
-
-  // these actions are now grouped together as we're not really testing their functionality but just the existence of the option in the dropdown
-  it('should test other action within take action dropdown', () => {
-    expandFirstAlertExpandableFlyout();
-
-    cy.log('should add endpoint exception');
-
-    // TODO figure out why this option is disabled in Cypress but not running the app locally
-    //  https://github.com/elastic/security-team/issues/6300
-    openTakeActionButton();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_ENDPOINT_EXCEPTION).should('be.disabled');
-
-    cy.log('should add rule exception');
+// FLAKY: https://github.com/elastic/kibana/issues/171002
+describe.skip(
+  'Alert details expandable flyout right panel',
+  { tags: ['@ess', '@serverless'] },
+  () => {
+    const rule = getNewRule();
+
+    beforeEach(() => {
+      deleteAlertsAndRules();
+      login();
+      createRule(rule);
+      visit(ALERTS_URL);
+      waitForAlertsToPopulate();
+    });
+
+    it('should display header and footer basics', () => {
+      expandFirstAlertExpandableFlyout();
+
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_TITLE).should('have.text', rule.name);
+
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_STATUS).should('have.text', 'open');
+
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE).should('have.text', 'Risk score:');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE_VALUE)
+        .should('be.visible')
+        .and('have.text', rule.risk_score);
+
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_SEVERITY_VALUE)
+        .should('be.visible')
+        .and('have.text', upperFirst(rule.severity));
+
+      cy.log('Verify all 3 tabs are visible');
+
+      cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB)
+        .should('have.text', 'Overview')
+        .and('have.class', 'euiTab-isSelected');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB)
+        .should('have.text', 'Table')
+        .and('not.have.class', 'euiTab-isSelected');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB)
+        .should('have.text', 'JSON')
+        .and('not.have.class', 'euiTab-isSelected');
+
+      cy.log('Verify the expand/collapse button is visible and functionality works');
+
+      expandDocumentDetailsExpandableFlyoutLeftSection();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_COLLAPSE_DETAILS_BUTTON).should(
+        'have.text',
+        'Collapse details'
+      );
 
-    // TODO this isn't fully testing the add rule exception yet
-    //  https://github.com/elastic/security-team/issues/6301
-    selectTakeActionItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION);
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION_FLYOUT_HEADER).should('exist');
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION_FLYOUT_CANCEL_BUTTON)
-      .should('be.visible')
-      .click();
-
-    // cy.log('should isolate host');
-
-    // TODO figure out why isolate host isn't showing up in the dropdown
-    //  https://github.com/elastic/security-team/issues/6302
-    // openTakeActionButton();
-    // cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ISOLATE_HOST).should('be.visible');
+      collapseDocumentDetailsExpandableFlyoutLeftSection();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_EXPAND_DETAILS_BUTTON).should('have.text', 'Expand details');
 
-    cy.log('should respond');
+      cy.log('Verify the take action button is visible on all tabs');
 
-    // TODO this will change when respond is improved
-    //  https://github.com/elastic/security-team/issues/6303
-    openTakeActionButton();
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_RESPOND).should('be.disabled');
-
-    cy.log('should investigate in timeline');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
 
-    selectTakeActionItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE);
-    cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE_SECTION)
-      .first()
-      .within(() =>
-        cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE_ENTRY).should('exist')
-      );
-  });
-});
+      openTableTab();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB).should('have.class', 'euiTab-isSelected');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
+
+      openJsonTab();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB).should('have.class', 'euiTab-isSelected');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
+    });
+
+    // TODO this will change when add to existing case is improved
+    //  https://github.com/elastic/security-team/issues/6298
+    it('should add to existing case', () => {
+      expandFirstAlertExpandableFlyout();
+      openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE);
+      fillOutFormToCreateNewCase();
+      openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_EXISTING_CASE);
+
+      cy.get(EXISTING_CASE_SELECT_BUTTON).should('be.visible').contains('Select').click();
+
+      cy.get(VIEW_CASE_TOASTER_LINK).should('be.visible').and('contain.text', 'View case');
+    });
+
+    // TODO this will change when add to new case is improved
+    //  https://github.com/elastic/security-team/issues/6298
+    it('should add to new case', () => {
+      expandFirstAlertExpandableFlyout();
+      openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE);
+      fillOutFormToCreateNewCase();
+
+      cy.get(VIEW_CASE_TOASTER_LINK).should('be.visible').and('contain.text', 'View case');
+    });
+
+    it('should mark as acknowledged', () => {
+      cy.get(ALERT_CHECKBOX).should('have.length', 1);
+
+      expandFirstAlertExpandableFlyout();
+      openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_MARK_AS_ACKNOWLEDGED);
+
+      // TODO figure out how to verify the toasts pops up
+      // cy.get(KIBANA_TOAST)
+      //   .should('be.visible')
+      //   .and('have.text', 'Successfully marked 1 alert as acknowledged.');
+      cy.get(EMPTY_ALERT_TABLE).should('exist');
+    });
+
+    it('should mark as closed', () => {
+      cy.get(ALERT_CHECKBOX).should('have.length', 1);
+
+      expandFirstAlertExpandableFlyout();
+      openTakeActionButtonAndSelectItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_MARK_AS_CLOSED);
+
+      // TODO figure out how to verify the toasts pops up
+      // cy.get(KIBANA_TOAST).should('be.visible').and('have.text', 'Successfully closed 1 alert.');
+      cy.get(EMPTY_ALERT_TABLE).should('exist');
+    });
+
+    // these actions are now grouped together as we're not really testing their functionality but just the existence of the option in the dropdown
+    it('should test other action within take action dropdown', () => {
+      expandFirstAlertExpandableFlyout();
+
+      cy.log('should add endpoint exception');
+
+      // TODO figure out why this option is disabled in Cypress but not running the app locally
+      //  https://github.com/elastic/security-team/issues/6300
+      openTakeActionButton();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_ENDPOINT_EXCEPTION).should('be.disabled');
+
+      cy.log('should add rule exception');
+
+      // TODO this isn't fully testing the add rule exception yet
+      //  https://github.com/elastic/security-team/issues/6301
+      selectTakeActionItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION);
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION_FLYOUT_HEADER).should('exist');
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_RULE_EXCEPTION_FLYOUT_CANCEL_BUTTON)
+        .should('be.visible')
+        .click();
+
+      // cy.log('should isolate host');
+
+      // TODO figure out why isolate host isn't showing up in the dropdown
+      //  https://github.com/elastic/security-team/issues/6302
+      // openTakeActionButton();
+      // cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_ISOLATE_HOST).should('be.visible');
+
+      cy.log('should respond');
+
+      // TODO this will change when respond is improved
+      //  https://github.com/elastic/security-team/issues/6303
+      openTakeActionButton();
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_RESPOND).should('be.disabled');
+
+      cy.log('should investigate in timeline');
+
+      selectTakeActionItem(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE);
+      cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE_SECTION)
+        .first()
+        .within(() =>
+          cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_INVESTIGATE_IN_TIMELINE_ENTRY).should('exist')
+        );
+    });
+  }
+);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
index bea868ac488289..33bcb93caacf0c 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
@@ -7,13 +7,11 @@
 
 import { deleteAlertsAndRules } from '../../../../tasks/common';
 import { collapseDocumentDetailsExpandableFlyoutLeftSection } from '../../../../tasks/expandable_flyout/alert_details_right_panel';
-import { DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB_CONTENT } from '../../../../screens/expandable_flyout/alert_details_left_panel_investigation_tab';
 import {
   createNewCaseFromExpandableFlyout,
   expandFirstAlertExpandableFlyout,
 } from '../../../../tasks/expandable_flyout/common';
 import {
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ANALYZER_PREVIEW_CONTAINER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_DETAILS,
@@ -21,21 +19,16 @@ import {
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_OPEN_RULE_PREVIEW_BUTTON,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_DETAILS,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_HEADER_TITLE,
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_ANCESTRY,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SESSION,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_CASES,
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER,
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_VALUES,
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_GUIDE_BUTTON,
-  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_CONTENT,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_DETAILS,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_TITLE,
@@ -45,6 +38,7 @@ import {
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SAME_SOURCE_EVENT,
 } from '../../../../screens/expandable_flyout/alert_details_right_panel_overview_tab';
 import {
   navigateToCorrelationsDetails,
@@ -55,6 +49,9 @@ import {
   toggleOverviewTabInvestigationSection,
   toggleOverviewTabResponseSection,
   toggleOverviewTabVisualizationsSection,
+  navigateToEntitiesDetails,
+  navigateToThreatIntelligenceDetails,
+  navigateToResponseDetails,
 } from '../../../../tasks/expandable_flyout/alert_details_right_panel_overview_tab';
 import { login } from '../../../../tasks/login';
 import { visit } from '../../../../tasks/navigation';
@@ -63,10 +60,18 @@ import { getNewRule } from '../../../../objects/rule';
 import { ALERTS_URL } from '../../../../urls/navigation';
 import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
 import {
-  DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_CONTENT,
+  DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_BUTTON,
   DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS,
   DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS,
 } from '../../../../screens/expandable_flyout/alert_details_left_panel_entities_tab';
+import {
+  DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB,
+  DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB,
+  DOCUMENT_DETAILS_FLYOUT_RESPONSE_TAB,
+} from '../../../../screens/expandable_flyout/alert_details_left_panel';
+import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_CORRELATIONS_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_correlations_tab';
+import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_THREAT_INTELLIGENCE_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_threat_intelligence_tab';
+import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_prevalence_tab';
 
 describe(
   'Alert details expandable flyout right panel overview tab',
@@ -87,70 +92,73 @@ describe(
       it('should display about section', () => {
         cy.log('header and content');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_HEADER)
-          .should('be.visible')
-          .and('have.text', 'About');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_CONTENT).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_HEADER).should(
+          'have.text',
+          'About'
+        );
 
         cy.log('description');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_TITLE)
-          .should('be.visible')
-          .and('contain.text', 'Rule description');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_TITLE)
-          .should('be.visible')
-          .within(() => {
-            cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_OPEN_RULE_PREVIEW_BUTTON)
-              .should('be.visible')
-              .and('have.text', 'Show rule summary');
-          });
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_DETAILS)
-          .should('be.visible')
-          .and('have.text', rule.description);
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_TITLE).and(
+          'contain.text',
+          'Rule description'
+        );
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_TITLE).within(() => {
+          cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_OPEN_RULE_PREVIEW_BUTTON).should(
+            'have.text',
+            'Show rule summary'
+          );
+        });
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_DETAILS).should(
+          'have.text',
+          rule.description
+        );
 
         cy.log('reason');
 
         cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_REASON_TITLE)
-          .should('be.visible')
-          .and('contain.text', 'Alert reason')
+          .should('contain.text', 'Alert reason')
           .and('contain.text', 'Show full reason');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_REASON_DETAILS)
-          .should('be.visible')
-          .and('contain.text', rule.name);
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_REASON_DETAILS).should(
+          'contain.text',
+          rule.name
+        );
 
         cy.log('mitre attack');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_TITLE)
-          .should('be.visible')
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_TITLE).should(
+          'contain.text',
           // @ts-ignore
-          .and('contain.text', rule.threat[0].framework);
+          rule.threat[0].framework
+        );
 
         cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_DETAILS)
-          .should('be.visible')
           // @ts-ignore
-          .and('contain.text', rule.threat[0].technique[0].name)
+          .should('contain.text', rule.threat[0].technique[0].name)
           // @ts-ignore
           .and('contain.text', rule.threat[0].tactic.name);
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/168222
-    describe.skip('visualizations section', () => {
+    describe('visualizations section', () => {
       it('should display analyzer and session previews', () => {
         toggleOverviewTabAboutSection();
+        toggleOverviewTabInvestigationSection();
         toggleOverviewTabVisualizationsSection();
 
-        cy.log('analyzer graph preview');
+        cy.log('session view preview');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ANALYZER_PREVIEW_CONTAINER).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ANALYZER_PREVIEW_CONTAINER).should(
-          'be.visible'
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_SESSION_PREVIEW_CONTAINER).should(
+          'contain.text',
+          'You can only view Linux session details if you’ve enabled the Include session data setting in your Elastic Defend integration policy. Refer to Enable Session View data(opens in a new tab or window) for more information.'
         );
 
-        cy.log('session view preview');
+        cy.log('analyzer graph preview');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_SESSION_PREVIEW_CONTAINER).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_SESSION_PREVIEW_CONTAINER).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ANALYZER_PREVIEW_CONTAINER).should(
+          'contain.text',
+          'zsh'
+        );
       });
     });
 
@@ -160,68 +168,69 @@ describe(
 
         cy.log('header and content');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_HEADER)
-          .should('be.visible')
-          .and('have.text', 'Investigation');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_CONTENT).should(
-          'be.visible'
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_HEADER).should(
+          'have.text',
+          'Investigation'
         );
 
         cy.log('investigation guide button');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_GUIDE_BUTTON)
-          .should('be.visible')
-          .and('have.text', 'Show investigation guide');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_GUIDE_BUTTON).should(
+          'have.text',
+          'Show investigation guide'
+        );
 
         cy.log('should navigate to left Investigation tab');
 
         clickInvestigationGuideButton();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB_CONTENT).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB_CONTENT).should('be.visible');
+
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB)
+          .should('have.text', 'Investigation')
+          .and('have.class', 'euiTab-isSelected');
 
         cy.log('highlighted fields section');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_HEADER_TITLE)
-          .should('be.visible')
-          .and('have.text', 'Highlighted fields');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_DETAILS).should(
-          'be.visible'
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_HEADER_TITLE).should(
+          'have.text',
+          'Highlighted fields'
         );
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_DETAILS).should('exist');
 
         cy.log('custom highlighted fields');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL)
-          .should('be.visible')
-          .and('contain.text', 'host.os.name');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL).should(
+          'contain.text',
+          'host.os.name'
+        );
         const customHighlightedField =
           DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('Mac OS X');
-        cy.get(customHighlightedField).should('be.visible').and('have.text', 'Mac OS X');
+        cy.get(customHighlightedField).and('have.text', 'Mac OS X');
 
         cy.log('system defined highlighted fields');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL)
-          .should('be.visible')
-          .and('contain.text', 'host.name');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL).should(
+          'contain.text',
+          'host.name'
+        );
         const hostNameCell =
           DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('siem-kibana');
-        cy.get(hostNameCell).should('be.visible').and('have.text', 'siem-kibana');
+        cy.get(hostNameCell).and('have.text', 'siem-kibana');
 
         cy.get(hostNameCell).click();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS).should('exist');
 
         collapseDocumentDetailsExpandableFlyoutLeftSection();
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL)
-          .should('be.visible')
-          .and('contain.text', 'user.name');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL).should(
+          'contain.text',
+          'user.name'
+        );
         const userNameCell =
           DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('test');
-        cy.get(userNameCell).should('be.visible').and('have.text', 'test');
+        cy.get(userNameCell).should('have.text', 'test');
 
         cy.get(userNameCell).click();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS).should('exist');
       });
     });
 
@@ -233,18 +242,20 @@ describe(
 
         cy.log('header and content');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER)
-          .should('be.visible')
-          .and('have.text', 'Entities');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_CONTENT).should('be.visible');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER).should(
+          'have.text',
+          'Entities'
+        );
 
         cy.log('should navigate to left panel Entities tab');
 
-        // TODO: skipping this section as Cypress can't seem to find the element (though it's in the DOM)
-        // navigateToEntitiesDetails();
-        // cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_CONTENT).should('be.visible');
+        navigateToEntitiesDetails();
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB)
+          .should('have.text', 'Insights')
+          .and('have.class', 'euiTab-isSelected');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_BUTTON)
+          .should('have.text', 'Entities')
+          .and('have.class', 'euiButtonGroupButton-isSelected');
       });
 
       it('should display threat intelligence section', () => {
@@ -254,40 +265,32 @@ describe(
 
         cy.log('header and content');
 
-        cy.get(
-          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER
-        ).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER)
-          .should('be.visible')
-          .and('have.text', 'Threat intelligence');
-        cy.get(
-          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_CONTENT
-        ).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_CONTENT)
-          .should('be.visible')
-          .within(() => {
-            // threat match detected
-            cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES)
-              .eq(0)
-              .should('be.visible')
-              .and('have.text', '0 threat matches detected'); // TODO work on getting proper IoC data to get proper data here
-
-            // field with threat enrichement
-            cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES)
-              .eq(1)
-              .should('be.visible')
-              .and('have.text', '0 fields enriched with threat intelligence'); // TODO work on getting proper IoC data to get proper data here
-          });
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER).should(
+          'have.text',
+          'Threat intelligence'
+        );
+
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES)
+          .eq(0)
+          .should('have.text', '0 threat matches detected'); // TODO work on getting proper IoC data to get proper data here
+
+        // field with threat enrichement
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES)
+          .eq(1)
+          .should('have.text', '0 fields enriched with threat intelligence'); // TODO work on getting proper IoC data to get proper data here
 
         cy.log('should navigate to left panel Threat Intelligence tab');
 
-        // TODO: skipping this section as Cypress can't seem to find the element (though it's in the DOM)
-        // navigateToThreatIntelligenceDetails();
-        // cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_CONTENT).should('be.visible'); // TODO update when we can navigate to Threat Intelligence sub tab directly
+        navigateToThreatIntelligenceDetails();
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB)
+          .should('have.text', 'Insights')
+          .and('have.class', 'euiTab-isSelected');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_THREAT_INTELLIGENCE_BUTTON)
+          .should('have.text', 'Threat intelligence')
+          .and('have.class', 'euiButtonGroupButton-isSelected');
       });
 
-      // TODO: skipping this due to flakiness
-      it.skip('should display correlations section', () => {
+      it('should display correlations section', () => {
         cy.log('link the alert to a new case');
 
         createNewCaseFromExpandableFlyout();
@@ -298,67 +301,64 @@ describe(
 
         cy.log('header and content');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER)
-          .should('be.visible')
-          .and('have.text', 'Correlations');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_CONTENT).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_CONTENT)
-          .should('be.visible')
-          .within(() => {
-            // cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_SUPPRESSED_ALERTS)
-            //   .should('be.visible')
-            //   .and('have.text', '1 suppressed alert'); // TODO populate rule with alert suppression
-            cy.get(
-              DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_ANCESTRY
-            )
-              .should('be.visible')
-              .and('have.text', '1 alert related by ancestry');
-            // cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SAME_SOURCE_EVENT)
-            //   .should('be.visible')
-            //   .and('have.text', '1 alert related by the same source event'); // TODO work on getting proper data to display some same source data here
-            cy.get(
-              DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SESSION
-            )
-              .should('be.visible')
-              .and('have.text', '1 alert related by session');
-            cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_CASES)
-              .should('be.visible')
-              .and('have.text', '1 related case');
-          });
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER).should(
+          'have.text',
+          'Correlations'
+        );
+        // cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_SUPPRESSED_ALERTS)
+        //   .should('be.visible')
+        //   .and('have.text', '1 suppressed alert'); // TODO populate rule with alert suppression
+        cy.get(
+          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_ANCESTRY
+        ).should('have.text', '1 alert related by ancestry');
+        cy.get(
+          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SAME_SOURCE_EVENT
+        ).should('have.text', '1 alert related by source event');
+        cy.get(
+          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SESSION
+        ).should('have.text', '1 alert related by session');
+        cy.get(
+          DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_CASES
+        ).should('have.text', '1 related case');
 
         cy.log('should navigate to left panel Correlations tab');
 
         navigateToCorrelationsDetails();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_CONTENT).should('be.visible'); // TODO update when we can navigate to Correlations sub tab directly
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB)
+          .should('have.text', 'Insights')
+          .and('have.class', 'euiTab-isSelected');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_CORRELATIONS_BUTTON)
+          .should('have.text', 'Correlations')
+          .and('have.class', 'euiButtonGroupButton-isSelected');
       });
 
       // TODO work on getting proper data to make the prevalence section work here
       //  we need to generate enough data to have at least one field with prevalence
-      it.skip('should display prevalence section', () => {
+      it('should display prevalence section', () => {
         toggleOverviewTabAboutSection();
         toggleOverviewTabInvestigationSection();
         toggleOverviewTabInsightsSection();
 
         cy.log('header and content');
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER)
-          .should('be.visible')
-          .and('have.text', 'Prevalence');
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_CONTENT).scrollIntoView();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_CONTENT)
-          .should('be.visible')
-          .within(() => {
-            cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_VALUES)
-              .should('be.visible')
-              .and('have.text', 'is uncommon');
-          });
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER).should(
+          'have.text',
+          'Prevalence'
+        );
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_CONTENT).should(
+          'have.text',
+          'No prevalence data available.'
+        );
 
         cy.log('should navigate to left panel Prevalence tab');
 
         navigateToPrevalenceDetails();
-        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_CONTENT).should('be.visible'); // TODO update when we can navigate to Prevalence sub tab directly
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB)
+          .should('have.text', 'Insights')
+          .and('have.class', 'euiTab-isSelected');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_BUTTON)
+          .should('have.text', 'Prevalence')
+          .and('have.class', 'euiButtonGroupButton-isSelected');
       });
     });
 
@@ -368,7 +368,15 @@ describe(
         toggleOverviewTabInvestigationSection();
         toggleOverviewTabResponseSection();
 
-        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON).should('be.visible');
+        cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON).should(
+          'have.text',
+          'Response'
+        );
+
+        navigateToResponseDetails();
+        cy.get(DOCUMENT_DETAILS_FLYOUT_RESPONSE_TAB)
+          .should('have.text', 'Response')
+          .and('have.class', 'euiTab-isSelected');
       });
     });
   }
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
index 0c1bd2ad48880f..0e1f95b1e23a95 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
@@ -48,7 +48,8 @@ describe('Ransomware Detection Alerts', { tags: ['@ess', '@serverless'] }, () =>
     });
   });
 
-  describe('Ransomware in Timelines', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/170846
+  describe.skip('Ransomware in Timelines', () => {
     before(() => {
       login();
       visitWithTimeRange(TIMELINES_URL);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
index 2bb739cc70d973..1b69b314daf75f 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
@@ -152,7 +152,7 @@ describe('Timelines', (): void => {
     before(() => {
       login();
       visitWithTimeRange(OVERVIEW_URL);
-      openTimelineUsingToggle();
+      createNewTimeline();
     });
 
     it('should show the correct timeline status', { tags: ['@ess', '@serverless'] }, () => {
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel.ts
index 678ed9484fb00b..5b8c8255dffee1 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel.ts
@@ -11,6 +11,8 @@ import {
 } from '@kbn/security-solution-plugin/public/flyout/document_details/left/tabs/test_ids';
 import {
   INSIGHTS_TAB_TEST_ID,
+  INVESTIGATION_TAB_TEST_ID,
+  RESPONSE_TAB_TEST_ID,
   VISUALIZE_TAB_TEST_ID,
 } from '@kbn/security-solution-plugin/public/flyout/document_details/left/test_ids';
 import { getDataTestSubjectSelector } from '../../helpers/common';
@@ -19,6 +21,10 @@ export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB =
   getDataTestSubjectSelector(INSIGHTS_TAB_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_VISUALIZE_TAB =
   getDataTestSubjectSelector(VISUALIZE_TAB_TEST_ID);
+export const DOCUMENT_DETAILS_FLYOUT_INVESTIGATION_TAB =
+  getDataTestSubjectSelector(INVESTIGATION_TAB_TEST_ID);
+export const DOCUMENT_DETAILS_FLYOUT_RESPONSE_TAB =
+  getDataTestSubjectSelector(RESPONSE_TAB_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_VISUALIZE_TAB_BUTTON_GROUP = getDataTestSubjectSelector(
   VISUALIZE_TAB_BUTTON_GROUP_TEST_ID
 );
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
index d288f259f9e2da..e7095ac71b236a 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
@@ -10,7 +10,6 @@ import {
   EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID,
 } from '@kbn/security-solution-plugin/public/flyout/shared/components/test_ids';
 import {
-  ABOUT_SECTION_CONTENT_TEST_ID,
   ABOUT_SECTION_HEADER_TEST_ID,
   DESCRIPTION_DETAILS_TEST_ID,
   DESCRIPTION_TITLE_TEST_ID,
@@ -19,7 +18,6 @@ import {
   HIGHLIGHTED_FIELDS_TITLE_TEST_ID,
   INSIGHTS_HEADER_TEST_ID,
   INVESTIGATION_GUIDE_BUTTON_TEST_ID,
-  INVESTIGATION_SECTION_CONTENT_TEST_ID,
   INVESTIGATION_SECTION_HEADER_TEST_ID,
   MITRE_ATTACK_DETAILS_TEST_ID,
   MITRE_ATTACK_TITLE_TEST_ID,
@@ -28,7 +26,6 @@ import {
   VISUALIZATIONS_SECTION_HEADER_TEST_ID,
   HIGHLIGHTED_FIELDS_CELL_TEST_ID,
   RESPONSE_SECTION_HEADER_TEST_ID,
-  RESPONSE_EMPTY_TEST_ID,
   INSIGHTS_THREAT_INTELLIGENCE_TEST_ID,
   CORRELATIONS_TEST_ID,
   PREVALENCE_TEST_ID,
@@ -51,8 +48,6 @@ import { getDataTestSubjectSelector } from '../../helpers/common';
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_HEADER = getDataTestSubjectSelector(
   ABOUT_SECTION_HEADER_TEST_ID
 );
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_CONTENT =
-  getDataTestSubjectSelector(ABOUT_SECTION_CONTENT_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_TITLE =
   getDataTestSubjectSelector(DESCRIPTION_TITLE_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_DESCRIPTION_DETAILS = getDataTestSubjectSelector(
@@ -77,8 +72,6 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_MITRE_ATTACK_DETAILS = getData
 
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_HEADER =
   getDataTestSubjectSelector(INVESTIGATION_SECTION_HEADER_TEST_ID);
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INVESTIGATION_SECTION_CONTENT =
-  getDataTestSubjectSelector(INVESTIGATION_SECTION_CONTENT_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_HEADER_TITLE =
   getDataTestSubjectSelector(HIGHLIGHTED_FIELDS_TITLE_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_DETAILS =
@@ -100,8 +93,6 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_SECTION_HEADER =
 
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER =
   getDataTestSubjectSelector(EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(INSIGHTS_ENTITIES_TEST_ID));
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_CONTENT =
-  getDataTestSubjectSelector(EXPANDABLE_PANEL_CONTENT_TEST_ID(INSIGHTS_ENTITIES_TEST_ID));
 
 /* Insights Threat Intelligence */
 
@@ -109,10 +100,6 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_H
   getDataTestSubjectSelector(
     EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(INSIGHTS_THREAT_INTELLIGENCE_TEST_ID)
   );
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_CONTENT =
-  getDataTestSubjectSelector(
-    EXPANDABLE_PANEL_CONTENT_TEST_ID(INSIGHTS_THREAT_INTELLIGENCE_TEST_ID)
-  );
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_VALUES =
   getDataTestSubjectSelector(SUMMARY_ROW_VALUE_TEST_ID(INSIGHTS_THREAT_INTELLIGENCE_TEST_ID));
 
@@ -120,8 +107,6 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_V
 
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER =
   getDataTestSubjectSelector(EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(CORRELATIONS_TEST_ID));
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_CONTENT =
-  getDataTestSubjectSelector(EXPANDABLE_PANEL_CONTENT_TEST_ID(CORRELATIONS_TEST_ID));
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_SUPPRESSED_ALERTS =
   getDataTestSubjectSelector(SUMMARY_ROW_VALUE_TEST_ID(CORRELATIONS_SUPPRESSED_ALERTS_TEST_ID));
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_ANCESTRY =
@@ -145,8 +130,6 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER =
   getDataTestSubjectSelector(EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(PREVALENCE_TEST_ID));
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_CONTENT =
   getDataTestSubjectSelector(EXPANDABLE_PANEL_CONTENT_TEST_ID(PREVALENCE_TEST_ID));
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_VALUES =
-  getDataTestSubjectSelector(PREVALENCE_TEST_ID);
 
 /* Visualization section */
 
@@ -163,5 +146,3 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_SECTION_HEADER =
   getDataTestSubjectSelector(RESPONSE_SECTION_HEADER_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON =
   getDataTestSubjectSelector(RESPONSE_BUTTON_TEST_ID);
-export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_SECTION_EMPTY_RESPONSE =
-  getDataTestSubjectSelector(RESPONSE_EMPTY_TEST_ID);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/common.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/common.ts
index f3c0df5cf8f31c..808a508044c5f2 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/common.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/common.ts
@@ -11,6 +11,8 @@ import {
 } from '../../helpers/common';
 
 export const VIEW_CASE_TOASTER_LINK = getDataTestSubjectSelector('toaster-content-case-view-link');
+export const VIEW_CASE_TOASTER_CLOSE_BUTTON = getDataTestSubjectSelector('toastCloseButton');
+export const CREATE_CASE_BUTTON = `[data-test-subj="createNewCaseBtn"]`;
 export const NEW_CASE_NAME_INPUT = `[data-test-subj="input"][aria-describedby="caseTitle"]`;
 export const NEW_CASE_DESCRIPTION_INPUT = getDataTestSubjectSelector('euiMarkdownEditorTextArea');
 export const EXISTING_CASE_SELECT_BUTTON =
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel_overview_tab.ts b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel_overview_tab.ts
index 85b5b9f586e791..7c5a1006e8a3c0 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel_overview_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel_overview_tab.ts
@@ -5,13 +5,6 @@
  * 2.0.
  */
 
-import { EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID } from '@kbn/security-solution-plugin/public/flyout/shared/components/test_ids';
-import {
-  CORRELATIONS_TEST_ID,
-  INSIGHTS_ENTITIES_TEST_ID,
-  PREVALENCE_TEST_ID,
-  INSIGHTS_THREAT_INTELLIGENCE_TEST_ID,
-} from '@kbn/security-solution-plugin/public/flyout/document_details/right/components/test_ids';
 import {
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_VISUALIZATIONS_SECTION_HEADER,
@@ -23,6 +16,11 @@ import {
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_SECTION_HEADER,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_REASON_TITLE,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_OPEN_ALERT_REASON_PREVIEW_BUTTON,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER,
+  DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON,
 } from '../../screens/expandable_flyout/alert_details_right_panel_overview_tab';
 
 /* About section */
@@ -61,36 +59,40 @@ export const toggleOverviewTabInsightsSection = () => {
  * Click on the header in the right section, Insights, Entities
  */
 export const navigateToEntitiesDetails = () => {
-  const TEST_ID = EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(INSIGHTS_ENTITIES_TEST_ID);
-  cy.get(TEST_ID).scrollIntoView();
-  cy.get(TEST_ID).should('be.visible').click();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER).scrollIntoView();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER)
+    .should('be.visible')
+    .click();
 };
 
 /**
  * Click on the header in the right section, Insights, Threat Intelligence
  */
 export const navigateToThreatIntelligenceDetails = () => {
-  const TEST_ID = EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(INSIGHTS_THREAT_INTELLIGENCE_TEST_ID);
-  cy.get(TEST_ID).scrollIntoView();
-  cy.get(TEST_ID).should('be.visible').click();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER).scrollIntoView();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_THREAT_INTELLIGENCE_HEADER)
+    .should('be.visible')
+    .click();
 };
 
 /**
  * Click on the header in the right section, Insights, Correlations
  */
 export const navigateToCorrelationsDetails = () => {
-  const TEST_ID = EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(CORRELATIONS_TEST_ID);
-  cy.get(TEST_ID).scrollIntoView();
-  cy.get(TEST_ID).should('be.visible').click();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER).scrollIntoView();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_HEADER)
+    .should('be.visible')
+    .click();
 };
 
 /**
  * Click on the view all button under the right section, Insights, Prevalence
  */
 export const navigateToPrevalenceDetails = () => {
-  const TEST_ID = EXPANDABLE_PANEL_HEADER_TITLE_LINK_TEST_ID(PREVALENCE_TEST_ID);
-  cy.get(TEST_ID).scrollIntoView();
-  cy.get(TEST_ID).should('be.visible').click();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER).scrollIntoView();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_PREVALENCE_HEADER)
+    .should('be.visible')
+    .click();
 };
 
 /* Visualizations section */
@@ -150,3 +152,11 @@ export const clickAlertReasonButton = () => {
         .click();
     });
 };
+
+/**
+ * Click the Response button to open the response detail tab in the left section
+ */
+export const navigateToResponseDetails = () => {
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON).scrollIntoView();
+  cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON).should('be.visible').click();
+};
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/common.ts b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/common.ts
index bc1d8e1cd8171f..cd244f192bd526 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/common.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/common.ts
@@ -11,6 +11,7 @@ import {
   DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE_CREATE_BUTTON,
   DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE_DESCRIPTION_INPUT,
   DOCUMENT_DETAILS_FLYOUT_FOOTER_ADD_TO_NEW_CASE_NAME_INPUT,
+  VIEW_CASE_TOASTER_CLOSE_BUTTON,
   VIEW_CASE_TOASTER_LINK,
 } from '../../screens/expandable_flyout/common';
 import { openTakeActionButtonAndSelectItem } from './alert_details_right_panel';
@@ -33,4 +34,7 @@ export const createNewCaseFromExpandableFlyout = () => {
 
   // NOTE: wait for case link (case created)
   cy.get(VIEW_CASE_TOASTER_LINK).should('be.visible');
+
+  // NOTE: close pop up to limit interaction with flyout behind
+  cy.get(VIEW_CASE_TOASTER_CLOSE_BUTTON).should('be.visible').click();
 };
diff --git a/x-pack/test/security_solution_cypress/package.json b/x-pack/test/security_solution_cypress/package.json
index 0e34d7867d37a0..e43f32a4475751 100644
--- a/x-pack/test/security_solution_cypress/package.json
+++ b/x-pack/test/security_solution_cypress/package.json
@@ -28,6 +28,7 @@
     "cypress:changed-specs-only:serverless": "yarn cypress:serverless --changed-specs-only --env burn=5",
     "cypress:burn:serverless": "yarn cypress:serverless --env burn=2",
     "cypress:qa:serverless": "TZ=UTC NODE_OPTIONS=--openssl-legacy-provider node ../../plugins/security_solution/scripts/start_cypress_parallel_serverless --config-file ../../test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts",
+    "cypress:open:qa:serverless": "yarn cypress:qa:serverless open",
     "cypress:run:qa:serverless": "yarn cypress:qa:serverless --spec './cypress/e2e/!(investigations|explore)/**/*.cy.ts'",
     "cypress:run:qa:serverless:investigations": "yarn cypress:qa:serverless --spec './cypress/e2e/investigations/**/*.cy.ts'",
     "cypress:run:qa:serverless:explore": "yarn cypress:qa:serverless --spec './cypress/e2e/explore/**/*.cy.ts'"
diff --git a/x-pack/test/spaces_api_integration/common/plugins/spaces_test_plugin/server/index.ts b/x-pack/test/spaces_api_integration/common/plugins/spaces_test_plugin/server/index.ts
index 1db5fe493b35b1..e30ef09b951eef 100644
--- a/x-pack/test/spaces_api_integration/common/plugins/spaces_test_plugin/server/index.ts
+++ b/x-pack/test/spaces_api_integration/common/plugins/spaces_test_plugin/server/index.ts
@@ -7,6 +7,6 @@
 
 import { Plugin } from './plugin';
 
-export function plugin() {
+export async function plugin() {
   return new Plugin();
 }
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 61c42a76f3d9d9..de573976c4cbc5 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -86,7 +86,6 @@
     "@kbn/data-views-plugin",
     "@kbn/datemath",
     "@kbn/safer-lodash-set",
-    "@kbn/securitysolution-rules",
     "@kbn/es-archiver",
     "@kbn/config-schema",
     "@kbn/kubernetes-security-plugin",
@@ -146,5 +145,9 @@
     "@kbn/coloring",
     "@kbn/es",
     "@kbn/metrics-data-access-plugin",
+    "@kbn/reporting-export-types-csv-common",
+    "@kbn/reporting-export-types-pdf-common",
+    "@kbn/reporting-export-types-png-common",
+    "@kbn/reporting-common",
   ]
 }
diff --git a/x-pack/test/ui_capabilities/common/plugins/foo_plugin/server/index.ts b/x-pack/test/ui_capabilities/common/plugins/foo_plugin/server/index.ts
index 7bb8b446dcc79b..4698b8c59c8f48 100644
--- a/x-pack/test/ui_capabilities/common/plugins/foo_plugin/server/index.ts
+++ b/x-pack/test/ui_capabilities/common/plugins/foo_plugin/server/index.ts
@@ -8,7 +8,7 @@
 import { CoreSetup, Plugin } from '@kbn/core/server';
 import { PluginSetupContract as FeaturesPluginSetupContract } from '@kbn/features-plugin/server';
 
-export const plugin = () => new FooPlugin();
+export const plugin = async () => new FooPlugin();
 
 interface SetupDeps {
   features: FeaturesPluginSetupContract;
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/reporting/download_csv_dashboard.ts b/x-pack/test_serverless/api_integration/test_suites/common/reporting/download_csv_dashboard.ts
index 6548b76f08bd5b..b709e3b43bc25e 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/reporting/download_csv_dashboard.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/reporting/download_csv_dashboard.ts
@@ -8,7 +8,7 @@
 import { X_ELASTIC_INTERNAL_ORIGIN_REQUEST } from '@kbn/core-http-common';
 import expect from '@kbn/expect';
 import { INTERNAL_ROUTES } from '@kbn/reporting-plugin/common/constants';
-import { JobParamsDownloadCSV } from '@kbn/reporting-plugin/server/export_types/csv_searchsource_immediate/types';
+import type { JobParamsDownloadCSV } from '@kbn/reporting-export-types-csv-common';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 const ELASTIC_USERNAME = 'elastic_serverless';
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts
index 4aea7f5d670dbe..2b7fc3653c3b62 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts
@@ -6,6 +6,7 @@
  */
 
 import { cleanup, generate } from '@kbn/infra-forge';
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -88,7 +89,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.5],
                 timeSize: 5,
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_no_data.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_no_data.ts
index 2d6e8d63afbf20..4f1e9a4ab080ba 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_no_data.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_no_data.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -74,7 +75,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.5],
                 timeSize: 5,
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
index 1f02377919a8d3..47ed54412296d9 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/custom_eq_avg_bytes_fired.ts
@@ -12,6 +12,7 @@
  */
 
 import { cleanup, generate } from '@kbn/infra-forge';
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -90,7 +91,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.9],
                 timeSize: 1,
@@ -187,7 +188,7 @@ export default function ({ getService }: FtrProviderContext) {
           .eql({
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [0.9],
                 timeSize: 1,
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts
index 5c34258de8c15a..0f47627be5e2bf 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts
@@ -6,6 +6,7 @@
  */
 
 import { cleanup, generate } from '@kbn/infra-forge';
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import {
   Aggregators,
   Comparator,
@@ -84,7 +85,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT,
                 threshold: [2],
                 timeSize: 1,
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/group_by_fired.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/group_by_fired.ts
index 864b35de6f3d46..78daabb1eb1312 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/group_by_fired.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/group_by_fired.ts
@@ -11,6 +11,7 @@
  * 2.0.
  */
 
+import { CUSTOM_AGGREGATOR } from '@kbn/observability-plugin/common/custom_threshold_rule/constants';
 import { kbnTestConfig } from '@kbn/test';
 import moment from 'moment';
 import { cleanup, generate } from '@kbn/infra-forge';
@@ -94,7 +95,7 @@ export default function ({ getService }: FtrProviderContext) {
           params: {
             criteria: [
               {
-                aggType: Aggregators.CUSTOM,
+                aggType: CUSTOM_AGGREGATOR,
                 comparator: Comparator.GT_OR_EQ,
                 threshold: [0.2],
                 timeSize: 1,
diff --git a/x-pack/test_serverless/functional/services/index.ts b/x-pack/test_serverless/functional/services/index.ts
index dd4ec37f21501f..a1c381331f6bc4 100644
--- a/x-pack/test_serverless/functional/services/index.ts
+++ b/x-pack/test_serverless/functional/services/index.ts
@@ -16,6 +16,7 @@ import { SvlCommonScreenshotsProvider } from './svl_common_screenshots';
 import { SvlCasesServiceProvider } from '../../api_integration/services/svl_cases';
 import { MachineLearningProvider } from './ml';
 import { SvlReportingServiceProvider } from './svl_reporting';
+import { LogsSynthtraceProvider } from './log';
 
 export const services = {
   // deployment agnostic FTR services
@@ -31,4 +32,7 @@ export const services = {
   svlCases: SvlCasesServiceProvider,
   svlMl: MachineLearningProvider,
   svlReportingApi: SvlReportingServiceProvider,
+
+  // log services
+  svlLogsSynthtraceClient: LogsSynthtraceProvider,
 };
diff --git a/x-pack/test_serverless/functional/services/log/index.ts b/x-pack/test_serverless/functional/services/log/index.ts
new file mode 100644
index 00000000000000..0aadf7b9bf2923
--- /dev/null
+++ b/x-pack/test_serverless/functional/services/log/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createLogger, LogLevel, LogsSynthtraceEsClient } from '@kbn/apm-synthtrace';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export function LogsSynthtraceProvider(context: FtrProviderContext) {
+  return new LogsSynthtraceEsClient({
+    client: context.getService('es'),
+    logger: createLogger(LogLevel.info),
+    refreshAfterIndex: true,
+  });
+}
diff --git a/x-pack/test_serverless/functional/test_suites/common/management/index_management/create_enrich_policy.ts b/x-pack/test_serverless/functional/test_suites/common/management/index_management/create_enrich_policy.ts
index f5b51c815e0fef..c54baeed370667 100644
--- a/x-pack/test_serverless/functional/test_suites/common/management/index_management/create_enrich_policy.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/management/index_management/create_enrich_policy.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { SLO_SUMMARY_ENRICH_POLICY_NAME } from '@kbn/observability-plugin/server/assets/constants';
 import { FtrProviderContext } from '../../../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
@@ -20,9 +21,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const POLICY_NAME = `policy-${Math.random()}`;
 
   describe('Create enrich policy', function () {
+    // TimeoutError:  Waiting for element to be located By(css selector, [data-test-subj="enrichPoliciesEmptyPromptCreateButton"])
+    this.tags(['failsOnMKI']);
     before(async () => {
       log.debug('Creating test index');
       try {
+        await es.ingest.deletePipeline({ id: '.slo-*' }, { ignore: [404] });
+        await es.enrich.deletePolicy({ name: SLO_SUMMARY_ENRICH_POLICY_NAME }, { ignore: [404] });
         await es.indices.create({
           index: INDEX_NAME,
           body: {
diff --git a/x-pack/test_serverless/functional/test_suites/common/reporting/management.ts b/x-pack/test_serverless/functional/test_suites/common/reporting/management.ts
index c36000889d4812..90be1b602441a7 100644
--- a/x-pack/test_serverless/functional/test_suites/common/reporting/management.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/reporting/management.ts
@@ -6,8 +6,10 @@
  */
 
 import { DISCOVER_APP_LOCATOR } from '@kbn/discover-plugin/common';
-import { CSV_REPORT_TYPE_V2 } from '@kbn/reporting-plugin/common/constants';
-import type { JobParamsCsvFromSavedObject } from '@kbn/reporting-plugin/common/types';
+import {
+  CSV_REPORT_TYPE_V2,
+  JobParamsCsvFromSavedObject,
+} from '@kbn/reporting-export-types-csv-common';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
diff --git a/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/app.ts b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/app.ts
index fc03be6e0c1255..271bba6b45035f 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/app.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/app.ts
@@ -5,15 +5,19 @@
  * 2.0.
  */
 import expect from '@kbn/expect';
+import { log, timerange } from '@kbn/apm-synthtrace-client';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
-export default function ({ getPageObjects }: FtrProviderContext) {
+export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const PageObjects = getPageObjects([
     'observabilityLogExplorer',
     'svlCommonNavigation',
     'svlCommonPage',
   ]);
 
+  const synthtrace = getService('svlLogsSynthtraceClient');
+  const dataGrid = getService('dataGrid');
+
   describe('Application', () => {
     before(async () => {
       await PageObjects.svlCommonPage.login();
@@ -25,6 +29,7 @@ export default function ({ getPageObjects }: FtrProviderContext) {
 
     it('is shown in the global search', async () => {
       await PageObjects.observabilityLogExplorer.navigateTo();
+
       await PageObjects.svlCommonNavigation.search.showSearch();
       await PageObjects.svlCommonNavigation.search.searchFor('log explorer');
 
@@ -33,5 +38,32 @@ export default function ({ getPageObjects }: FtrProviderContext) {
 
       await PageObjects.svlCommonNavigation.search.hideSearch();
     });
+
+    it('should load logs', async () => {
+      const from = '2023-08-03T10:24:14.035Z';
+      const to = '2023-08-03T10:24:14.091Z';
+      const COUNT = 5;
+      await synthtrace.index(generateLogsData({ from, to, count: COUNT }));
+      await PageObjects.observabilityLogExplorer.navigateTo();
+      const docCount = await dataGrid.getDocCount();
+
+      expect(docCount).to.be(COUNT);
+      await synthtrace.clean();
+    });
   });
 }
+
+function generateLogsData({ from, to, count = 1 }: { from: string; to: string; count: number }) {
+  const range = timerange(from, to);
+
+  return range
+    .interval('1m')
+    .rate(1)
+    .generator((timestamp) =>
+      Array(count)
+        .fill(0)
+        .map(() => {
+          return log.create().message('A sample log').timestamp(timestamp);
+        })
+    );
+}
diff --git a/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/flyout_highlights.ts b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/flyout_highlights.ts
new file mode 100644
index 00000000000000..98a3914fed4e8d
--- /dev/null
+++ b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/flyout_highlights.ts
@@ -0,0 +1,291 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+const DATASET_NAME = 'flyout';
+const NAMESPACE = 'default';
+const DATA_STREAM_NAME = `logs-${DATASET_NAME}-${NAMESPACE}`;
+const NOW = Date.now();
+
+const sharedDoc = {
+  time: NOW + 1000,
+  logFilepath: '/flyout.log',
+  serviceName: 'frontend-node',
+  datasetName: DATASET_NAME,
+  namespace: NAMESPACE,
+  message: 'full document',
+  logLevel: 'info',
+  traceId: 'abcdef',
+  hostName: 'gke-edge-oblt-pool',
+  orchestratorClusterId: 'my-cluster-id',
+  orchestratorClusterName: 'my-cluster-id',
+  orchestratorResourceId: 'orchestratorResourceId',
+  cloudProvider: 'gcp',
+  cloudRegion: 'us-central-1',
+  cloudAz: 'us-central-1a',
+  cloudProjectId: 'elastic-project',
+  cloudInstanceId: 'BgfderflkjTheUiGuy',
+  agentName: 'node',
+};
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dataGrid = getService('dataGrid');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['observabilityLogExplorer', 'svlCommonPage']);
+
+  describe('Flyout highlight customization', () => {
+    let cleanupDataStreamSetup: () => Promise<void>;
+
+    describe('Service container', () => {
+      const { serviceName, traceId, ...rest } = sharedDoc;
+      const docWithoutServiceName = { ...rest, traceId, time: NOW - 1000 };
+      const docWithoutTraceId = { ...rest, serviceName, time: NOW - 2000 };
+      const docWithoutServiceContainer = { ...rest, time: NOW - 4000 };
+
+      const docs = [
+        sharedDoc,
+        docWithoutServiceName,
+        docWithoutTraceId,
+        docWithoutServiceContainer,
+      ];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+        await PageObjects.svlCommonPage.login();
+      });
+
+      after('clean up DataStream', async () => {
+        await PageObjects.svlCommonPage.forceLogout();
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the service container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.existOrFail('logExplorerFlyoutService');
+        await testSubjects.existOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the service container even when 1 field is missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.missingOrFail('logExplorerFlyoutService');
+        await testSubjects.existOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the service container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 3 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionService');
+        await testSubjects.missingOrFail('logExplorerFlyoutService');
+        await testSubjects.missingOrFail('logExplorerFlyoutTrace');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Infrastructure container', () => {
+      const { hostName, orchestratorClusterName, orchestratorResourceId, ...rest } = sharedDoc;
+      const docWithoutHostName = {
+        ...rest,
+        orchestratorClusterName,
+        orchestratorResourceId,
+        time: NOW - 1000,
+      };
+      const docWithoutInfrastructureContainer = { ...rest, time: NOW - 2000 };
+
+      const docs = [sharedDoc, docWithoutHostName, docWithoutInfrastructureContainer];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+        await PageObjects.svlCommonPage.login();
+      });
+
+      after('clean up DataStream', async () => {
+        await PageObjects.svlCommonPage.forceLogout();
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the infrastructure container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.existOrFail('logExplorerFlyoutHostName');
+        await testSubjects.existOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.existOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the infrastructure container even when 1 field is missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.missingOrFail('logExplorerFlyoutHostName');
+        await testSubjects.existOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.existOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the infrastructure container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 2 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionInfrastructure');
+        await testSubjects.missingOrFail('logExplorerFlyoutHostName');
+        await testSubjects.missingOrFail('logExplorerFlyoutClusterName');
+        await testSubjects.missingOrFail('logExplorerFlyoutResourceId');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Cloud container', () => {
+      const { cloudProvider, cloudInstanceId, cloudProjectId, cloudRegion, cloudAz, ...rest } =
+        sharedDoc;
+      const docWithoutCloudProviderAndInstanceId = {
+        ...rest,
+        cloudProjectId,
+        cloudRegion,
+        cloudAz,
+        time: NOW - 1000,
+      };
+      const docWithoutCloudContainer = { ...rest, time: NOW - 2000 };
+
+      const docs = [sharedDoc, docWithoutCloudProviderAndInstanceId, docWithoutCloudContainer];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+        await PageObjects.svlCommonPage.login();
+      });
+
+      after('clean up DataStream', async () => {
+        await PageObjects.svlCommonPage.forceLogout();
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the cloud container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionCloud');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProjectId');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudInstanceId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the cloud container even when some fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionCloud');
+
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudInstanceId');
+
+        await testSubjects.existOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.existOrFail('logExplorerFlyoutCloudProjectId');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should not load the cloud container if all fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 2 });
+        await testSubjects.missingOrFail('logExplorerFlyoutHighlightSectionCloud');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProvider');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudRegion');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudAz');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudProjectId');
+        await testSubjects.missingOrFail('logExplorerFlyoutCloudInstanceId');
+        await dataGrid.closeFlyout();
+      });
+    });
+
+    describe('Other container', () => {
+      const { logFilepath, agentName, ...rest } = sharedDoc;
+      const docWithoutLogPathAndAgentName = {
+        ...rest,
+        time: NOW - 1000,
+      };
+
+      const docs = [sharedDoc, docWithoutLogPathAndAgentName];
+      before('setup DataStream', async () => {
+        cleanupDataStreamSetup = await PageObjects.observabilityLogExplorer.setupDataStream(
+          DATASET_NAME,
+          NAMESPACE
+        );
+        await PageObjects.observabilityLogExplorer.ingestLogEntries(DATA_STREAM_NAME, docs);
+        await PageObjects.svlCommonPage.login();
+      });
+
+      after('clean up DataStream', async () => {
+        await PageObjects.svlCommonPage.forceLogout();
+        if (cleanupDataStreamSetup) {
+          await cleanupDataStreamSetup();
+        }
+      });
+
+      beforeEach(async () => {
+        await PageObjects.observabilityLogExplorer.navigateTo({
+          from: new Date(NOW - 60_000).toISOString(),
+          to: new Date(NOW + 60_000).toISOString(),
+        });
+      });
+
+      it('should load the other container with all fields', async () => {
+        await dataGrid.clickRowToggle();
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionOther');
+        await testSubjects.existOrFail('logExplorerFlyoutLogPathFile');
+        await testSubjects.existOrFail('logExplorerFlyoutNamespace');
+        await testSubjects.existOrFail('logExplorerFlyoutDataset');
+        await testSubjects.existOrFail('logExplorerFlyoutLogShipper');
+        await dataGrid.closeFlyout();
+      });
+
+      it('should load the other container even when some fields are missing', async () => {
+        await dataGrid.clickRowToggle({ rowIndex: 1 });
+        await testSubjects.existOrFail('logExplorerFlyoutHighlightSectionOther');
+
+        await testSubjects.missingOrFail('logExplorerFlyoutLogPathFile');
+        await testSubjects.missingOrFail('logExplorerFlyoutLogShipper');
+
+        await testSubjects.existOrFail('logExplorerFlyoutNamespace');
+        await testSubjects.existOrFail('logExplorerFlyoutDataset');
+        await dataGrid.closeFlyout();
+      });
+    });
+  });
+}
diff --git a/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/index.ts b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/index.ts
index 6e0b6508696809..9f3d9b7e39c86a 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/observability_log_explorer/index.ts
@@ -16,5 +16,7 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./filter_controls'));
     loadTestFile(require.resolve('./flyout'));
     loadTestFile(require.resolve('./header_menu'));
+    loadTestFile(require.resolve('./header_menu'));
+    loadTestFile(require.resolve('./flyout_highlights.ts'));
   });
 }
diff --git a/x-pack/test_serverless/tsconfig.json b/x-pack/test_serverless/tsconfig.json
index e587356636d610..b4fdeb93c91cf9 100644
--- a/x-pack/test_serverless/tsconfig.json
+++ b/x-pack/test_serverless/tsconfig.json
@@ -63,5 +63,8 @@
     "@kbn/cloud-security-posture-plugin",
     "@kbn/reporting-plugin",
     "@kbn/management-settings-ids",
+    "@kbn/apm-synthtrace",
+    "@kbn/apm-synthtrace-client",
+    "@kbn/reporting-export-types-csv-common",
   ]
 }
diff --git a/yarn.lock b/yarn.lock
index a932e8766f44a0..cb1e4e12d11650 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3000,6 +3000,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/analytics-collection-utils@link:packages/analytics/utils/analytics_collection_utils":
+  version "0.0.0"
+  uid ""
+
 "@kbn/analytics-ftr-helpers-plugin@link:test/analytics/plugins/analytics_ftr_helpers":
   version "0.0.0"
   uid ""
@@ -4148,6 +4152,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/dataset-quality-plugin@link:x-pack/plugins/dataset_quality":
+  version "0.0.0"
+  uid ""
+
 "@kbn/datemath@link:packages/kbn-datemath":
   version "0.0.0"
   uid ""
@@ -4552,10 +4560,6 @@
   version "0.0.0"
   uid ""
 
-"@kbn/generate-csv-types@link:packages/kbn-generate-csv-types":
-  version "0.0.0"
-  uid ""
-
 "@kbn/generate-csv@link:packages/kbn-generate-csv":
   version "0.0.0"
   uid ""
@@ -5252,10 +5256,46 @@
   version "0.0.0"
   uid ""
 
+"@kbn/reporting-export-types-csv-common@link:packages/kbn-reporting/export_types/csv_common":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-export-types-csv@link:packages/kbn-reporting/export_types/csv":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-export-types-pdf-common@link:packages/kbn-reporting/export_types/pdf_common":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-export-types-pdf@link:packages/kbn-reporting/export_types/pdf":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-export-types-png-common@link:packages/kbn-reporting/export_types/png_common":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-export-types-png@link:packages/kbn-reporting/export_types/png":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-mocks-server@link:packages/kbn-reporting/mocks_server":
+  version "0.0.0"
+  uid ""
+
 "@kbn/reporting-plugin@link:x-pack/plugins/reporting":
   version "0.0.0"
   uid ""
 
+"@kbn/reporting-public@link:packages/kbn-reporting/public":
+  version "0.0.0"
+  uid ""
+
+"@kbn/reporting-server@link:packages/kbn-reporting/server":
+  version "0.0.0"
+  uid ""
+
 "@kbn/resizable-layout-examples-plugin@link:examples/resizable_layout_examples":
   version "0.0.0"
   uid ""
@@ -6044,6 +6084,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/unsaved-changes-badge@link:packages/kbn-unsaved-changes-badge":
+  version "0.0.0"
+  uid ""
+
 "@kbn/upgrade-assistant-plugin@link:x-pack/plugins/upgrade_assistant":
   version "0.0.0"
   uid ""
@@ -11443,11 +11487,16 @@ axe-core@^3.5.5:
   resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-3.5.6.tgz#e762a90d7f6dbd244ceacb4e72760ff8aad521b5"
   integrity sha512-LEUDjgmdJoA3LqklSTwKYqkjcZ4HKc4ddIYGSAiSkr46NTjzg2L9RNB+lekO9P7Dlpa87+hBtzc2Fzn/+GUWMQ==
 
-axe-core@^4.2.0, axe-core@^4.6.1, axe-core@^4.6.2:
+axe-core@^4.2.0, axe-core@^4.6.2:
   version "4.7.2"
   resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.7.2.tgz#040a7342b20765cb18bb50b628394c21bccc17a0"
   integrity sha512-zIURGIS1E1Q4pcrMjp+nnEh+16G56eG/MUllJH8yEvw7asDo7Ac9uhC9KIH5jzpITueEZolfYglnCGIuSBz39g==
 
+axe-core@^4.8.2:
+  version "4.8.2"
+  resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.8.2.tgz#2f6f3cde40935825cf4465e3c1c9e77b240ff6ae"
+  integrity sha512-/dlp0fxyM3R8YW7MFzaHWXrf4zzbr0vaYb23VBFCl83R7nWNPg/yaQw2Dc8jzCMmDVLhSdzH8MjrsuIUuvX+6g==
+
 axios@^0.21.1:
   version "0.21.4"
   resolved "https://registry.yarnpkg.com/axios/-/axios-0.21.4.tgz#c67b90dc0568e5c1cf2b0b858c43ba28e2eda575"